Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is

Further details are in the legal notice.

Website

Hosting

This website runs together with the web app on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which acts on our behalf (Art. 28 GDPR). When you visit it, technically necessary access data such as your IP address, the time of access and the page requested are processed. The legal basis is our legitimate interest in providing the website securely and efficiently (Art. 6(1)(f) GDPR). No data is transferred to third countries in the process.

Server log files

The hosting provider automatically stores information your browser transmits: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the request and IP address. This data is not combined with other data sources and is used for technical provision and security (Art. 6(1)(f) GDPR).

Fonts

The “Inter” font is loaded locally from our own server. No connections are made to third-party servers such as Google Fonts.

Cookies and local storage

The website sets no cookies. In your browser’s local storage (localStorage) we only store your choice in the privacy settings and, if you change it yourself, your preferred language, so we don’t ask you again on every visit. This is technically necessary (§ 25(2) no. 2 TDDDG).

Audience measurement with FABULOUS ANALYTICS (only with consent)

If you agree in the privacy settings, we use FABULOUS ANALYTICS (app.fabulous-analytics.com), a service of the FABULOUS group of companies, Conventstraße 15, 22089 Hamburg, Germany, to count anonymously how our website is used. Without your consent, the analytics script is not loaded.

The following is transmitted: the page visited, the referring page (referrer), campaign parameters in the address (e.g. utm_source), your browser’s time zone and language, the screen width, time on page and scroll depth, and a random identifier for the individual page view. Browser and device type are derived from your browser’s user agent; the user agent itself is not stored. FABULOUS ANALYTICS sets no cookies, stores nothing on your device, stores no IP addresses, uses no fingerprinting and does not recognise you across visits or websites. Your IP address is only processed briefly for the technical transmission.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future by opening “Privacy settings” at the bottom of the page and choosing “Decline”. The statistics collected contain no data that identifies you.

FABULOUS 2FA service

FABULOUS 2FA is an authenticator app: you store the two-factor authentication (2FA) credentials of your online accounts, for example at GitHub, Google or Amazon, in your FABULOUS 2FA account. This makes them available in the web app and in the apps for iPhone and Android, and the one-time codes are calculated on your device. Unless stated otherwise, processing the following data is necessary to provide the service (Art. 6(1)(b) GDPR).

Hosting of the service

The web app and the interface for the apps run on the same server of Hetzner Online GmbH as this website (see above). Server log files are created on access as described above.

Your account

When you register, we store your name, your email address and your password. The password is only stored as a cryptographic hash, never in plain text. We also store your settings (e.g. language, design, list sorting) as well as the time of registration and of your last sign-in. The service is intended for people aged 16 and over.

When you accept our terms, we store the version of the terms and the time of your acceptance so we can prove which version you agreed to (Art. 6(1)(b) and (f) GDPR).

If an account violates our terms or misuse is suspected, we may suspend it. For this we store a suspension note with time and reason (Art. 6(1)(f) GDPR, legitimate interest in secure and lawful operation).

Your 2FA accounts

For each 2FA account you add, we store the name of the service (e.g. “GitHub”), the account name (e.g. your email address or user name at that service), the secret key and the technical settings (TOTP or HOTP, algorithm, number of digits, period or counter). Optionally, we store a note, the service’s website, the group, the favorite flag, the order and the time you last copied a code.

Secret keys and notes are stored in our database encrypted with libsodium (XSalsa20-Poly1305). So that your devices can calculate the codes, our server decrypts the keys while you are signed in and transmits them to your web app or app exclusively over encrypted connections. To detect duplicate entries, we also store a hash (fingerprint) of the key from which the key cannot be derived.

The data in your 2FA accounts may contain personal data about you, for example which services you have an account with. We only use it to provide the service to you and do not analyse it.

Camera, QR codes and import

To scan QR codes, the web app or app accesses your device’s camera once you allow it. The camera image and any images you select or drop in for scanning (e.g. screenshots) are processed only on your device and are not transmitted to us. Only the decoded text of the QR code (e.g. an otpauth link or the export code from Google Authenticator) is sent to our server so we can create the accounts it contains. The same applies to backups from other apps (e.g. Aegis or 2FAS) and to links you paste.

You can revoke camera permission at any time in your browser or device settings. You can still enter accounts manually.

Export (backup)

You can export all 2FA accounts as a file (JSON file or list of otpauth links). You have to enter your password again first. The file is saved on your device and contains your secret keys unencrypted, so keep it safe. After every export we send you a security email (see below).

Service logos

To show the logo of the respective service next to your 2FA accounts, our server requests the icon of the corresponding domain (e.g. “github.com”) from Google LLC’s favicon service or directly from the respective website. The domain is taken from the website you enter or derived from the name of the service or account. Only the domain name is transmitted, no data about you and not your IP address. Your browser or app does not connect to any third party for this. No request is made for addresses of large email providers such as Gmail or Outlook. Logos are cached for up to 30 days. The legal basis is our legitimate interest in a clear presentation (Art. 6(1)(f) GDPR).

Sign-in and security

For sign-in, the web app sets a session cookie and, to keep you signed in, a login cookie valid for 90 days. In the apps, a login token is stored in your device’s protected storage (Keychain or Keystore). These cookies and tokens are technically necessary (§ 25(2) no. 2 TDDDG). On our server we only store them as a hash. Beyond that, the web app and the apps set no cookies and use no analytics or tracking services, so no consent is required for them.

If you enable two-factor authentication for your FABULOUS 2FA account, we store the secret key encrypted and your recovery codes as a hash.

To protect against attacks and misuse, we count failed sign-in attempts per IP address and email address as well as certain actions such as imports and exports per account. These entries are deleted after 24 hours at the latest. For security-relevant events in your account (e.g. password changed, two-factor authentication turned on or off, recovery code used, backup exported) we send you an email containing the time and IP address of the event. The legal basis is our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).

System emails

We send emails to confirm your address, reset your password and security notices via the Postmark service of ActiveCampaign, LLC, USA. Your email address, your name and the content of the respective message are transmitted. Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses.

Apps for iPhone and Android

The apps are distributed via Apple Inc.’s App Store and Google LLC’s Google Play. Their privacy policies apply to download and installation. The apps contain no advertising, analytics or tracking services.

So that improvements arrive without a new download, the app checks Expo (650 Industries, Inc., USA) for updates when it starts. Your IP address and technical information about the app version and platform are transmitted. The legal basis is our legitimate interest in an up-to-date and secure app (Art. 6(1)(f) GDPR). Transfers to the USA are based on standard contractual clauses.

Backup files are only saved to or shared from your device when you choose to. Copied codes are placed on your device’s clipboard.

Recipients and third countries

We do not pass your data on to third parties and do not sell it. Recipients are only the service providers named above who act on our behalf. For service providers in the USA (Postmark and Expo), transfers are based on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. When logos are fetched, Google or the respective website only receives the service’s domain name, no data about you.

Retention

We store your account data, your 2FA accounts, groups and settings for as long as your account exists. If you delete a single 2FA account, it is removed from our database immediately. You can delete your entire account at any time in the settings under “Account & security”. All associated data is then deleted from our systems immediately, including all stored secret keys. Two-factor authentication at the respective services is not affected. Server log files are deleted automatically after a short time, entries used to limit sign-in attempts after 24 hours at the latest.

Obligation to provide data and automated decisions

We need the information you provide when registering and the data of your 2FA accounts to provide the service. Without them, the service cannot be used. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Your rights

Under the GDPR you have the following rights:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR), e.g. for FABULOUS ANALYTICS via “Privacy settings”

An informal message to hello@fabulous-code.com is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

SSL/TLS encryption

The website, web app and apps only transmit data encrypted (SSL/TLS). This also applies to the transfer of your secret keys between our server and your devices.

Changes

We update this privacy policy when our service or the legal requirements change. The version published here applies.

Last updated: November 6, 2026