WWWveilig 2FA API · https://api.wwwveilig.nl
Privacy policy — WWWveilig Authenticator
Last updated: 28 August 2026
WWWveilig Authenticator is a two-factor authentication app. It shows six-digit codes and lets you approve or deny sign-in requests for applications you already have an account with. This policy describes exactly what the app and its API store, and why.
Who is responsible
The app and the API at api.wwwveilig.nl are operated by WWWveilig. For
questions about this policy or your data, contact privacy@wwwveilig.nl.
What stays on your phone only
- The secret keys used to generate your six-digit codes. They are held in the operating system's secure storage (iOS Keychain, Android Keystore) and are used entirely on the device. Codes are generated offline; generating a code sends nothing anywhere.
- The address of the API your accounts belong to.
The app has no account of its own. There is no username, no password and no sign-up.
What the API stores
When an application you use links your phone as its second factor, the service stores:
| Data | Why |
|---|---|
| A user reference supplied by that application | To know which of its users this phone belongs to. It is that application's own identifier, not your name. |
| An optional label (often your e-mail address) | So you can tell your accounts apart in the app. Supplied by the application, not by us. |
| An encrypted copy of the secret key | To verify the codes you enter. Encrypted at rest. |
| Your device name, platform and app version | So you can recognise your phone and we can support it. |
| A push notification token | To deliver approval requests to your phone. |
| For each sign-in request: time, status, IP address, and any location text the application supplied | To show you where a request came from, and as a security record. |
We keep a security log of events such as "code verified", "request approved" and "enrollment revoked", including the IP address involved. Security log entries are deleted automatically after 180 days.
Requests for addresses that do not exist
When something asks this service for an address it does not have, we answer with a short "not allowed" page and record the request: the IP address it actually came from, the browser or program's identification, the address that was asked for, and the time. We do this to notice scanning and repeated probing of the service, which is a legitimate interest in keeping it secure (Article 6(1)(f) GDPR). These records are about the request, not about an account -- we do not try to work out who sent it, and they are not combined with anything else. They are deleted automatically after 90 days.
What we do not do
- We do not sell or rent your data.
- We do not use advertising, tracking or analytics of any kind.
- We do not profile you or make automated decisions about you.
- We do not ask for your name, address, phone number or date of birth.
- We do not have access to the accounts you protect — only the application you are signing in to knows who you are.
Who else is involved
Push notifications are delivered through the operating system vendor's service — Apple Push Notification service on iOS, Firebase Cloud Messaging on Android — and where configured, Expo's push relay. Those services receive the notification token and the text of the notification in order to deliver it. Nothing else is shared with any third party.
The service runs on servers in the European Union.
How long we keep things
- Enrollment data: until the account is removed from the app or the operator of the application switches your two-factor authentication off.
- Sign-in requests: they expire within minutes; the record is kept as part of the security log.
- Security log: 180 days, then deleted automatically.
- Requests for non-existent addresses: 90 days, then deleted automatically.
Your rights
Under the GDPR you may request access to, correction of, or deletion of your data, and you may object to its processing. Because the service only ever knows you through an identifier given to it by the application you sign in to, the fastest route is usually that application's own account settings.
You can always remove data yourself:
- Remove one account: in the app, Settings → the account → Remove. This deletes the secret and unlinks the phone.
- Remove everything: Settings → Reset this phone.
- Full erasure request: see Deleting your data or e-mail privacy@wwwveilig.nl.
You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Secret keys are encrypted before storage. Every six-digit code can be used only once. Approval requests expire within minutes and are tied to a single device. All traffic uses TLS.
Changes
If this policy changes materially we will update the date at the top and, where the change affects you, note it in the app.