WWWveilig
EN

Authenticator 2FA · Privacy

WWWveilig Authenticator privacy statement

WWWveilig Authenticator is a two-factor authentication app: it shows six-digit codes and lets you approve or deny sign-in requests for applications you already have an account with. Here you can read exactly what the app and its API store, and why.

Last updated: 3 November 2026

This is a translation of the Dutch privacy statement. If the two differ, the Dutch version applies.

Who is responsible

The app and the API at api.wwwveilig.nl are a service of WWWveilig, part of EVweb BV. EVweb BV is responsible for the processing of personal data by the app and the API.

EVweb BV / Centerdesk / WWWveilig
Bijlestaal 44M
1721 PW Broek op Langedijk
Netherlands

Questions about this statement or about your data? Email privacy@wwwveilig.nl.

What stays on your phone only

  • The secret keys used to calculate your six-digit codes. They are held in the operating system's secure storage (iOS Keychain, Android Keystore) and used on the device only. Making a code happens offline and sends nothing anywhere.
  • The address of the API your accounts belong to.

The app has no account of its own. There is no username, no password and no sign-up.

What the API stores

When an application links your phone as its second step, the service stores:

  • A user reference from that application: to know which of its users this phone belongs to. It is that application's own identifier, not your name.
  • An optional label (often your email address): so you can tell your accounts apart in the app. Supplied by the application, not by us.
  • An encrypted copy of the secret key: to check the codes you enter. Encrypted at rest.
  • Your device's name, platform and app version: so you can recognise your phone and we can support it.
  • A push notification token: to deliver approval requests to your phone.
  • For each sign-in request: time, status, IP address and any location text the application supplied: to show you where a request came from, and as a security record.

We keep a security log of events such as "code verified", "request approved" and "link revoked", with the IP address involved. Security log entries are deleted automatically after 180 days.

Requests for addresses that do not exist

When something asks the service for an address it does not have, we answer with a short "not allowed" page and record the request: the IP address it actually came from, the browser or program's identification, the address asked for and the time. This is how we notice scanning and repeated probing of the service, which is our legitimate interest in keeping it secure (Article 6(1)(f) GDPR). These records are about the request, not about an account: we do not try to work out who sent it and we do not combine them with other data. They are deleted automatically after 90 days.

Demo sign-in for app reviewers

The first screen of a phone without accounts shows Demo account (app review). It is meant for the reviewers of Google Play and the App Store. What you enter there (email address and password) goes to our demo site m.centerdesk.nl, which only accepts its own review accounts and pairs the phone with one. Normal users do not need this screen.

What we do not do

  • We do not sell or rent your data.
  • We do not use advertising, tracking or analytics.
  • We do not profile you or make automated decisions about you.
  • We do not ask for your name, address, phone number or date of birth.
  • We have no access to the accounts you protect: only the application you sign in to knows who you are.

Who else is involved

Push notifications are delivered through the operating system maker's service: Apple Push Notification service on iOS and Firebase Cloud Messaging on Android, and where configured through Expo's push relay. Those services receive the notification token and the text of the notification in order to deliver it. We share nothing else with third parties.

The service runs on servers in the European Union.

How long we keep things

  • Link data: until the account is removed from the app or the operator of the application switches your two-step verification off.
  • Sign-in requests: they expire within minutes; the record stays part of the security log.
  • Security log: 180 days, then deleted automatically.
  • Requests for non-existent addresses: 90 days, then deleted automatically.

Your rights

Under the GDPR you can ask for access to, correction of or deletion of your data, and object to its processing. The service only knows you through an identifier from the application you sign in to, so the quickest route is usually that application's own account settings.

You can always remove data yourself:

  • Remove one account: in the app, Settings → the account → Remove. This deletes the secret key and unlinks the phone.
  • Remove everything: Settings → Reset this phone.
  • Full erasure request: see Deleting your data, or email privacy@wwwveilig.nl.

You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

Secret keys are stored encrypted. Every six-digit code can be used only once. Approval requests expire within minutes and are tied to a single device. All traffic uses TLS.

Changes

If this statement changes materially, we update the date at the top and, where it affects you, mention it in the app.