0fa.site
Home / Legal / Privacy Policy
Zero-Knowledge Architecture

Privacy Policy

At 0fa.site, privacy is not an afterthought or an opt-in toggle — it is mathematically engineered into our core architecture. We do not track you, sell your information, or store your private two-factor authentication secrets.

Last Updated: October 24, 2026 • GDPR & CCPA Compliant • Zero Third-Party Trackers

1. Zero-Knowledge Philosophy

Traditional authentication and verification portals require you to upload your sensitive credentials and authenticator secrets to remote databases. 0fa.site rejects this design completely.

When you enter an OTP secret or open a delivery link on 0fa.site, all computations are executed entirely on your client device using the standard window.crypto.subtle interface provided natively by modern browsers. Your plaintext secret keys never traverse our network.

🛡️

Mathematical Impossibility of Data Leaks

Because we do not ingest or store your TOTP secrets, it is architecturally and mathematically impossible for a database breach at 0fa.site to expose your authentication codes.

2. Information We Do NOT Collect

We believe data minimization is the ultimate privacy safeguard. We strictly do not collect:

  • Plaintext 2FA Secret Keys: Base32 or hexadecimal seeds are processed strictly in-memory within your device browser.
  • Personal Identity Profiles: We do not require account registration, usernames, real names, phone numbers, or credit cards to use the public authenticator.
  • Behavioral Tracking Data: We do not deploy Google Analytics, Meta Pixels, Hotjar, session recorders, or cross-site tracking beacons.
  • Advertising Identifiers: We have no advertising partners and never monetize user activity or sell behavioral data.

3. Data We Process Locally (On-Device)

To deliver a fluid and secure user experience, your browser may store minimal operational preferences locally:

Storage Scope Data Stored Purpose Duration
sessionStorage Temporary OTP secret Allows refreshing active tab without re-entering key Destroyed on tab close
localStorage 0fa_cookie_consent Remembers your consent preferences 1 Year
localStorage 0fa_admin_token Session token for authorized merchant operations 7 Days (or until manual lock)

You can clear these items at any time through your browser's Developer Tools or Clear Browsing Data settings.

4. URL Hash Fragment Cryptography (#t=...)

When an automated marketplace order delivers a 2FA link (e.g. https://0fa.site/#t=SECRET_DATA), the data is stored in the URI Fragment (the portion following #).

Pursuant to IETF RFC 3986 Section 3.5 and the W3C Uniform Resource Identifier specification:

Fragment identifiers are processed entirely on the client side by the user agent (web browser) and are strictly withheld from HTTP request headers.

As a result, neither our Cloudflare edge servers, nor intermediary proxies, nor ISP routing nodes ever receive or log your secret keys when you open a fragment link.

5. Ephemeral Customer Delivery Links

For merchants utilizing our Cloudflare Edge Worker API for automated e-commerce delivery:

  • Payload Encryption: Payloads stored in our ephemeral Edge Key-Value (KV) cache are encrypted using AES-GCM-256 before transmission.
  • Auto-Incineration: Links configured with view restrictions (e.g., Burn-After-Read) are permanently erased from KV storage the moment the buyer views the code.
  • Strict Expiration: Any unread ephemeral link is automatically deleted upon TTL expiration (maximum 72 hours).

6. GDPR Compliance & International Privacy Rights

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

  • Right to Erasure (Article 17): All client-side data can be wiped instantly by clearing your browser cache. Ephemeral links are automatically shredded.
  • Right of Access & Portability (Articles 15 & 20): You can export your bulk secrets to standard plain text (.txt) or JSON format directly within the application.
  • Right to Restriction of Processing (Article 18): Because we do not store personal profiles, there is no centralized processing to restrict.

7. California Consumer Privacy Act (CCPA / CPRA)

Under the California Consumer Privacy Act, California residents are entitled to know if their personal data is sold or shared:

✨

We Do NOT Sell or Share Personal Information

0fa.site has never sold, rented, or shared personal information with data brokers or advertisers, and will never do so in the future.

8. Security Architecture & Retention Schedule

We deploy rigorous technical safeguards to ensure our web environment remains hardened:

  • Strict Transport Security (HSTS): Forces 100% of connections over TLS 1.3 with modern AEAD ciphers.
  • Content Security Policy (CSP): Restricts script execution to approved hashes, preventing cross-site scripting (XSS) and unauthorized data exfiltration.
  • X-Frame-Options & Permissions-Policy: Prevents clickjacking and blocks unauthorized access to sensitive device sensors.

9. Data Protection Officer & Privacy Inquiries

If you have questions regarding this Privacy Policy or wish to exercise any privacy rights, contact our Data Protection Officer: