Welcome to LazyCoffee TOTP Authenticator (referred to as "the App" or "the Service"). Two-factor authentication (2FA / TOTP) secrets are critical digital security assets. Please review this Privacy Policy and Compliance Statement prior to installation and use.
Developer & Operator: LazyCoffee Team.
Core Principle: The App strictly adheres to Data Minimization and Zero Tracking. All cryptographic calculations are performed locally on your device, ensuring maximum confidentiality of your authentication credentials.
1. Data Minimization & Privacy-First Principle
LazyCoffee TOTP collects only the absolute minimum dataset necessary to operate authentication and synchronization services:
- Account Identity Information: When you choose to enable cloud encrypted synchronization, we collect only your phone number or email address (for unique account identification and secure login), and a one-way password hash using industry-standard bcrypt with salt (irreversible; we never possess your plaintext password).
- Two-Factor Authentication Credentials: Account names, issuer tags, and TOTP secret keys added to the App remain strictly encrypted in storage and throughout cloud transit.
- What We Never Collect: We never collect your real legal name, government ID numbers, bank card details, address books, SMS contents, GPS location, call logs, device application lists, or photo albums.
2. Two-Factor Authentication (TOTP) Data Security
- RFC 6238 Industry Standards: TOTP algorithms strictly conform to RFC 6238 and RFC 4226 international standards established by the Internet Engineering Task Force (IETF).
- Local Real-Time Computations: 6-digit dynamic codes are computed entirely inside your local device processor sandbox every 30 seconds (or custom period), working smoothly even in offline / airplane mode. Secret keys are never exposed in plaintext to our servers or third parties.
- Encrypted Transport & Sandboxing: Local records are safeguarded via OS-level sandbox encryption. Cloud data synchronization is protected end-to-end via TLS 1.3 modern encryption channels.
3. Device Permissions & System Services
Operating under the principle of minimal authorization, permissions are requested only upon explicit user actions:
| Permission | System Identifier | Purpose & Usage Scenario |
|---|---|---|
| Camera | CAMERA / NSCameraUsageDescription |
Requested solely when you tap "Scan QR Code" to import otpauth:// URI keys. The camera is never accessed in the background and no photographs are captured or stored. |
| Biometrics | USE_BIOMETRIC / LocalAuthentication |
Used strictly when you enable "App Lock" to authenticate via Face ID or Fingerprint. Verification is performed on-device by the Secure Enclave / TEE; the App has no access to raw biometric data. |
| Network Access | INTERNET |
Used for encrypted multi-device synchronization with the dedicated LazyCoffee server, authentication, and checking for updates. |
| Clipboard Access | System Clipboard | Invoked only when you tap "Copy Code" or "Copy Secret" to write the 6-digit dynamic code to the clipboard for convenience. The App strictly never reads or inspects your clipboard contents. |
4. Zero-Tracking Commitment & Third-Party SDK / Open-Source Component Disclosure
- Zero Commercial Tracking SDKs: Built with an independent, pure architecture, the App does not integrate any commercial advertising SDKs, push tracking SDKs, or behavioral profiling/analytics SDKs.
- No Cross-App Data Brokering: We never sell, rent, or share user behavioral traces, device fingerprints, or authentication assets with any commercial entities.
- Dedicated Communications: All network communications are strictly bounded to the official LazyCoffee dedicated domain (
https://totp.lazycoffee.com).
To ensure robust, secure, and performant local operations, the App integrates the following minimal system libraries strictly under the principle of data minimization:
| Component | Provider | Usage & Purpose | Data Collected | Website / Notice |
|---|---|---|---|---|
| Tencent MMKV | Shenzhen Tencent Computer Systems Co., Ltd. | High-performance local key-value encrypted persistent storage sandbox | None (Fully local, no telemetry) | Homepage |
| Google ML Kit Vision | Google LLC | On-device offline scanning and parsing of otpauth:// QR codes |
None (Processed strictly on-device, no cloud transmission) | Documentation |
5. Account Deletion & User Data Rights
You maintain complete autonomy and legal rights over your digital authentication assets:
- Local Data Wiping: You may at any time clear local cache, reset biometric security locks, and wipe all local TOTP records within the Settings page.
- Account Deletion & Permanent Purge: When logged in, you may permanently delete your account directly via [Settings] -> [Delete Account] located at the bottom of the account section. After reviewing the terms and verifying your password, your account will be immediately deleted. All associated cloud backups, credentials, and personal data will be irreversibly and physically destroyed immediately. Should the same phone number or credentials be registered again in the future, it will be treated strictly as a brand-new user with zero historical data residuals, eliminating any risk of legacy data leakage. You may also request manual assistance at
support@lazycoffee.com(processed within 3 business days). - Encrypted Data Export: You can export your credentials as encrypted backups to seamlessly migrate to any RFC-compliant 2FA tools. We recommend exporting a local backup prior to account deletion.
6. Protection of Minors
LazyCoffee TOTP is intended for users who have the capacity to manage digital security credentials.
- If you are under the age of 14 (or the legal age of majority in your jurisdiction), please read this policy under the supervision of a parent or legal guardian and obtain their consent before using the Service.
- We do not knowingly collect personal information from minors. If a guardian becomes aware that a minor has provided data without consent, please contact us and we will promptly delete the data.
7. Security Standards & Legal Compliance
LazyCoffee TOTP is developed and operated in accordance with the Personal Information Protection Law (PIPL) and the EU General Data Protection Regulation (GDPR). We apply strict least-privilege access controls, cryptographic standards, and technical safeguards against unauthorized access, disclosure, or destruction.
8. Updates & Notifications
We may revise this Privacy Policy to reflect regulatory changes or service enhancements. Any material changes will be announced in advance via in-app dialogs, service notices, or on this static webpage. Continued use of the Service signifies acceptance of the revised terms.
9. Developer Information & Contact
If you have questions, feedback, or compliance inquiries regarding this Privacy Policy, please contact our security team:
- Developer / Operating Entity: Dongguan Lizhi Kafei Software Development Co., Ltd. (东莞礼知咔啡软件开发有限公司)
- Brand & Engineering Team: LazyCoffee Team
- ICP Filing / License: 粤ICP备13049010号-3
- Registered Address: Dongguan, Guangdong, China
- Privacy & Compliance Contact: support@lazycoffee.com