Terms of Service

By downloading, installing, configuring, or operating Ghost Auth Manager ("the Application"), provided by SDDEV ("Developer", "we", "us", or "our"), you acknowledge that you have read, understood, and agreed to these Terms of Service. If you do not accept these terms, you must refrain from using the Application.

These terms apply across all supported Android platforms, including smartwatches (Wear OS), smartphones, foldables, tablets, and Android TV.

We grant you a personal, revocable, non-exclusive, non-transferable license to use Ghost Auth Manager for safeguarding credentials, passkeys, TOTP two-factor codes, and identity items on devices you legally control.

The Application is intended as a sovereign personal vault. You agree not to distribute modified binary forks, bypass biometric checks, or use the Application for unlawful interception of authentication secrets.

Ghost Auth Manager is engineered around a strict zero-knowledge security architecture:

• SQLCipher 256-Bit AES Encryption: Every credential record, username, password, TOTP seed, and custom field is encrypted prior to being written to storage.
• Hardware KeyStore Derivation: Cryptographic keys are protected using Android KeyStore hardware backends with strong PBKDF2/Argon2 key derivation.
• Zero Cloud Relays: We maintain zero central authentication servers, zero telemetry relays, and zero accounts. Your data never touches a server operated by SDDEV.

If you forget your master password and have not established a secure secondary export or backup, your vault contents are permanently unrecoverable by anyone, including the Developer. You are solely responsible for memorizing your master credentials and regularly exporting encrypted backup files to secure offline locations.

Ghost Auth Manager interfaces directly with Android's system-level AutofillService framework and the Android Credential Manager API:

• Domain Matching & Package Verification: Autofill suggestions are surfaced locally by matching website domains and verified Android package signatures.
• Passkeys (FIDO2/WebAuthn): Passkey private keys generated within the app are stored exclusively in your encrypted SQLCipher database. They are never exported or synchronized without your explicit direction.

The Application includes an optional Bluetooth Human Interface Device (HID) feature, allowing your Android device to emulate a standard hardware keyboard and wirelessly inject credentials into external hosts (PC, Mac, Linux, TV):

• Direct Point-to-Point Bluetooth: Keystrokes are transmitted directly over local Bluetooth radio without intermediary cloud proxies or clipboard sharing.
• Pairing Caution: You are responsible for ensuring you only pair and transmit credentials to trusted host machines that you physically verify.

Ghost Auth Manager allows you to establish optional encrypted backups to your personal Google Drive or Dropbox storage:

• Direct OAuth Tokens: The app connects directly from your phone to Google or Dropbox using direct OAuth tokens stored on-device. No intermediate proxy exists.
• Client-Side Pre-Encryption: Backup archives are encrypted with your master key before leaving your device. Even if your cloud account is compromised, vault items remain unreadable without your master password.
• Third-Party Terms: Your usage of Google Drive or Dropbox is governed by their respective terms of service and availability.

Ghost Auth Manager provides core password and 2FA vault capabilities as sovereign software. Any optional premium licenses, supporter contributions, or feature packs are handled strictly via Google Play Billing:

• No Financial Data Collection: We never collect, process, or store credit card numbers, payment tokens, or billing addresses.
• Google Play Terms: All transactions and billing inquiries are governed by Google Play's Refund Policy.

The Application is supplied on an "AS IS" and "AS AVAILABLE" basis without warranties of any kind. While engineered following industry-standard cryptography, SDDEV cannot guarantee immunity against compromised operating systems, rooted devices, keyloggers, or hardware-level malware.

To the maximum extent permitted by law, SDDEV shall not be liable for any lost credentials, account lockouts, unauthorized access resulting from compromised master passwords, or data loss.

We may update these Terms of Service periodically. Changes take effect upon posting with an updated effective date. Continued use of Ghost Auth Manager signifies acceptance of the amended terms.

For inquiries, security reports, or support, please contact us: