SSem Privacy Policy
Effective September 29, 2026
Levelupsoft Inc. (“we”) provides the macOS app SSem TouchOTP (the “app”) and its information website (https://levelupsoft.com/SSemTouchOTP/en/, the “website”), and complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws. This policy explains what information the app and the website handle, and how. If this English version and the Korean version differ, the Korean version prevails.
Summary: The app does not collect personal information and sends nothing to us. It has no network entitlement and cannot connect to the internet. The account information you enter is stored encrypted on your Mac only, and we have no access to it.
1. Information we collect
We do not collect any personal information through the app.
- There is no sign-up or sign-in.
- The app has no networking features and no network entitlement, so it cannot send information anywhere.
- It contains no analytics, advertising, tracking or crash-reporting tools.
- The app makes no connections of its own, not even update checks.
- It does not request access to the camera, microphone, photos, contacts or location.
2. Information stored only on your Mac
To work, the app stores the following only on your Mac. We never receive or see it.
| Information | Where and how it is protected |
|---|---|
| OTP accounts (issuer, account name, secret key, and settings such as algorithm, digits, period and counter) | A vault file in the app’s own container, encrypted with AES-GCM. Its key is sealed by a Secure Enclave key that opens only with the currently enrolled fingerprints. |
| The sealed vault key and a generation number for tamper detection | The macOS keychain (this device only; never synced with iCloud Keychain) |
| App settings (auto-lock time, app language, backup reminder state, fingerprint enrollment identifier) | The app’s own settings file. It contains no secret keys or codes. |
The vault file opens only with this Mac’s security key, so a copy of it cannot be opened on another Mac.
3. Touch ID and fingerprint data
Fingerprint recognition is handled by macOS and the Secure Enclave. The app never accesses or stores fingerprint images or fingerprint data; it only learns whether authentication succeeded. To explain when the fingerprint enrollment has changed, the app may keep the “enrollment identifier” macOS provides in its settings, but this value cannot be used to reconstruct any fingerprint.
4. Clipboard and screen capture
- A copied code goes to this Mac’s clipboard only and is cleared automatically after 30 seconds unless you copied something else meanwhile. It is also cleared when the app locks or quits.
- Copied codes are marked so they are not passed to your other devices via Universal Clipboard and not kept by clipboard history apps (to the extent those apps honor the marker).
- A pasted QR image is cleared from this Mac’s clipboard right after it is read. QR recognition happens on your Mac, and the image is not stored.
- The app’s windows are excluded from screen recording, screen sharing and screenshots (as far as macOS allows).
5. Backup files
When you export a backup, an encrypted backup file (.touchotp) is saved to the location you choose. It opens only with the passphrase you set (PBKDF2-SHA256 and AES-GCM) and is never sent to us. Where you keep the file and who you share it with is entirely up to you. If you forget the passphrase, we cannot recover it.
6. Website
- The website uses no cookies, analytics, advertising, external fonts or external scripts.
- For security and operations (troubleshooting and blocking abusive access), the web servers (including the front-end proxy) automatically keep access logs containing the IP address, the date and time, the requested address, and the response status and size. Depending on the server configuration, the referring page (Referer) and browser type (User-Agent) may also be logged. No cookies are used, so none are logged.
- Legal basis: Article 15(1)(6) of the Personal Information Protection Act (our legitimate interest in security and troubleshooting); processed without consent.
- If you click a link on the app’s About screen, your Mac’s default web browser opens this website. That connection is made by the browser; the app itself does not communicate.
7. Information in support requests
If you email us, we process your email address, your name (if provided) and the content of your message to answer you. We use this information only to answer the request and keep a record of it. Please don’t include secret keys, codes, QR images, backup files or passphrases.
Legal basis: Article 15(1)(4) of the Personal Information Protection Act (acting on your request); processed without consent.
8. Sharing, processors and transfers abroad
We do not share or sell personal information, except where the law requires disclosure. The app sends no information, so nothing is shared, outsourced or transferred abroad through the app.
Support email is received and stored by the following provider (processing on our behalf and transfer abroad).
| Recipient | Google LLC (Google Workspace email), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA · https://support.google.com/policies/ |
|---|---|
| Information | Email address, name (if provided), message content |
| Countries | The USA and other countries with Google data centers |
| When and how | Sent over the network when your email arrives |
| Purpose | Receiving and storing support email |
| Retention | Same as support requests in section 9 |
| How to refuse | If you don’t want this, don’t email us. We then can’t answer you, but the app works the same. |
The app is sold on the Mac App Store. Apple handles purchase, payment, download and device information under its own privacy policy; we never receive buyers’ names or payment details (we only see Apple’s aggregate sales reports).
9. Retention and deletion
- App information: we hold none. It is removed from your Mac when you delete accounts in the app, or delete the app and its data folder (
~/Library/Containers/com.levelupsoft.touchotp). Older copies of the vault file in Time Machine backups or APFS snapshots, and backup files you exported, may still contain deleted accounts; delete them separately if needed. The security keys left in the keychain can’t bring back any account information on their own. - Web server access logs: kept for one year from collection, then deleted.
- Support requests: kept for one year after the request is resolved, then deleted.
- Information past its retention period is deleted without delay.
10. Your rights
You may ask to access, correct, delete or stop the processing of personal information we hold about you (such as support requests). Email the privacy officer below and we will act and reply within 10 days. You may also make a request through a legal guardian or an authorized agent (please include a power of attorney). Information stored in the app can be viewed, changed and deleted by you directly.
11. Security measures
- App: App Sandbox, hardened runtime, no network entitlement, encryption bound to the Secure Enclave and Touch ID (current fingerprint enrollment), device-only keychain items, auto-lock, automatic clipboard clearing, and no secrets in logs.
- Distribution: the Mac App Store (reviewed, signed and distributed by Apple).
- Website and support information: restricted access and only the minimum information needed.
12. Children
The app collects no personal information from anyone, including children. The website and email support handle only the information in sections 6 and 7; if we learn that a child under 14 contacted us without a legal guardian’s consent, we delete that information without delay.
13. Privacy officer
| Company | Levelupsoft Inc. |
|---|---|
| Privacy officer | Patrick Kim, Development Lead |
| halo@levelupsoft.com |
You can also report or seek advice on privacy violations from the Korean Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Personal Information Dispute Mediation Committee (+82 1833-6972, www.kopico.go.kr), the Supreme Prosecutors’ Office (1301) or the Korean National Police Agency (182).
14. Changes to this policy
If we change this policy, we will post the changes and the effective date on this page. If the way the app handles information changes (for example, a new networking feature), we will announce it before releasing that version.
Previous versions: none (first version)