Privacy Policy
At KD Labs, we hold that privacy is not a decorative configurable feature, but an inviolable fundamental human right. This comprehensive document transparently articulates our data practices, mathematically and technically substantiates our Zero-Network architecture, and provides thorough alignment with the Google Play Data Safety requirements, Vietnam Decree 13/2023/ND-CP, the European Union General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA/CPRA).
Executive Summary (At a Glance)
Four non-negotiable architectural pillars embedded into every KD Labs software product:
Zero-Network Architecture
The app never declares android.permission.INTERNET. Mathematically incapable of transmitting telemetry or exfiltrating data.
Zero Tracking & Ad SDKs
Strictly zero Google Firebase Analytics, Crashlytics, AppsFlyer, or any commercial advertising networks.
Hardware Cryptographic Enclave
Master Vault Keys derived via PBKDF2 (100,000 rounds) and encrypted with AES-256-GCM backed by Android Keystore / iOS Keychain.
MIT Open-Source Auditing
Entire codebase publicly auditable at github.com/001123/simple-otp for peer review by security researchers worldwide.
Jump to section (12 mục)
This Privacy Policy ("Policy") governs all software applications, mobile utilities, and digital tools created and published by KD Labs ("we", "us", "our", or "KD Labs") across the Google Play Store, Apple App Store, and open-source software repositories such as GitHub. This includes, without limitation, the Simple OTP authenticator app (Package ID: com.duybk.simpleotp) and our official domain https://kd.io.vn.
By installing, copying, or utilizing any KD Labs application, you acknowledge that you have read, understood, and consented to the stipulations detailed herein. If you do not consent to these terms, please immediately uninstall our applications from your hardware.
1.1. Key Definitions
• "Personal Data": Any information relating to an identified or identifiable natural person as defined under GDPR Article 4(1) and Vietnam Decree 13/2023/ND-CP.
• "Application": The Simple OTP mobile application and all modular standalone software tools engineered by KD Labs.
• "Device": Any mobile phone, tablet, or consumer hardware operating Android or iOS owned and operated by the user.
• "2FA Secret Key / Seed": Base32 formatted cryptographic strings or otpauth:// URIs issued by online service providers to calculate two-factor authentication tokens (TOTP / HOTP).
1.2. Legal Status & Data Processing Roles
Under GDPR Article 4(7) and Vietnam Decree 13/2023/ND-CP, with respect to all 2FA accounts and secrets entered into Simple OTP, you remain the sole Data Subject and the exclusive Data Controller. KD Labs DOES NOT act as a cloud Data Processor because our software architecture operates with zero servers, never ingests, never stores, and never transmits your data.
The defining distinction between KD Labs’ Simple OTP and mainstream commercial authenticator utilities is our strict Zero-Network Architecture. This is a mathematical and operating-system-level guarantee rather than a mere contractual promise.
In our Android application manifest (AndroidManifest.xml), we purposefully omit network permissions entirely:
2.1. Zero Telemetry & Zero External SDKs
We rigorously exclude all third-party software development kits (SDKs) common in mobile development:
• No Google Firebase Analytics, no Google Crashlytics.
• No Facebook SDK, AppsFlyer, Mixpanel, or Flurry.
• Zero tracking pixels, conversion monitors, or advertising libraries.
The application generates no outbound crash reports or telemetry logs. Any application errors or exceptions remain strictly local on your screen for manual review if you choose to report them via support email.
2.2. Air-Gapped & Airplane Mode Operation
Simple OTP operates with 100% functional completeness on air-gapped devices and in Airplane Mode. TOTP token calculations (RFC 6238) depend exclusively on your device’s local hardware clock and locally stored seeds, without requiring any external time-server synchronization.
The Google Play Store mandates that developers publish an explicit Data Safety declaration. Below is the verified item-by-item breakdown matching KD Labs’ official Google Play Console disclosure:
| Data Category | Collection Status | Sharing Status | Purpose & Handling Details |
|---|---|---|---|
| Personal Info (Name, Email, Phone, User ID) | NOT COLLECTED | NOT SHARED | App requires no account sign-in or registration. |
| Location (Precise or Approximate) | NOT COLLECTED | NOT SHARED | No GPS or cellular triangulation permissions requested. |
| Financial & Payment Info | NOT COLLECTED | NOT SHARED | Zero in-app purchases or payment processing libraries. |
| Contacts, SMS, & Call Logs | NOT COLLECTED | NOT SHARED | No telecommunication or address book permissions requested. |
| Photos & Videos | NOT COLLECTED | NOT SHARED | Temporary RAM decode only when user actively selects a QR image. |
| Audio Recordings & Microphone | NOT COLLECTED | NOT SHARED | RECORD_AUDIO permission permanently excluded. |
| Files & User Documents | NOT COLLECTED | NOT SHARED | Only imports/exports user-specified .simpleotp backup files. |
| App Activity & Usage Analytics | NOT COLLECTED | NOT SHARED | Zero analytics events or telemetry monitoring. |
| Device Identifiers (IMEI, Android ID, Ad ID) | NOT COLLECTED | NOT SHARED | Never queries hardware IDs or Advertising IDs. |
| Diagnostic & Crash Logs | NOT COLLECTED | NOT SHARED | No background transmission of crash telemetry. |
Simple OTP strictly observes the Principle of Least Privilege. We only request permissions necessary to execute user-initiated cryptographic features:
| Android / iOS Permission | Permission Tier | Functional Purpose | Technical Handling & Security Bounds |
|---|---|---|---|
| android.permission.CAMERA | Dangerous (Runtime Permission) | Exclusively used for scanning live 2FA configuration QR codes (otpauth://). | Camera frames stream strictly into volatile memory (RAM), decoded locally via ML Kit / ZXing, and immediately purged. Never written to disk, never recorded, never broadcasted. |
android.permission.USE_BIOMETRIC
/ USE_FINGERPRINT | Normal (Hardware Security) | Authenticates user identity via fingerprint or biometric face unlock to decrypt the vault. | Delegated entirely to system BiometricPrompt. The app receives only a boolean success/failure signal and CryptoObject; raw biometric templates are never exposed. |
android.permission.READ_MEDIA_IMAGES
(Android 13+) / READ_EXTERNAL_STORAGE | Optional (System Photo Picker) | Allows user to select a pre-saved QR code screenshot from the gallery. | Leverages the modern system Photo Picker where available (granting isolated access only to the selected item). The image is decoded in RAM and released immediately. |
| android.permission.VIBRATE | Normal | Triggers subtle tactile haptic feedback upon successful QR scan or code copy. | Has zero privacy implications or data exposure risk. |
android.permission.POST_NOTIFICATIONS
(Android 13+) | Optional | Schedules local reminders to create an offline backup (if toggled by the user). | Managed via local AlarmManager; contains zero cloud push notification tokens. |
4.1. Explicitly Excluded Permissions
KD Labs commits to never introducing the following invasive permissions into Simple OTP:
• android.permission.INTERNET (No network)
• android.permission.ACCESS_FINE_LOCATION / COARSE_LOCATION (No GPS)
• android.permission.READ_CONTACTS (No contacts)
• android.permission.RECORD_AUDIO (No microphone)
• android.permission.READ_PHONE_STATE (No telephony identifiers)
Your 2FA credentials (issuer names, account labels, and secret seeds) are secured using state-of-the-art cryptographic primitives:
5.1. Master Vault Key (MVK) & PBKDF2 Key Derivation
• When you configure a master passphrase, it is processed through PBKDF2-HMAC-SHA256 with a cryptographically secure 256-bit random salt produced by SecureRandom.
• A minimum iteration count of 100,000 rounds is enforced to prevent GPU-accelerated brute-force attacks and rainbow table computations.
5.2. AES-256-GCM & Android Keystore Integration
• All persistent local account data is encrypted using 256-bit Advanced Encryption Standard in Galois/Counter Mode (AES-256-GCM). GCM provides both confidentiality and authenticated integrity verification with a 128-bit authentication tag.
• The database encryption key is safeguarded within the Android Keystore (or Apple Keychain / Secure Enclave on iOS). Cryptographic keys reside inside hardware-isolated enclaves and are never exposed as plaintext in application memory.
5.3. Interface Shielding: FLAG_SECURE Anti-Surveillance
To shield against malicious background screen-recorder utilities and OS recent-apps snapshots, Simple OTP activates WindowManager.LayoutParams.FLAG_SECURE across all sensitive screens.
Any attempt to take a screenshot, record the screen, or mirror content over HDMI/Chromecast will be blocked by the operating system or will output a completely black frame.
5.4. Memory Zeroization & Ephemeral Secrets
During OTP token generation (RFC 6238 / RFC 4226), byte arrays holding decrypted secret seeds reside in RAM for mere milliseconds. Once token math completes, memory buffers are explicitly zeroized (overwritten with zeroes) to mitigate memory dump exploits.
Because Simple OTP maintains zero cloud servers to sync your tokens, we provide an Encrypted Offline Backup feature allowing you to transfer credentials securely across devices.
6.1. The .simpleotp Archive Format
• Backups are saved with the custom .simpleotp extension as an authenticated binary bundle.
• Format specification: Version header byte, 32-byte cryptographic Salt, 12-byte initialization vector (IV), 16-byte authentication tag, followed by AES-256-GCM encrypted payload.
• Passphrase protection: Determined exclusively by you upon export. KD Labs holds NO record of this passphrase and incorporates ABSOLUTELY NO BACKDOOR to open your file if you forget it.
Please preserve your backup passphrase in a dependable password manager. If you lose this passphrase, no entity on Earth — including KD Labs engineers — can recover or decrypt your .simpleotp backup file.
6.2. No Automatic Third-Party Cloud Uploads
The application does not autonomously push backups to Google Drive, iCloud, or Dropbox. When you choose "Export Backup", the Android Storage Access Framework (SAF) prompts you to choose your desired target: local storage, SD card, or USB OTG flash drive.
While Simple OTP runs 100% offline, users may communicate with KD Labs through external touchpoints such as customer support email or GitHub. Here is how such interactions are managed:
7.1. Technical Support Email (support@kd.io.vn)
• When you email our support team, we receive your email address, sender name, and message contents.
• Processing Purpose: Strictly utilized to respond to inquiries, troubleshoot bugs, or address feature suggestions.
• Retention Period: Resolved support correspondence is purged after 90 days. We never use support emails for marketing, never build promotional mailing lists, and never share email addresses with commercial brokers.
7.2. Public GitHub Repository Interactions
• Bug reports (Issues) and code contributions (Pull Requests) submitted to github.com/001123/simple-otp are governed by GitHub’s (Microsoft) Privacy Statement.
• Precaution: NEVER attach screenshots containing live QR codes, secret keys, or backup passwords to public GitHub tickets.
7.3. Official Website Access (https://kd.io.vn)
• The kd.io.vn website is a static site hosted via Cloudflare Pages. We deploy zero behavioral cookies, zero third-party advertising pixels, and zero analytics scripts.
• Cloudflare may record transient routing logs (anonymized IP, User-Agent, timestamp) solely to defend against DDoS attacks and maintain CDN performance, in accordance with Cloudflare Inc.’s privacy practices.
KD Labs unconditionally honors global privacy frameworks including Vietnam Decree 13/2023/ND-CP, EU GDPR, and the California Consumer Privacy Act (CCPA/CPRA).
8.1. Exercising Your Legal Rights
• Right to Know & Access: You have transparent, real-time access to all stored information directly inside the app interface. No shadow data is stored outside your view.
• Right to Rectification: You can freely edit labels, issuers, and icons directly in the application UI at any moment.
• Right to Erasure (Right to be Forgotten): Because KD Labs retains zero user records on servers, you do not need to submit formal data deletion requests. You execute complete and irreversible erasure yourself by:
1. Navigating to Device Settings > Apps > Simple OTP > Storage > Clear Data; or
2. Uninstalling Simple OTP from your device.
• Right to Object & Withdraw Consent: You can revoke camera or storage permissions at any time via Android system settings.
KD Labs software utilities are designed for general audiences and are not directed towards children under 13 years of age (or under 16 within the European Economic Area).
We do not knowingly solicit, collect, or process personal data from children. Given our Zero-Network architecture which collects no user data whatsoever, the risk of child data exploitation within our software is non-existent.
If a parent or guardian discovers that a child has communicated personal details via our support email, please notify support@kd.io.vn for prompt and complete record deletion.
In cryptography and software security, we adhere firmly to Kerckhoffs’s principle: "Don't trust, verify." The only credible proof of privacy is unrestricted open-source audibility.
Simple OTP is distributed under the permissive MIT Open Source License at https://github.com/001123/simple-otp.
10.1. Independent Verification Procedure
Security researchers, developers, and privacy auditors can independently verify our claims:
1. Inspect AndroidManifest.xml: Confirm the complete absence of android.permission.INTERNET.
2. Audit build.gradle: Verify that no telemetry or ad dependencies are linked.
3. Packet Sniffing: Run Simple OTP within an Android emulator monitored by Wireshark, Charles Proxy, or PCAPdroid. You will observe exactly zero outbound network packets.
4. Reproducible Builds: Clone the GitHub repository and build your own APK directly from source to ensure binary integrity.
KD Labs may periodically amend this Privacy Policy to reflect software enhancements, updated regulatory standards, or Google Play Developer Policy revisions.
All updates will be published immediately on this page with an updated version number and effective date. Material alterations will also be highlighted in our Google Play Store "What's New" release notes.
| Version | Effective Date | Summary of Principal Changes |
|---|---|---|
| 1.2.0 | September 2026 | Comprehensive 1-page overhaul: added detailed permissions matrix, Google Play Data Safety alignment, Keystore cryptographic analysis, and global compliance clauses. |
| 1.0.0 | June 2026 | Initial privacy policy published for Simple OTP Google Play launch. |
If you have inquiries, privacy concerns, or security vulnerability disclosures regarding this Policy or KD Labs products, please reach our dedicated team through the following official channels:
12.1. Developer Contact Details
• Developer Entity: KD Labs (Independent Mobile & Cryptographic Studio)
• Country of Origin: Vietnam
• Lead Developer: Duy BK
• Official Privacy & Support Email: support@kd.io.vn
• Official Website: https://kd.io.vn
• Open-Source Repository: https://github.com/001123/simple-otp
• Service Level Commitment: We endeavor to address all privacy and cryptographic inquiries within 48 business hours.
Privacy & Cryptographic Security Inquiries
Discovered a potential vulnerability or have ideas to bolster Simple OTP’s privacy guarantees? Reach out directly. We actively collaborate with ethical security researchers.
Ghi chú về bảo mật nâng cao:
For sensitive vulnerability disclosures, please reach out via email or submit a private GitHub Security Advisory on our repository.