Privacy Policy
How Team2FA handles account, authenticator and website data.
Effective 2026-10-02Optional Google sign in
When Google sign in is enabled and you choose it, Google provides your account identifier, verified email address and name. We store the Google identifier to connect your account and use your email and name for your Team2FA profile. We request only openid, email and profile scopes. We do not request access to Gmail, Drive or your Google Authenticator codes. Google processes authentication under its own privacy policy. Google tokens are used during sign in and are not stored for continuing access to Google services. Temporary sign in state expires after ten minutes and is removed automatically. Existing accounts must sign in with their current method and explicitly connect Google in Settings.
Who operates the service
Team2FA is a shared authenticator application operated by Educational Traning Center LTD, Tax ID 514541200, at Hevruta 13, Harish 3786100, Israel. For privacy requests, contact support@team2fa.cloud. An organization administrator controls member access, organization contact details and the shared entries in that organization.
Information we handle
We process account names, email addresses, optional personal job title, company and postal address, optional organization contact email, phone, website, description and postal address, organization agent permission settings and their audit activity, optional profile images and organization logos, password hashes, passkey credentials, optional phone numbers, organization and guest access records, including names and email addresses shown to other authorized code viewers in access reports, signup and invitation records, account welcome email delivery status, session identifiers, Chrome extension pairing records and limited extension sessions, share link records, audit activity, authenticator labels and encrypted TOTP seeds. Administrators may provide account labels that contain personal data. We also process service logs needed for security and operation. Short lived request fingerprints prevent duplicate changes after an identity confirmation; they do not contain submitted passwords or authenticator seeds.
Why we use it
Account, session, invitation and authenticator data is used to provide the service and perform the agreement with users and organizations. Security logs and rate limits support protection of the service and legitimate operational interests. Optional analytics would require a separate choice and is not currently installed.
Providers and transfers
The application is hosted on Render, including its PostgreSQL database. Creem processes checkout and subscription events for Pro and Teams. Team2FA receives signed billing events and stores billing customer and subscription identifiers and status. If enabled by the administrator, SendGrid delivers account email and invitations, Twilio Verify handles SMS verification, and IDrive e2 stores profile images and organization logos in private object storage. Authenticator export QR images are decoded in the browser; imported secrets are sent only when the user confirms an import. Their processing locations and transfer mechanisms should be reviewed for the applicable deployment before EU customer data is onboarded. We do not sell personal data or use advertising trackers on this site.
Retention and security
Website sessions expire after at most 12 hours. A connected Chrome extension has its own persistent credential and remains connected when a website session ends or is revoked. Its credential is revoked when you disconnect the extension. It can access only codes currently permitted for the account. Unused extension pairing codes expire after five minutes. Unopened share links expire at the selected deadline; opened links allow code access for five minutes, and expired share records are purged after 30 days. Removed group assignments and globally archived entries are purged after 30 days. Replaced or removed profile images and logos are deleted from object storage; provider backups may have separate retention. Organization audit views include recent activity, while underlying audit records and operational logs can have different retention. Welcome email delivery records are retained for account setup and removed when the account is deleted. Contact support to request account deletion or ask about retention for your organization. Account deletion is handled by the service operator, rather than a self service control. The operator reviews shared organization content and records that must be retained for security or legal obligations before fulfilling a request. Entries are encrypted in the application, but the server can decrypt them to issue codes. This is not end to end encryption.
Your choices and rights
You can edit your personal profile and request access, correction, deletion, restriction or a copy of your personal data where applicable, and object to processing in appropriate cases. Contact the service operator at the address above; for membership or shared account content, also contact your organization administrator. You may complain to your local supervisory authority. We may need to retain limited records where legally required or necessary for security.
Cookies and updates
We use essential sign in and short lived share viewer cookies. The Chrome extension keeps its access token in Chrome local extension storage until you disconnect it; short lived pairing details remain in session storage. It never stores authenticator setup seeds. Signing out of the website does not disconnect the extension. We also remember a local cookie preference, whether you dismissed the guided onboarding and whether you postponed the install suggestion on this device. See the Cookie Policy. Material changes to this notice will be published here with a revised date.