1code ID

Privacy Policy

Last updated 19 October 2026 · applies wherever you are · your region

1code ID is a sign-in app. Your phone becomes your key: you approve every sign-in with your fingerprint or Face ID, and that check never leaves your phone. This policy says, in plain language, what we collect, why, where it is kept and what you can do about it. The same policy applies to everyone, in every country; the section at the end adds what your country's law gives you on top.

The short version

Your fingerprint or Face ID is checked by your phone's own operating system. 1code never sees, receives or stores it.
The private key that signs your approvals is created on your phone, kept in the phone's protected keychain behind your fingerprint or Face ID, and never leaves the phone. We hold only the matching public key.
There is no password and no email sign-in code. An account is a username and a phone. An email address is optional.
We collect the minimum needed to run your account. We don't sell your data, show ads, or embed third-party trackers.

Who we are

1code ID is operated by 1code x LTD (company number 12828341), 2 Centurion Way, Credenhill, Hereford, England, HR4 7FF, United Kingdom, a company registered in England and Wales. We decide what is collected and why, which makes us the controller of your personal information (the "responsible party" in South African terms), wherever you are. Our team works from South Africa. Questions, requests and complaints: support@1code.id.

What we collect, and why

What	Why	Legal ground, where your law asks for one
Your account — a username you choose. An email address only if you add one, and we keep it only once you have verified it. Your language, time zone and country, if you tell us them (your phone offers what it is set to; we never work them out from your connection).	To run your account and show apps you approve who you are. The email is used only to contact you about your account and, with your approval on screen, to pass to an app you sign in to. Language, time zone and country are passed, with that same approval, so an app can show you dates, times and prices your way. A work address under a company's name (you@company.1code.email) is the company's: the company's owner can see it and close it.	Our agreement with you. The optional email, language, time zone and country: your choice, which you can change or clear at any time.
Your device key and certificate — the public half of the key your phone generated, the certificate we issued for it (a serial number, issue and expiry dates), the type of phone it reports, what protects the key (a protected keychain entry today), and a device name you can set.	To recognise your phone when it approves a sign-in, and so you can see and remove your own devices.	Our agreement with you.
Fingerprint and Face ID	Not collected. The check happens entirely on your phone, performed by its operating system; 1code ID asks "is this the enrolled person?" and receives only yes or no. No fingerprint or face data is transmitted to us or stored by us.
Sign-in approvals — which app or website asked, when, the stable identifier we released for you, and what you agreed to share on that screen.	To perform the sign-in and to show you your own activity.	Our agreement with you.
Key holders and recovery — the people you choose as key holders, invites you send, recovery requests, who confirmed them and when.	So you can get back into your account if you lose your phone, and so you can see who confirmed what.	Our agreement with you.
Security and activity records — the time, the device and the action for sign-ins and sensitive changes (adding or removing a phone, starting or refusing a recovery).	So you can review them, and so we can detect fraud and abuse.	Our legitimate interest in keeping accounts safe, which we balance against yours.
Identity verification — only if you use it	If a business asks you to verify your identity, you can photograph an identity document with your camera. The images go to that business's verification service, named on screen before you start, and are handled under its privacy terms. 1code ID does not keep a copy. If you never go through a verification, this never happens.
In your browser	This site keeps only what makes it work and what you chose: your sign-in session (a cookie on auth.1code.id), and your theme and region choices on these pages (stored in your browser, never sent to us). No analytics, advertising or tracking scripts; fonts and every script come from our own domain, so no other company sees your visit.
Technical data — the country your network connection appears to come from, used to show you the right region on this page.	To show the right section of this policy.	Not stored by us; our hosting provider keeps short-lived network logs, including IP addresses, for security.

We do not read your phone's address book, your messages or your photos. The camera is used for two things only: scanning codes (to pair a phone, approve a sign-in or confirm a recovery in person) and, if you choose to verify your identity, photographing a document. It is never used in the background.

Where your information is kept

Our database runs on Cloudflare's network and is stored in Western Europe. The key that signs device certificates is held in Google Cloud's Johannesburg region. We are a company registered in the United Kingdom, and our team accesses the service from South Africa. Cloudflare (hosting) and Google Cloud (key management) process data only on our instructions, under their data-processing agreements, which include the standard contractual clauses used for international transfers. Your region's section below says what this means under your law.

What we share

When you sign in to an app or website that uses 1code ID, you approve exactly what is released: a stable identifier for you, and only the specific details you consent to on that screen (such as your username or a verified email). Nothing is shared until you approve it with your fingerprint or Face ID. Beyond that:

We do not sell your personal information, and we do not share it for advertising.
We do not show advertising, and the app embeds no third-party analytics or tracking.
We rely on the infrastructure providers named above, who process data only on our instructions.
We may disclose information where the law requires it, and we will tell you unless the law forbids that.

How long we keep it

Account information: for as long as your account is active, then removed within 30 days of your deleting it.
Certificates: a retired or revoked certificate is kept for 12 months so that revocation checks keep working, then removed.
Security and activity records: 12 months.
Recovery requests and confirmations: 12 months after they complete, expire or are refused.
Sessions: they expire within hours and are then removed.

Your rights

Wherever you live, you can ask us to show you the personal information we hold about you, correct it, give you a copy in a portable form, or delete it. You can remove an optional email at any time, remove any of your devices, and delete your account in the app or by asking us. You can object to processing we base on our legitimate interests. We do not make automated decisions about you that have legal or similarly significant effects. Email support@1code.id from a phone that holds your account; we reply within 30 days, and sooner where your law requires. If you are unhappy with our answer you can complain to the regulator for your region, named below.

Security

Your private key never leaves your phone. We hold only public keys and certificates, which cannot be used to sign in. Certificates are short-lived and renew themselves; a lost phone's certificate is revoked the moment a recovery completes. All traffic is encrypted in transit. If a breach ever affects your information, we will tell you and the authorities your law requires, within the time it requires.

Children

1code ID is not intended for anyone under 18, and we do not knowingly collect their information. If you believe a child has created an account, email support@1code.id and we will remove it.

Changes to this policy

If we change this policy we will update the date above and, for significant changes, tell you in the app before they take effect.

Your region

Your country's law may give you rights and protections beyond the ones above. This section shows them for where you are; it never takes anything away from the policy above.

Every region’s section is on this page.

South Africa

The Protection of Personal Information Act, 2013 (POPIA) applies to how your information is handled. 1code x LTD is the responsible party. You have the rights in Chapter 3 of POPIA, including to be told what we hold, to correct or delete it, and to object to processing. We do not use your information for direct marketing. Your information is stored in Western Europe and handled by a company outside South Africa, under contractual safeguards that meet section 72 of POPIA. Our PAIA and POPIA manual is available on request from support@1code.id. Complaints: the Information Regulator (South Africa), inforegulator.org.za, after you have raised the matter with us.

Europe: EU, EEA, United Kingdom and Switzerland

We are a UK company, so the UK GDPR and the Data Protection Act 2018 govern everything we do with your information. The General Data Protection Regulation (GDPR) applies as well if you are in the EU or EEA, and the Federal Act on Data Protection if you are in Switzerland. 1code x LTD is the controller.

Legal bases. Running your account, your devices, your sign-ins and your recovery: performance of our agreement with you (Article 6(1)(b)). Security and activity records: our legitimate interests in keeping accounts safe (Article 6(1)(f)). An optional email address and identity verification: your consent, which you can withdraw. We process no special-category data: the fingerprint or Face ID check happens on your phone and we receive only yes or no.

Your rights (Articles 15 to 22): access, rectification, erasure, restriction, portability, objection, and the right not to be subject to a solely automated decision with legal effects, which we do not make. Exercise them at support@1code.id; we answer within one month.

Where your data is. Our database is in Western Europe. The EU recognises the United Kingdom as offering adequate protection, and our team's access from South Africa is covered by the UK's international data transfer terms (the Addendum to the standard contractual clauses). Our providers may process data elsewhere under the same clauses.

Representative. We are established in the United Kingdom, so no UK representative is needed. We have not yet appointed a representative in the EU under Article 27 GDPR; we will do so, and name them here, before offering 1code ID to the public in the EU. Until then, support@1code.id is the contact for everything.

Complaints. Our home regulator is the Information Commissioner's Office (ico.org.uk). You can also lodge a complaint with your national supervisory authority in the EU or EEA, or with the Federal Data Protection and Information Commissioner in Switzerland.

United States

State privacy laws, including the California Consumer Privacy Act as amended, give residents of several states rights over their personal information. We are currently below the thresholds at which those laws apply to a business, but we honour the same rights for every US resident anyway: to know what we collect and why, to access it, to correct it, to delete it, to receive a portable copy, and not to be treated differently for exercising them.

We do not sell or share your personal information in the sense those laws use, so there is nothing to opt out of; we do not use it for targeted advertising or profiling. We do not collect sensitive personal information: the fingerprint or Face ID check stays on your phone, and we do not collect precise location. Requests: support@1code.id; you may use an authorised agent with written permission. If we decline a request you may appeal by replying to our answer. 1code ID is not directed at children under 13, and no one under 18 may use it.

Brazil

The Lei Geral de Proteção de Dados (LGPD) applies. 1code x LTD is the controller. Legal bases: performance of the contract with you (your account, devices, sign-ins and recovery), our legitimate interest (security records), and your consent (optional email, identity verification). You have the rights in Article 18, including confirmation, access, correction, anonymisation or deletion, portability, information about sharing, and revocation of consent. Your data is stored in Western Europe and handled by us, a UK company working from South Africa, under contractual clauses, as Article 33 allows. We are a small processing agent; our contact channel for data-protection matters, in place of a formally designated encarregado, is support@1code.id. Complaints: the Autoridade Nacional de Proteção de Dados (ANPD).

Rest of Africa

Data-protection laws across Africa give you broadly the rights described above; we honour them in every country. In particular:

Nigeria: the Nigeria Data Protection Act, 2023 applies. Lawful bases as in the table above; rights of access, correction, deletion, portability and objection; complaints to the Nigeria Data Protection Commission. We will register with the Commission when we meet its "major importance" thresholds.
Kenya: the Data Protection Act, 2019 applies; rights under section 26; complaints to the Office of the Data Protection Commissioner. We will register with the Commissioner when the Act's registration thresholds apply to us.
Ghana: the Data Protection Act, 2012 applies; complaints to the Data Protection Commission.

Everywhere else in Africa, the policy above applies in full and you can complain to your national data-protection authority where one exists.

Asia-Pacific

India: the Digital Personal Data Protection Act, 2023 applies, with its Rules taking effect in stages to May 2027. We process your data on the basis of your consent, given when you create an account, which you can withdraw by deleting it. You have the rights in Chapter III, including access, correction, erasure and grievance redress; our grievance contact is support@1code.id. Complaints: the Data Protection Board of India.
Australia: we are below the Privacy Act's small-business threshold, but we handle your information in line with the Australian Privacy Principles anyway. Complaints: the Office of the Australian Information Commissioner.
Singapore: the Personal Data Protection Act applies; our data-protection contact is support@1code.id; complaints: the Personal Data Protection Commission.

Elsewhere in the region, the policy above applies in full and you can complain to your national authority.

Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and in Québec the Act respecting the protection of personal information in the private sector. We collect with your knowledge and consent, for the purposes in the table above, and you can withdraw consent by removing the optional data or deleting your account. You have the right to access and correct your information. Our privacy officer is reachable at support@1code.id. Your information is stored in Western Europe and handled by us, a UK company working from South Africa. Complaints: the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information in Québec.

Everywhere else

The policy above applies to you in full, wherever you are: what we collect, why, how long we keep it, and your rights to see, correct, export and delete it. If your country's law gives you more, you have that too, and you can complain to your national data-protection authority. We will add a section for your region as 1code ID grows there.