# Privacy | 2FAOrbit > How this version of 2FAOrbit handles your data. Canonical: https://2faorbit.online/privacy/ Language: en Updated November 5, 2026 The authenticator and QR tools process their inputs in your browser. ## Keys, codes and images Setup keys and decoded QR data stay in page memory. The code generator does not send them to a server or write them to cookies, localStorage or IndexedDB. Uploaded QR images are read locally. Reloading the authenticator resets it to the public example; closing the page ends that page session. ## Camera and clipboard The camera starts only when you choose Open camera and grant permission. Scanning stops when you switch away from the camera panel, hide the page or leave it. Clipboard reads happen when you choose Paste; clipboard writes happen when you choose Copy. ## Theme preference Your light or dark theme choice is remembered in browser storage. Setup keys, codes and QR data are not saved with it. ## Ordinary website requests The hosting provider receives ordinary requests for pages, fonts and scripts and may keep operational access logs, including IP addresses and browser information. Google Analytics 4 measures page visits only after you choose Allow analytics. Before that choice, or when you choose Essential only, this site does not load the Google Analytics script. It includes no advertisements, session recording or third-party font requests. The network tools contact the services described below. A private preview may additionally use the hosting provider’s sign-in system. ## IP and browser privacy tools The detailed map on My IP loads city, neighbourhood and road data from [OpenFreeMap](https://openfreemap.org/), based on OpenStreetMap. Tile requests reveal your connection IP and the map areas you view to that provider. We do not send your authentication keys, a queried IP address, or GPS coordinates to the map service. The marker uses approximate coordinates from the IP-location service; it does not identify your home or street. The browser-local country overview remains available if detailed tiles cannot load. See [OpenFreeMap privacy](https://openfreemap.org/privacy/). Opening My IP contacts ipify to detect public IPv4 and IPv6. My IP and IP lookup send the detected or queried public address to IPWho.is for network information, with GeoJS as a fallback if the first service is unavailable. These services see ordinary connection information, and their own privacy policies apply. Lookup results are cached briefly in page memory; they are not saved with your theme preference. The optional IP address passed between our lookup pages is removed from the displayed URL after loading, but an ordinary page request may appear in hosting logs. WebRTC testing starts only when you choose Run test. It creates a temporary data channel and contacts Cloudflare’s public STUN service. It does not request camera or microphone media. Candidate information remains in page memory and is included if you copy the findings. DNS testing starts only when you choose Run test. It asks our same-origin session endpoint to allocate a bash.ws test ID. That endpoint contacts only the fixed bash.ws session service. Your browser then contacts bash.ws and fresh test subdomains so its authoritative DNS infrastructure can observe the resolvers answering those queries. The current session and report remain in page memory here; bash.ws handles its own test data under its [privacy policy](https://bash.ws/privacy). IPWho.is, ipify and [GeoJS](https://www.geojs.io/privacy/) also apply their own provider policies. This website does not save diagnostic history or provide a cloud account. ## Downloads and contact A downloaded QR stays wherever you save it. The contact tool prepares a message in your email application or copies it to your clipboard; it does not submit a form to a server. If you email us, your email provider and ours process that message. ## Optional analytics Google Analytics 4 is provided by Google and uses cookies after you allow analytics. It measures page visits, general device information, approximate country/region and traffic sources. We use basic consent mode: no Google Analytics request is initiated by this site before analytics consent. Advertising storage, advertising user data, ad personalization and Google signals are disabled in this integration. Enhanced measurement remains disabled in our Analytics web stream. Our analytics events contain static page titles and paths. We omit URL queries and fragments and send only the referring website origin. Our code does not add setup keys, authentication codes, QR images or decoded contents, queried IP addresses or diagnostic results to analytics events. Google receives ordinary connection information when its analytics service is loaded. Read [Google’s privacy policy](https://policies.google.com/privacy) for its data handling. Your choice is saved in browser storage for up to 180 days. Analytics cookies are configured with a 180-day lifetime. Use Cookie settings in the footer to change your choice. Withdrawing consent disables measurement on the current page and clears accessible _ga cookies; the Google script will not load on subsequent pages while your choice is Essential only. Google’s script may remain in memory until the current page is closed or reloaded. Changing or clearing a preference does not erase data already collected by Google. Contact us if you have a data-related question. ## Changes and questions This page will be updated when the product’s data handling changes. Questions can be directed through [Contact](https://2faorbit.online/contact/). ## More information - [All tools](https://2faorbit.online/tools/) - [Guides](https://2faorbit.online/guides/) - [Privacy policy](https://2faorbit.online/privacy/) - [Contact](https://2faorbit.online/contact/)