Frequently asked

Almost nothing. The protocol the phone speaks is a compact binary format, typically a few hundred bytes per screen, encrypted in transit like everything else. A typical day of use is comfortably under 1 MB.

Great for everyday accounts; assess your risk tolerance for your most sensitive ones. Codes from a paired phone travel over a channel we encrypt ourselves using ChaCha20-Poly1305, the same cipher TLS 1.3 uses because 2003-2013 phones can't validate modern security certificates. That keeps every request private and tamper-proof, but it can't prove the server's identity the way a browser's padlock does. So we treat these codes as medium-security: ideal for logins where a second factor is a sensible extra, less suited to high-value financial or administrative accounts. Whatever you protect with them, keep the backup codes the other service gave you somewhere safe. The full reasoning is on the how it works page.

No, none of it. We don't run ads, sell or share your data, profile you, or use your data to train AI models. RetroRelay is paid for by people who choose to support it, which is exactly what lets that answer stay simple. The only thing we keep is a handful of anonymous counters (like how many phones pair, or which features get clicked) that aren't tied to your account, and every one is listed on the privacy page.

Yes. Every feature is free for one phone. Supporters pay once, any amount from £3, and can pair up to 6. There's more on the pricing page.

You can pair one phone for free, or up to six as a supporter, and they all sit under your one account. Pair each separately, each shows its own six-digit code, and your dashboard lists them so you can rename or unpair any single phone without touching the others. One thing to know: every paired phone shares your one account, so they all see the same Authenticator codes, Habits, Tasks, Events, and Weather. That's perfect for your own spare phones or a shared household view, but it isn't a separate private account per person.

In the web app: Account → Delete Account. It's immediate and removes your account and all its data, along with every paired device, in one step. Before you go, you should export any Authenticator account seeds from the Authenticator feature page as we can't recover those for you once your account has been deleted.