LEGAL / PRIVACY POLICY
Thiravoo Privacy Policy
What Thiravoo is
Thiravoo stores authenticator setup keys and shows the six-digit codes they generate. You can also save a username, password, and notes for each account. Code access and credential access are managed separately; sharing codes alone does not share saved credentials.
Information we collect
| Data | Why | Where it is stored |
|---|---|---|
| Email address and a password | To create and sign in to your Thiravoo account and to verify your email | Firebase Authentication (Google LLC). We never receive your password. |
| Authenticator entries: service name, account label, category, and the setup key | To generate verification codes for you and for people you share with | Our API servers. Setup keys are encrypted at rest with AES-256-GCM; only the server can decrypt them to compute a code. |
| Saved credentials: username, password, and notes you choose to add | To let you view your login details and explicitly share them with selected people | Our API servers, encrypted at rest with AES-256-GCM. The server decrypts them only after checking access. |
| Email addresses of people you share an account with | To grant them access to that account’s codes when they sign in | Our API servers |
| Activity log: who added, copied, shared or removed an account, and when | So account owners can see how shared access is used | Our API servers, latest 60 entries |
| Camera image, while scanning | To read a QR code | Processed on your device only; never uploaded |
We do not use analytics or advertising SDKs, and we do not track you across apps or websites.
How we use it
Only to provide the service above, to keep it secure, and to respond to support requests. We do not sell personal data.
Sharing
- Firebase Authentication (Google LLC) processes sign-in, email verification and password reset emails.
- Hosting providers run our API and database.
- People you grant code access to can see verification codes and your email address as the owner. People you explicitly grant credential access to can also view the saved username, password, and notes, including future updates. Revoking access prevents future viewing but cannot erase details a recipient already copied.
- Authorities, if required by law.
Retention and deletion
Your data stays while your account exists. You can delete your account at any time from Settings → Delete account in the app. This immediately removes every authenticator entry you added, every share you granted or received, your activity log and your sign-in. Deleting Thiravoo data does not turn off two-factor authentication on the services themselves; keep their recovery codes. Backups are purged within 30 days.
Your rights
Depending on where you live you may have rights to access, correct, export or erase your data, or to object to processing. Email support@thiravoo.com. Data may be processed in regions where Google Cloud and Firebase infrastructure operate.
Children
Thiravoo is not directed at children under 13 and we do not knowingly collect their data.
Changes
We will post changes on this page and update the effective date. Material changes are announced in the app.
Contact
support@thiravoo.com · Higglers Lab, No 27, Second Floor, Second Street, Bank staff colony, Thanjavur, Tamil Nadu, India 613005