NO ACCOUNT · NO TRACKING
Sakura 2FA is local-first and privacy-first.
Sakura 2FA is designed so your authenticator vault stays on your
device. The Sakura application does not create an account, send your
token vault to a server, run analytics, serve advertising, or use
tracking technologies.
1. What Sakura 2FA stores
Your OTP tokens, issuer names, account labels, secrets, counters,
settings, and the device recovery key are stored locally in the
browser's IndexedDB. The vault is encrypted before it is stored.
Sakura 2FA does not operate a cloud vault or a server-side account
database for your authenticator data.
2. What Sakura 2FA does not collect
✓ No name or profile
✓ No email address
✓ No phone number
✓ No account or password database
✓ No authentication-token cloud sync
✓ No analytics or telemetry
✓ No advertising IDs
✓ No cookies used for tracking
✓ No behavioral profiling
✓ No sale or sharing of personal data
3. Server and network behavior
The included Debian web application is a local web server whose job
is to serve the Sakura 2FA application files and perform the limited
QR image helper functions used by the app. It does not store your
vault, token secrets, PIN, or recovery key.
The Sakura 2FA Python server is configured with request logging
disabled. It does not record client IP addresses or request URLs in
its application logs.
If you place Sakura 2FA behind Caddy, a reverse proxy, CDN, firewall,
hosting panel, or VPS provider, that separate infrastructure may have
its own logging settings. Those systems are outside the Sakura 2FA
application itself and should be configured with access logging
disabled when you want a no-log deployment.
4. Offline operation
After the application shell has been cached successfully, Sakura 2FA
is designed to keep working without Internet access. OTP generation,
local QR scanning, photo import, manual token entry, and local vault
operations are performed on the device.
5. QR codes and camera access
Camera access is requested only when you choose to scan a QR code.
QR data is decoded locally by the app. Photo/file import reads the
image you explicitly select; the app does not send that image to a
cloud OCR service.
6. Clipboard, sharing, and exports
When you choose Copy, Share, or Save, the selected token/link or
encrypted backup is handed to the operating system or browser for
that action. Those destinations are under your control. Sharing an
otpauth:// link or QR code can reveal the underlying
token secret, so only share credentials you intend to transfer.
Encrypted .2fa backups are generated locally before they
leave the browser. The backup password is derived from the built-in
cryptodakini prefix plus the digits you choose. The digits
themselves are not stored as the backup password.
7. Permissions
Sakura 2FA may request camera access for QR scanning and file access
when you explicitly choose an image or encrypted backup. Your browser
and operating system control these permissions. You can revoke them
in device/browser settings.
8. Data deletion
Because the vault is local, deleting the site's browser data, clearing
IndexedDB, uninstalling the browser/PWA, or resetting the relevant
site storage can permanently remove the local vault. Keep an encrypted
.2fa backup before clearing site data or changing devices.
9. Security model
Sakura 2FA uses local encryption for the vault and provides a PIN for
quick unlock plus an automatically generated recovery key. The PIN is
an application unlock mechanism; it is not a promise that the physical
device, browser, operating system, or a compromised device is secure.
Protect your device, browser profile, recovery key, and exported backup
files. Anyone who obtains an unlocked device, recovery key, token
secret, or decrypted backup may be able to access your accounts.
10. Third-party services
Sakura 2FA's core vault does not require an analytics platform,
advertising network, account provider, or cloud storage service. The
app may contain links that you voluntarily open, such as creator or
support pages. Those external websites have their own privacy
practices and are not part of the Sakura 2FA vault.
11. Children's privacy
Sakura 2FA is not designed as a service for collecting information
from children. No account registration or profile information is
required to use the application.
12. Changes to this policy
If Sakura 2FA's data-handling behavior changes, this policy should be
updated together with the application build. The policy describes the
Sakura 2FA application itself; separately configured hosting, proxy,
CDN, operating-system, and browser services may have their own logs or
policies.
CREATED BY
cryptoDakini
Sakura 2FA is created and maintained by cryptoDakini.
Last updated: 2026-09-17 · Sakura 2FA build v23 · Privacy policy for the
application software, not for separately operated hosting or third-party
services.