This notice covers the public help pages at learn.2falive.live and explains their relationship to the authenticator at 2falive.live. The two addresses have different purposes.

Reading these help pages

The help pages are static documents. They do not have a sign-in form, secret-key input, comment form, or file upload. The help website itself does not set login cookies or store account information in your browser’s local storage. Fonts, styles, and brand images are served as part of this website; there are no embedded social widgets.

Like other websites, delivery requires network requests. The website host and Cloudflare process connection information such as an IP address, the requested path, and browser information to deliver and protect the site. Cloudflare may use security-related cookies depending on its security features. See Cloudflare’s cookie documentation and Cloudflare’s privacy policy for its processing.

Cloudflare also adds a Web Analytics performance beacon to these help pages. It sends page-load timing and performance measurements to Cloudflare. Cloudflare says this service does not track individual visitors across its customers’ websites. See Cloudflare’s description of the beacon and data collection.

Advertising status

Google AdSense code is enabled only on the four public guide pages. An ad may not appear on every visit. The authenticator, account views, and share-code viewers do not load advertising scripts.

Google and other advertising vendors may use cookies or similar technologies to select and measure ads. Depending on your choices, they may personalize ads using visits to this website and other sites. Advertising requests can send Google information such as the page address, IP address, and browser details. See how Google uses information from partner sites and Google’s privacy policy.

Open a guide’s privacy controls to review the applicable consent choices. The Privacy and cookie settings button appears when Google’s EU consent controls are available. For applicable US visitors, Google provides its own Do Not Sell or Share My Personal Information link on the guide page. You can also manage Google ad personalization in My Ad Center and use the Digital Advertising Alliance’s choices for participating vendors. Turning off personalization does not necessarily remove ads or all advertising-related processing.

Advertising is separate from the authenticator. Do not put a secret, code, password, or share token in a help-page address or message. We do not pass those account values to the ad code.

Using the authenticator

The authenticator is a separate application at 2falive.live. Generating a code without choosing to save or share calculates it in your browser. That generation action does not send the secret to the application server. The secret remains visible on the page while it is entered.

Creating an account sends a username and password to the server over HTTPS. No email address is requested. Passwords are stored as salted hashes. Signing in uses an HTTP-only session cookie, which is marked Secure on the HTTPS deployment. Accounts have no password-recovery feature.

Saving a code sends its secret and associated label or settings to the server. The vault stores encrypted secrets and makes them available to that account after sign-in. This is server-side encryption, not end-to-end encryption: access to both the stored database and its encryption key can allow decryption.

Creating a share link sends the authenticator secret to the server so the service can supply current codes. The full link contains a private token in its URL fragment. The viewer sends that token to the application to resolve the link. Anyone with the full active link can view its current codes and label without an account; the viewer does not receive the permanent secret.

Timed links expire. Signed-in owners can revoke their links. Guest links cannot be revoked through the app, and guest lifetime links have no expiry. Revoked or expired link contents are cleared by the application, but copies in backups are separate. Deleting a vault entry does not revoke its separately created share links.

Saved information and backups

Saved vault entries remain until you delete them. Server backups include the database and matching encryption key; the current deployment retains the newest 14 snapshots, taken daily and before some changes, on the server. Deleting a live entry does not instantly remove older backup copies. The application does not intentionally log submitted secret keys, passwords, or share tokens.

The help pages do not collect account details or accept privacy requests through a web form. Do not place a secret key or share token in a URL used to visit these pages. For an account at another service, use that provider’s own privacy or recovery process.

Contact

For questions about these guides or this website’s privacy practices, email [email protected]. Do not send passwords, secret keys, current codes, recovery codes, or private share links. We cannot recover accounts at other services.

Links to standards, provider documentation, or the authenticator open a different website or application. The destination handles its own requests under its own settings. This notice will be revised when the features or data practices described here change.