Legal

Privacy Policy

Last updated: March 15, 2026

Overview

Yubi AppGate ("the app") is designed with privacy as a core principle. The app operates entirely on your device and does not collect, transmit, or store personal data on external servers.

Data We Do Not Collect

Yubi AppGate does not collect:

  • Personal information (name, email, phone number)
  • Device identifiers or advertising IDs
  • Location data
  • Usage analytics or behavioral data
  • Browsing history or app usage history
  • Contacts, photos, or other personal files

Data Stored on Your Device

The app stores the following information locally in the app's private storage (SharedPreferences) on your Android device:

  • Enrolled challenge-response pair: A random challenge and the corresponding HMAC-SHA1 response from your YubiKey, used to verify future authentication attempts.
  • Selected YubiKey slot: Whether Slot 1 or Slot 2 is configured for challenge-response.
  • Protected package names: The list of Android app package names you've chosen to protect.

This data never leaves your device. It is stored in the app's private storage directory, which is not accessible to other apps.

Analytics & Tracking

Yubi AppGate does not include any analytics SDKs, crash reporting services, advertising frameworks, or tracking libraries. No data is sent to third-party services.

If optional analytics are added in a future version, they will be clearly disclosed, opt-in only, and this policy will be updated accordingly.

Network Access

The app does not require internet access for its core functionality. All authentication happens offline between your device and the physical YubiKey. The only network activity that may occur is related to Google Play licensing verification, which is handled by the Android system.

Accessibility Service

If you enable the optional accessibility service for system-wide protection, the service monitors which app is in the foreground by observing window change events. It does not:

  • Read or record screen content
  • Access text fields or keyboard input
  • Interact with or modify other apps
  • Transmit any information off the device

The service solely observes the foreground package name to determine whether a protected app has been opened.

Device Administrator

The optional device administrator feature only uses the "force-lock" policy to prevent uninstallation. It does not access, manage, or reset any device data.

Children's Privacy

The app is not directed at children under 13 and does not knowingly collect information from children.

Data Deletion

All data stored by the app can be removed at any time by:

  • Using the "Reset enrollment" option within the app
  • Clearing the app's data via Android Settings
  • Uninstalling the app

Third-Party Services

The app is distributed via the Google Play Store. Google's privacy policy applies to the distribution platform. Yubi AppGate itself does not integrate with any third-party services beyond the Android system APIs required for its functionality.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

Disclaimer

Yubi AppGate is provided "as is" without warranty of any kind, express or implied. The developer is not responsible for data loss, device lockouts, or factory resets resulting from lost or damaged YubiKeys. Locking system applications such as Android Settings may make your device unrecoverable without a factory reset. Use at your own risk.

Contact

If you have questions about this Privacy Policy, please open an issue on GitHub.