Privacy Notice
Effective October 16, 2026. This notice explains what information SCB Solutions, Inc. ("SCB", "we") processes in connection with the Idaxis Authenticator software, its update checks and our support, and why.
In short
- Your one-time-code secrets are stored on your Idaxis SecureWave key. The app never sends them to us or anyone else.
- The app has no user account, no advertising and no crash reporting, and we collect no analytics from it.
- What you keep in the app (account names, an optional remembered PIN, settings) stays on your computer or phone, encrypted.
- We receive information only when the Windows app checks for or downloads an update, when you download it from our website, and when you contact us. That information includes your IP address and an approximate location derived from it.
- On Android, the app comes from Google Play, and its QR-code scanner (Google ML Kit) sends Google technical diagnostics; never your images, codes or secrets. See below.
What stays on your computer or phone
To work, the app keeps the following on your computer or phone only. We never receive it.
- Account details: the names and issuers of the accounts on your key, their display order and the icon you chose for each. They save reading them from the key every time.
- Remembered PIN, only if you choose to remember it.
- Settings and the language you chose.
On Windows, this information is encrypted with Windows' data protection for your Windows user account and stored in your profile; the window's size, position and zoom are stored in your Windows user registry. On Android, each item is encrypted with a key held in the Android Keystore and stored in the app's private storage; it is excluded from Android backups.
QR codes you scan or import are read on your device; images are not uploaded or kept. A code you copy is placed on the clipboard marked as sensitive (on Windows, not kept in clipboard history or synced to the cloud), and is cleared after 30 seconds, or when Windows locks. The app talks to your key over USB or NFC on your device. On Windows, the Idaxis background service installed with the app relays those commands on your computer; it does not use the network.
What stays on your security key
The secrets that generate your one-time codes are written to your key when you add an account and stay there. The app asks the key for codes; it does not store the secrets. When you add accounts and choose to copy them to a backup key, the secrets are held in the app's memory only until they are written to the backup key or the copy is cancelled, then erased. They are never written to disk or sent over the network.
Update checks and downloads
This section is about the Windows app. On Android, updates come through Google Play.
Update checks. Unless you turn them off in Settings, the app asks www.idaxis.com once a day (and whenever you choose "Check for updates now") whether a newer version exists. Like any web request, this reveals your IP address, the date and time, and the app's version (sent in the request's User-Agent). Our web server records these in its access logs. No other information about you, your key or your accounts is sent.
Updates installed from the app. When you choose to install an update, the app downloads the setup from www.idaxis.com. Besides the access log entry, we record the download: date and time, file, IP address, app version, and an approximate location (city, region, country and coordinates) derived from the IP address.
Downloads from our website. When you use a download button on www.idaxis.com, we record the date and time, the file, your IP address and the approximate location derived from it.
Google Play and the QR scanner (Android)
Google Play. On Android, you install and update the app through Google Play. Google processes the related information (your Google account, installs and purchases, if any) under Google's privacy policy. Google gives us aggregated statistics, such as numbers of installs and crash rates by device model; they do not identify you.
QR-code scanner. To read a QR code with the camera, the Android app uses Google's ML Kit, which works on your phone: camera images and the codes it reads are not sent anywhere. ML Kit does send Google technical diagnostics to improve its service: device information (manufacturer, model, Android version), the app's name and version, a per-installation identifier that is not meant to identify you or your phone, performance and error data, and the scanner's settings. Google states that this data is encrypted in transit and not transferred to third parties; see Google's ML Kit data disclosure. We do not receive it.
The Android app itself does not contact our servers.
Our website and contact form
When you contact us through www.idaxis.com/contact, we receive your name, email address, organization (optional), subject and message, together with your IP address and the approximate location derived from it. The form uses a session cookie for the duration of your visit to protect against forged submissions, and your IP address to limit repeated submissions. We email you an acknowledgement.
Please never send us passwords, PINs, one-time codes, private keys, seed secrets, recovery codes or unredacted enrollment QR codes.
Our pages load fonts from Google Fonts, and the contact page shows an embedded Google map; your browser then connects to Google, which receives your IP address and browser information under Google's privacy policy. We do not use advertising or analytics cookies.
How we use information
- To deliver updates and know which versions are in use, so we can support them and notify users of security fixes.
- To keep our website and services secure and detect abuse.
- To answer your messages and provide support.
- To comply with law and enforce our license agreement.
We do not sell or rent personal information, use it for advertising, or use your authentication secrets or account details for any purpose (including training AI models).
How long we keep it
- Web server access logs: up to 12 months, then deleted automatically.
- Download records: after 12 months, the IP address, city and coordinates are removed automatically. We keep the date, the file, the app version and the state or region and country, which no longer identify you, to understand where and how the software is used.
- Contact messages and support emails: as long as needed to handle your request and keep business records, then deleted.
- Contact-form session and abuse-protection data: up to 24 hours.
- Information on your computer or phone: until you delete it ("Forget remembered PIN" in Settings, uninstalling the app and removing your profile data on Windows, or uninstalling the app or clearing its storage on Android).
Your choices and rights
- Turn off automatic update checks in the Windows app's Settings. You can still download new versions from our website.
- On Android, you can avoid the QR scanner's diagnostics by adding accounts by hand (secret key) or from an image instead of the camera.
- Ask us what personal information we hold about you, to correct it, or to delete it, by writing to info@idaxis.com. We may need to verify your request and will answer as applicable law requires. Depending on where you live, you may have further rights, including to appeal our decision or to complain to a data-protection authority.
Children, location and changes
The app and our services are not directed to children under 13, and we do not knowingly collect their personal information.
We are based in the United States, and the information described here is processed in the United States.
We may update this notice. The effective date at the top shows when it last changed; we will give notice of material changes, for example in the app or on this website.
Contact
SCB Solutions, Inc., attention Idaxis Authenticator
1001 Fillmore Street, Suite 3157, Arlington, VA 22201, USA
info@idaxis.com · www.idaxis.com/contact