The short version.
- Your accounts and their setup keys are encrypted on your device before they go anywhere.
- We hold the encrypted result. We cannot open it — a full breach of our database yields no working code.
- You do not need an account. Without one, Fistbump never contacts us at all.
- There is no analytics, no advertising, and no tracking of any kind.
- Everything is hosted in the United Kingdom on renewable energy.
Who we are
Fiducia Fistbump is made by Fiducia Together Ltd, a company registered in England & Wales, company number 17428906, registered office 9 Merlin Grove, Leyland, England, PR25 1DA. For the purposes of UK data protection law we are the data controller for the information described here.
For anything on this page — including a request to see, correct or delete your data — write to privacy@fiduciatogether.uk.
Fistbump works without us
Fistbump is usable in full without an account. If you never sign in, the app makes no network request to us, stores nothing on our servers, and we hold no record that you exist. Your accounts live on your device and nowhere else. Signing in is only ever needed to sync between your own devices.
What stays on your device
Your two-factor accounts — the issuer, the account name, and above all the shared secret that generates the codes — are encrypted on your device with AES-GCM. The key that opens them is either wrapped under a passkey, using a secret only your authenticator can reproduce, or derived from your account password on your device using Argon2id. That derived key is never transmitted.
In a browser, the encrypted vault is kept in IndexedDB under a second AES-GCM key created as non-extractable: the browser will use the key but will not hand its bytes to any code, including ours. In a private window, or where storage is refused, nothing is written to disk and the vault is held in memory for that session only.
The camera
When you scan a QR setup code, the camera image is processed on your device to read the code and is never uploaded, stored or transmitted. The camera is only ever active while the scanner is open, and you can add an account by typing its setup key instead.
What our server holds, if you sign in
To sync between your devices we store:
- the encrypted vault as opaque ciphertext, with a version number and the time it was last written;
- wrapped copies of your vault key — one per passkey, plus one wrapped under the key derived from your account password. Each is unopenable by us;
- your registered passkeys: public keys and the device name and platform you gave them, so you can recognise and revoke them;
- your username and display name, and your account password stored only as a PBKDF2-HMAC-SHA256 hash with a random salt — never in readable form.
We do not ask for your email address, phone number, date of birth or address, and the app does not collect them.
What a complete breach of our server would yield: ciphertext, and a list of which devices exist. Not one working code. This is a property of the design, not a promise about our conduct — which is the only kind of assurance worth giving for an authenticator.
Approval prompts, and the location shown in them
When a Fiducia app asks Fistbump to confirm a sign-in — the "is this you?" prompt — we briefly hold what you need in order to judge it: the app making the request, the time, the requesting IP address and the approximate location derived from it.
This exists so that a request from somewhere you have never been is visible to you rather than hidden. It is shown to you and to nobody else, it is never used to track your movements or build a profile, and the record is deleted automatically: prompts expire on their own, and answered or expired prompts are pruned within a day.
Releasing a code to the browser companion
If you use the browser companion, a code you release to it is sealed on your device for that one request using an ephemeral P-256 key exchange, and only the companion that asked can open it. We relay the sealed result and cannot read the code in transit. Released and expired requests are cleared automatically.
What we cannot do
We cannot read your accounts, reset your master password, or recover your data if you lose every device and every recovery code. That is the necessary cost of the design above, and it is why the app asks you to keep a recovery code and an exported backup somewhere safe. Removing an account from Fistbump destroys this device's only copy of that shared secret — the app says so plainly before it does it.
Connection data
As with any service reached over the internet, your device's IP address and the time of the request necessarily reach our server in order to return a response. This is used to operate and secure the service — for example to detect abuse — and is not used to build a profile of you, is not sold, and is not shared with advertisers.
Cookies, analytics and tracking
The Fistbump app sets no cookies, contains no analytics, no advertising SDK, no crash-reporting service and no third-party tracker. Nothing you do in the app is measured or reported anywhere. There is no cookie banner here because there is nothing to consent to.
Where your data is, and what it runs on
Everything is hosted in the United Kingdom with Krystal Hosting Ltd, a UK company based in London, on infrastructure we chose partly for its environmental standing. Krystal publishes that its data centres run on 100% renewable energy without relying on offsets, that it has been a certified B Corporation since 2023, that its UK facility operates at a power usage effectiveness of 1.1, and that it is a member of 1% for the Planet and the UN Race to Zero. Its hosting is verified as green by the Green Web Foundation.
Those are Krystal's own published commitments rather than something we audit ourselves; we name them because a claim about green hosting should be checkable, and you can check it at krystal.io/green.
Your data is not transferred outside the UK by us. We do not use an overseas analytics, advertising or profiling provider, because we do not use one at all.
How long we keep it
Your encrypted vault and account are kept for as long as your account exists. Delete your account and the vault ciphertext, the wrapped keys and the passkey records go with it. Revoking a passkey removes its wrapped copy of your vault key immediately, which is what makes a lost device stop being able to produce codes. Approval prompts and companion code requests are cleared automatically as described above.
Your rights
Under UK GDPR you have the right to access your data, correct it, delete it, restrict or object to how it is used, and to receive a portable copy. Fistbump's built-in export gives you a complete, decrypted copy of your accounts on demand, which satisfies portability far better than a request queue would.
To exercise any right, write to privacy@fiduciatogether.uk. If you are unhappy with how we have handled it you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Fistbump is not directed at children and we do not knowingly hold data about a child. Because the app requires no account and collects no profile information, we hold no age data about anyone.
Changes to this policy
If this policy changes in a way that affects what we collect or what we can see, we will update this page and change the date below. The underlying commitment — that your accounts are encrypted before they reach us — is a property of the software, and any change to it would be a change to the app itself, announced as such.