Privacy

Last updated 1 August 2026.

Latch holds two-factor secrets, so it is worth being exact about what is stored, what never is, and how to get rid of all of it.

What is stored

Data	Why	How
Your email address	It is your username, and the only way to recognise your account.	Plain text.
Your password	To sign you in.	Salted hash (scrypt). The password itself is never written down.
Your API key	To authenticate machine requests, and to re-show the key in your vault.	A SHA-256 hash for lookup, plus a Fernet-encrypted copy so the vault can display it again.
Your TOTP secrets	To compute your codes.	Fernet-encrypted (AES-128-CBC + HMAC-SHA256). The encryption key is held outside the database.
Issuer and label	So you can tell your entries apart.	Plain text — whatever you typed or the QR code contained.
Account creation time	Housekeeping.	Timestamp.

Generated codes. Every code is computed at the moment you ask for it and then discarded. There is no log of codes issued.
QR screenshots. Images you drop into the vault are decoded by JavaScript in your own browser. The image is never uploaded — only the otpauth:// string it contains is sent, over HTTPS.
Payment details. Latch is free and asks for no card.
Analytics, advertising or tracking cookies. There are none, and no third-party scripts of any kind. The only cookie is the session cookie that keeps you signed in.

You. Through the web vault, or the API with your key.
Whoever holds your API key. It unlocks every code in your vault — that is the deliberate trade-off Latch exists to make. Treat it like a password and rotate it from Your API if it is ever exposed.
Nobody else. Vaults are scoped to their owner at the database-query level; another account asking for one of your ids gets a 404. Your data is never sold, rented, or shared with third parties, and it is not used to train anything.
Operators, in principle. Whoever runs the server holds the encryption key, so a determined operator could decrypt stored secrets. That is true of every hosted authenticator. If that is not an acceptable risk for you, do not put your most critical accounts in a hosted vault — keep those on a device-only authenticator and use Latch for the automation accounts it is built for.

Removing an entry in the vault deletes its encrypted secret immediately and permanently. There is no soft delete and no recycle bin.
To delete the whole account — the login, the API key and every stored secret — email alphamarketinggroup916@gmail.com from the address you signed up with. Deletion is permanent and cannot be reversed.

All traffic is HTTPS. The session cookie is HttpOnly, SameSite=Lax and Secure.
The site sets frame-ancestors and X-Frame-Options so no other origin can frame your vault.
No endpoint returns a stored TOTP secret — not even to the account that owns it.
Sign-in and signup are rate limited per IP.

Latch is not intended for anyone under 13, and accounts are not knowingly created for them.

If this page changes materially, the date at the top changes with it.