Mahsumah Authenticator — Privacy Policy

Mahsumah Authenticator is an authenticator app from Mahsumah. When you sign in to Mahsumah Cloud, the website shows a code (QR) that you scan with the app; the app asks you to confirm with biometrics (Face ID / Touch ID) and then displays a 6-digit verification code that rotates every 30 seconds, which you enter on the website to complete sign-in. The app's sole purpose is to secure your login.

The app collects only the minimum required to secure your login:

• Device identifier / push token: when you first pair your device, the app generates a device-specific secret (and an APNs push token when notifications are enabled) stored securely in the Keychain on your device and sent to Mahsumah's server to bind your phone to your account and deliver login-approval requests. This identifier is used for app functionality only and is not used for tracking.
• Login request identifier: when you scan a code, the app exchanges the short-lived session id (it expires within minutes) with the server to obtain the verification code.

The camera is used solely to scan the login code shown on the website; we do not capture, store, or transmit any image. Biometrics (Face ID / Touch ID) are handled entirely on-device by iOS — the app receives only a success/failure result and never accesses or stores your face or fingerprint data.

• We use no analytics, advertising, or third-party tracking SDKs.
• We do not track you across other apps or websites, or build profiles about you.
• We do not sell your data or share it with any third party for promotional purposes.
• The app asks for no password; verification codes are derived on your device.

The app communicates exclusively with Mahsumah's server at cloud.mahsumaah.sa (hosted in Riyadh, Kingdom of Saudi Arabia) and Apple's Push Notification service (APNs) to deliver approval requests when notifications are enabled. No data is sent to any other party.

The device secret remains in the Keychain until you delete the app or unbind the device from your account settings. Deleting the app removes the secret from your device. To unbind a device or delete its data from the server, contact us at info@mahsumaah.sa.

The app is a security tool intended for Mahsumah Cloud account holders and is not directed to children.

We handle personal data in line with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia. For our general company privacy policy see the Privacy Policy. For any question about the app's privacy, contact Mahsumah at info@mahsumaah.sa — Riyadh, Kingdom of Saudi Arabia.