Privacy

Last updated 13 September 2026.

Latch holds two-factor secrets, so it is worth being exact about what is stored, what never is, and how to get rid of all of it.

What is stored

Data	Why	How
Your email address	It is your username, and the only way to recognise your account.	Plain text.
Your password	To sign you in.	Salted hash (scrypt). The password itself is never written down.
Your API key	To authenticate machine requests, and to re-show the key in your vault.	A SHA-256 hash for lookup, plus a Fernet-encrypted copy so the vault can display it again.
Your TOTP secrets	To compute your codes.	Fernet-encrypted (AES-128-CBC + HMAC-SHA256). The encryption key is held outside the database.
Issuer and label	So you can tell your entries apart.	Plain text — whatever you typed or the QR code contained.
Account creation time	Housekeeping.	Timestamp.

If you use Continue with Google, Latch receives and stores only two things from Google — your email address and your Google account ID — and never your name, photo, contacts or Google password. Alongside them it keeps one yes/no flag: whether Google vouched that the Google account owns this Latch account's email address (true for Gmail and Google Workspace addresses).

What is never stored

• Generated codes. Every code is computed at the moment you ask for it and then discarded. There is no log of codes issued.
• QR screenshots. Images you drop into the vault are decoded by JavaScript in your own browser. The image is never uploaded — only the otpauth:// string it contains is sent, over HTTPS.
• Payment details. Latch is free and asks for no card.
• Analytics, advertising or tracking cookies. There are none, and no third-party scripts of any kind. The only cookie is the session cookie that keeps you signed in.

Who can see it

• You. Through the web vault, or the API with your key.
• Whoever holds your API key. It unlocks every code in your vault — that is the deliberate trade-off Latch exists to make. It does not unlock the secrets behind those codes: there is no export route on the API, so a leaked key can be fully revoked by rotating it from Your API. Treat it like a password.
• Nobody else. Vaults are scoped to their owner at the database-query level; another account asking for one of your ids gets a 404. Your data is never sold, rented, or shared with third parties, and it is not used to train anything.
• Operators, in principle. Whoever runs the server holds the encryption key, so a determined operator could decrypt stored secrets. That is true of every hosted authenticator. If that is not an acceptable risk for you, do not put your most critical accounts in a hosted vault — keep those on a device-only authenticator and use Latch for the automation accounts it is built for.

Getting your secrets out

Your TOTP secrets are yours, and you can take them with you. Each entry in your vault has an Export link that shows the setup QR code and the otpauth:// URI behind it, which any authenticator — Google Authenticator, Authy, 1Password, Aegis, Bitwarden — can import. Exporting does not remove the entry from Latch.

Be clear about what comes out. An export gives you the seed itself, in plain text — the QR code, the base32 setup key and the otpauth:// URI are three renderings of the same secret, and nothing encrypts or wraps any of them. It is a bearer credential: anyone who ends up with it — from a screenshot, a photo of your screen, your clipboard, a screen share — can generate valid codes for that account indefinitely, without your password and without touching Latch at all. It cannot be revoked. The only way to invalidate an exported seed is to turn two-factor off at the site it belongs to and set it up again, which issues a new one. Latch produces no file and keeps no extra copy; once it is on your screen, where it goes next is outside anything we control.

Because of that, the path to it is deliberately narrow — it is the only one in the whole service that reveals a stored secret rather than a code:

• It asks for your password, on the request that returns the secret — not merely at some earlier point in your session. A stolen session cookie on its own gets a password prompt, not a seed.
• The API cannot do it at all. There is no export endpoint on /api/. An API key lives in CI config and shell history, so it is the credential most likely to leak; keeping seeds out of its reach is what makes rotating a leaked key a complete fix rather than a partial one.
• One entry at a time. There is no “download everything” button, so no single click or mistaken tap can spill a whole vault.
• The QR code is drawn in your browser, from the URI, by a script served from this site. No picture of your secret is ever generated on the server, so none can be cached or logged along the way.

Deleting your data

• Removing an entry in the vault deletes its encrypted secret immediately and permanently. There is no soft delete and no recycle bin.
• To delete the whole account — the login, the API key and every stored secret — open your vault and use Delete my account at the bottom of the page (auth.amgcc.space/app). It asks for your password and for your email address typed out, then deletes the entries and the account itself in a single step. It takes effect immediately: the API key stops working at once, and there is no backup, no soft delete and no recycle bin. Nobody here can reverse it afterwards.
• Before you delete, make sure you can still get into the sites those codes belong to. Deleting an entry does not turn two-factor off at the site itself — that site will still ask for a code. Use Export on anything you still need first (see above), or re-enrol it in another authenticator, or save the site's recovery codes. The deletion page lists exactly which entries are about to go.
• If you cannot sign in and so cannot reach that page, email [email protected] from the address you signed up with and ask for the account to be deleted.

Security notes

• All traffic is HTTPS. The session cookie is HttpOnly, SameSite=Lax and Secure. A session lasts 14 days from when you sign in, and resetting your password or rotating your API key signs out every other browser. We email you whenever a Google account is connected to yours, and a password reset disconnects one that was connected with only your password. The first password reset on an account whose address had never been confirmed also replaces its API key.
• The site sets frame-ancestors and X-Frame-Options so no other origin can frame your vault.
• No API endpoint returns a stored TOTP secret. Secrets leave Latch by exactly one route — Export, in the browser, with your password, one entry at a time.
• Sign-in and signup are rate limited per IP. An account that collects many failed sign-ins gives each IP only a few more tries at it, while a correct password from an address that has not been guessing still works.

Children

Latch is not intended for anyone under 13, and accounts are not knowingly created for them.

Changes

If this page changes materially, the date at the top changes with it.

Contact

Alpha Marketing Group — [email protected].