Privacy

Last updated 1 November 2026.

This notice explains what the DeskAuth app and the deskauth.com website collect. DeskAuth is an open-source project maintained by Nick Morphis. For questions or requests about your data, open an issue on GitHub.

The DeskAuth app

The DeskAuth app has no account and keeps your authenticators in an encrypted file on your computer. It never sends your authenticators, their names, codes or secret keys, your passwords, or anything about the websites you use.

The app connects to the internet only:

• when you use Get icon. It downloads the page or image at the address you entered, directly from that website, which will see a request from your computer.
• to check for a new version when it starts, unless you turn this off.
• to send anonymous usage statistics, if you agree to it.

Checking for a new version

Each time DeskAuth starts, it asks GitHub for the latest published release of DeskAuth, and tells you if it is newer than the one you have. The request contains only the DeskAuth version, and GitHub sees your IP address as with any download, as described in the GitHub General Privacy Statement. To stop, untick Check for updates in DeskAuth's options menu (the gear button).

Anonymous usage statistics

DeskAuth asks the first time it opens whether you want to send anonymous usage statistics. Nothing is sent unless you choose Send statistics; if you close the question without choosing, DeskAuth asks again next time.

If you agree, at most once a day when DeskAuth starts, it sends:

• a random ID created for your copy of DeskAuth, so that repeat use counts as one user. It is not linked to you, your computer or your accounts.
• the DeskAuth version
• the Windows version and processor type, for example Windows 11 on an x64 processor

We use these only to count how many people install and use DeskAuth, and which versions of DeskAuth and Windows to support. They are collected with Google Analytics, in a separate property from the website, with advertising features turned off. As with the website, Google receives your IP address with each report but does not store it, and the data is kept for 2 months.

To stop, untick Send anonymous usage statistics in DeskAuth's options menu (the gear button). DeskAuth then stops sending and deletes its random ID, so if you agree again later you are counted as a new user. Your choice and the random ID are stored in your DeskAuth file.

The deskauth.com website

Hosting

The website is hosted by GitHub Pages, and its domain name is served by Cloudflare. GitHub may record the IP address of visitors for security and to keep the service running, as described in the GitHub General Privacy Statement. Downloads come from GitHub releases on the same terms.

Cloudflare Web Analytics

We use Cloudflare Web Analytics to count visits. It records which pages are viewed, the website you came from, your country, your browser and device type, and how quickly pages load. It does not use cookies, does not store anything on your device, and does not identify or track you across websites. We use it because it lets us see how many people use the site without asking you to accept cookies. See the Cloudflare privacy policy.

Google Analytics, only if you accept

If you choose Accept in the cookie banner, we also use Google Analytics to understand how people find and use the site. It sets cookies named _ga and _ga_WQHNE1ETW3, which let it recognize repeat visits, and records:

• the pages you view and how you arrived at the site
• your approximate location, such as country and city. Google Analytics works this out from your IP address but does not store the address.
• your browser, operating system, device type and screen size
• actions such as scrolling, following links to other sites and downloading files

We use this information only for statistics about the website. It is not used for advertising or to build a profile of you, and advertising features are turned off. Google Analytics data is kept for 2 months. Google processes it on our behalf and may store it outside your country; see how Google uses information from sites that use its services and the Google Privacy Policy.

If you choose Decline, or don't choose, Google Analytics is not loaded and sets no cookies. If your browser sends a Global Privacy Control signal, we treat it as declining.

Your choice

The website remembers your choice in your browser's local storage, under deskauth-analytics-consent. It is not a cookie and is never sent to us.

You can change your mind at any time with Cookie settings, at the bottom of every page. Declining removes the Google Analytics cookies. You can also clear this site's data in your browser, or install Google's Google Analytics opt-out browser add-on.

Your rights

Depending on where you live, you may have the right to ask what data is held about you, and to have it corrected or deleted. We don't hold any data that identifies you; Google Analytics data is linked only to a random identifier in its cookie. Open an issue on GitHub, without including personal details, and we'll help with any request. You can also complain to your local data protection authority.

Changes

If we change what the website or app collects, we'll update this page and the date at the top.