End User License Agreement
1. Terms used in this licence
- The App is the Ydentifi Authenticator application for iOS, published by Ydentifi through the
official Apple App Store. It is the software to which this licence applies.
- Ydentifi (also "we", "us") is Ydentifi Ltd., the publisher of the App and the party
responsible under this licence.
- The Ecosystem is the ensemble of distinct software components, including but not limited to
server, mobile applications, SDKs, proprietary and freely distributed libraries, as well as cryptographic protocols and specifications, allowing organizations to implement multi-factor authentication ("MFA") and action authorization workflows based on these and other components, embedding them in their products, software and services.
- The Relying Party is the organisation that gives you the setup code or equivalent, for example your
employer, your bank, your service provider or similar, and it is the entity responsible for providing the service and its quality.
- The setup code is a QR code, number, string of characters or similar token, used to link the
App to the Relying Party's service. Only once a setup code from a Relying Party has been used to link the App to that service does the App begin providing its core functionalities.
2. Who this is between, and what it covers
This licence is between you and Ydentifi Ltd., a company registered in the Republic of Bulgaria under number 208962261, with its registered office at Todor Aleksandrov No. 46, floor 2, 2700 Blagoevgrad ("Ydentifi", "we", "us").
It covers only your use of the Ydentifi Authenticator application (the "App") on your own device. It is not a contract for any service.
2.1 Ydentifi Ltd. publishes the App and is the party responsible under this licence. Any claim arising out of the App or out of this licence lies against Ydentifi Ltd. and against no one else, as clause 14 sets out.
2.2 The App is a freely distributed component of the Ecosystem, which might or might not be used by a Relying Party in the process of building MFA or action authorization workflows embedding arbitrary number of parts of the Ydentifi ecosystem.
2.3 We assume no responsibility, express or implied, for the integrity or operation of any service or functionality provided by a Relying Party, or for any data processed by such a service or functionality. This does not affect any liability that cannot lawfully be excluded, which clause 14 sets out.
2.4 By accepting this licence, the user acknowledges and agrees that it is the sole responsibility of the respective Relying Party, to whose service the user may opt to onboard or subscribe, to provide support and maintain the operation of the respective service, as well as that it is the Relying Party's sole responsibility to build, maintain and operate secure authentication and action authorization workflows. The App is an optional ingredient, not a product in the context of MFA and action authorization workflows relying on the Ecosystem.
2.5 This licence concerns the usage of the App. It does not govern the usage of any other component of the Ecosystem. Usage of other components of the Ecosystem is governed by separate licences or terms, which are published alongside those components.
2.6 Your rights concerning the authentication service you are using — including support, availability, and what happens to your account — are governed by the Relying Party's own terms with you, not by this licence. If the Relying Party has not given you terms, it is your responsibility to ask for and obtain the relevant terms for the service they provide. We are not a party to that relationship and cannot answer or be held responsible for it.
3. The App is optional
The App is one client among any number. You do not necessarily need it to use a Relying Party's authentication service, and it is not mandatory for you to use the App.
The App itself is proprietary and its source code is not published. The device libraries from which any Relying Party can build an equivalent client for iOS or Android are licensed under the Apache License 2.0. Where they are published is stated at https://ydentifi.io/docs/sdks.
The App implements the Ydentifi communication protocols, but a Relying Party may opt for building its own application, based on the freely distributed Ydentifi libraries or custom-built libraries, without ever using the App — and may require you to use that client instead of this one. The Ydentifi authentication and action authorization protocol does not restrict which client software you use. Where a particular deployment restricts it, that restriction operates under the control of the Relying Party running that deployment, which can change or remove it. We cannot.
4. The App does nothing until a Relying Party activates it
Before you use a setup code from a Relying Party, the App performs no authentication of any kind: no accounts, no codes, no manual entry, and nothing for it to authenticate against. All it provides is a minimal interface describing its purpose, which does not constitute a service. We do not supply you with any service by making the App available for download — we provide you with an implementation of the Ydentifi authentication and action authorization protocols.
5. Licence
We grant you a personal, non-exclusive, non-transferable and free licence to install and run the App on devices you own or control, from the moment you install it until this licence ends under clause 15.
You may not sell, rent, sublicense or distribute the App, remove or alter its notices, or work around its security or licensing controls — except so far as clause 9 allows.
You must not use the App for any unlawful purpose, or in any manner that breaches the law applicable to you. You must not use it in connection with activities that cause unnecessary suffering to animals, or serious harm to the environment. Nothing in this paragraph limits the protection afforded by clause 9 to security research.
Your rights under Articles 5 and 6 of Directive 2009/24/EC — to make a back-up copy, to observe and study the App's functioning, and to decompile it so far as necessary for interoperability — are unaffected by anything in this licence.
6. We receive no personal data from you
We do not collect, receive or store personal data about you through the App. Your private cryptographic keys are generated on your device and never leave it. Biometric checks are performed by your device and their results are never transmitted to us.
Where the App communicates, it communicates with the Relying Party's own server, which the Relying Party operates. The Relying Party is the controller of any personal data processed in connection with your authentication. Its privacy notice governs that processing, not ours. Our own privacy notice is published alongside this licence.
7. If you lose your device
Your private keys are generated on your device and never leave it, so we retain nothing capable of restoring your access. If your device is lost, stolen, wiped or replaced, we cannot recover your enrolments, nor can we do so at the request of anyone acting on your behalf.
Restoring access is a matter between you and the Relying Party, which determines how you verify your identity and enrol a replacement device. Some Relying Parties provide backup methods or recovery codes; others do not. That determination is theirs, not ours.
Set up any backup option the Relying Party offers, such as recovery codes or a second device, while you still have your device.
8. Open-source components
The App includes third-party components licensed under the Apache License 2.0 and other open-source licences. The full list, with the required notices, is available in the App under About → Legal → Acknowledgements. Those components are licensed to you under their own terms, which prevail over this licence in respect of them.
9. Security research
We would prefer to learn of a weakness from you than from its publication.
If you find a vulnerability and follow our published disclosure policy, we will not bring or support legal action against you for the research that found it. That means reporting it to us privately first, giving us a reasonable period to issue a fix before publishing, not accessing or altering data belonging to anyone else, and not degrading the service for other people.
In return we will acknowledge your report promptly, keep you informed while we work on it, agree a disclosure timeline with you, and credit you when we publish unless you would rather we did not.
This promise binds only us. We cannot authorise access to a Relying Party's systems. Testing against a live deployment needs the permission of the organisation that runs it, and we are not able to give it on their behalf.
This protects research. It does not protect exploitation. Nothing here limits our rights, or anyone else's, in respect of: exploiting a weakness against a real deployment or a real person; selling, trading or transferring an exploit; publishing a weaponised exploit rather than a finding; disclosing in a manner calculated to cause harm rather than to inform; or extortion. The line is between finding out and taking advantage, and it is not a fine one.
The policy, including how to reach us securely, is published at https://ydentifi.io/legal/security. The version published when you make your report is the one that applies to it.
10. Export control and sanctions
You confirm that you are not located in, and are not ordinarily resident in, a country or territory subject to comprehensive sanctions by the UN, EU, UK, US, or any other relevant governing body, and that you are not on any list of prohibited or restricted parties. The App contains cryptography and is subject to export control law. You must not use or export it in breach of that law.
11. Warranty
The App is provided as is and as available, without warranty of any kind, to the fullest extent permitted by applicable law. That describes the App as it stands at any moment: we do not promise it is free of defects or fit for any particular purpose, and we do not guarantee that it will be free of errors, interruptions or security weaknesses.
Nothing in this clause affects rights you may have under mandatory law that cannot be excluded, including any statutory rights you have as a consumer.
12. Our commitment to maintain the App
Ydentifi undertakes to maintain the App — correcting defects in it and fixing security weaknesses — for at least five years from the date a version is released, and for as long after that as we continue to support it.
We maintain the App by releasing new versions of it. Corrections and security fixes are made only in the latest version, which is free. We do not correct or update older versions.
You must keep the App up to date. Keep automatic updates turned on for the App, or install each new version as soon as it is available. An older version may contain defects that a newer version corrects, and it may stop working.
We tell Relying Parties about security problems in the App, and they tell you. We hold no contact details for you, as clause 6 explains, so we cannot tell you directly. The fix reaches you as a new version of the App.
This commitment is about the App on your device. The authentication service itself, its availability, and what happens to your account remain the Relying Party's, as clause 2 explains.
13. Events outside our control
Our commitment to maintain the App under clause 12 is suspended for as long as we are prevented from meeting it by an event outside our reasonable control — for example a natural disaster, armed conflict, an act of a public authority, the withdrawal of a distribution channel we depend on, or a failure of infrastructure we do not operate.
Should that occur, we will give notice on our website, describing the event and its anticipated consequences, as soon as we reasonably can. We hold no contact details for you, as clause 6 explains, so that is the only means available to us.
If the event continues for more than three months, either party may terminate this licence on notice, and clause 15 applies.
This clause suspends our obligation; it does not reduce it, and it does not affect any liability that clause 14 states is neither excluded nor limited.
14. Liability
To the fullest extent permitted by applicable law, we are not liable for indirect or consequential loss, loss of profit, loss of business, or loss of data arising from your use of, or inability to use, the App.
To the same extent, we are not liable for loss that results from:
- anyone other than you using your device or the App on it, including anyone to whom you gave the
device's passcode or whose face, fingerprint or other means of unlocking you added to the device;
- a request that you approved but did not start yourself, unless the App showed you that request
incorrectly;
- using the App on a device that has been modified, or using a modified copy of the App, contrary
to clause 19;
- the App stopping on a device that has been modified, as clause 19 describes; or
- using a version of the App other than the latest, where the latest version would have prevented
the loss.
Nothing in this licence excludes or limits our liability for:
- death or personal injury caused by our negligence;
- intent (_умисъл_) or gross negligence (_груба небрежност_), exclusion or limitation of which is
void under Article 94 of the Bulgarian Obligations and Contracts Act;
- liability under Directive (EU) 2024/2853 on liability for defective products, which cannot be
limited or excluded as against an injured person;
- fraud or fraudulent misrepresentation;
- any other liability that cannot lawfully be excluded.
Subject always to the liabilities listed above, which are neither excluded nor limited, and so far as the law allows, our total liability to you, for all claims arising out of or in connection with this licence and the App, is limited to EUR 50.
The App is supplied to you free of charge. The limit is proportionate to that, and is not an attempt to exclude our liability altogether.
Who these protections cover
The exclusions and limits in this clause apply not only to Ydentifi but equally to its licensors, suppliers, contractors, officers and employees, each of whom may rely on and enforce them directly. Under Article 22 of the Bulgarian Obligations and Contracts Act this licence confers those rights on them as third parties.
You agree to bring any claim arising out of the App against Ydentifi Ltd. alone, and not personally against any of those individuals or legal entities. Ydentifi Ltd. accepts this promise both for itself and on behalf of each of them.
If you bring such a claim anyway, you will reimburse Ydentifi Ltd. for the cost of defending it, so far as the law allows. This does not apply to a claim against Ydentifi Ltd. itself, or to any claim for liability that cannot lawfully be excluded.
The EUR 50 limit is a single limit shared by Ydentifi and everyone it protects together, not a separate limit for each of them.
This does not affect any liability that cannot lawfully be excluded — including liability for death or personal injury, for intent or gross negligence, and under Directive (EU) 2024/2853 on liability for defective products — and it does not prevent you claiming against Ydentifi Ltd. itself.
Time limit for claims
Where — and only where — the law governing your claim allows a contractual time limit, any claim must be brought within twelve months of the date you became aware, or ought reasonably to have become aware, of the circumstances giving rise to it.
Article 113 of the Obligations and Contracts Act makes an agreement shortening or extending a statutory limitation period of no effect. Where Bulgarian law governs, the statutory periods apply in full and nothing here shortens them.
If any part of this clause is held unenforceable, the remainder continues to apply.
15. Term and termination
This licence takes effect when you install the App and ends when you uninstall it, or if you breach this licence materially. You may end it at any time by uninstalling the App.
We may also end it by giving notice on our website, taking effect no sooner than thirty days afterwards. We would do that if we stopped offering the App on these terms, for example if it became a paid product.
It does not end merely because you have no accounts enrolled — the App may sit unused on your device for as long as you wish. Uninstalling the App does not end any agreement you have with a Relying Party.
16. Changes
You can read this licence at any time in the App under About → Legal, and the current version is published on our website.
Later versions of the App may carry a changed licence. When an update changes this licence, the App informs you the first time you open it after the update, and shows you the changed licence.
The change applies to you one month after the App first informs you. Until then, the licence you had before continues to apply.
If you do not accept the change, you can uninstall the App before the month ends. You need give no reason, and uninstalling it costs you nothing. Your accounts with Relying Parties are not affected, but you will need another way to authenticate to them; ask the Relying Party. If you keep the App after the month ends, the changed licence applies.
A change that the law, a court or a public authority requires applies from the date it requires, even if that is sooner than one month.
A change never applies to anything that happened before it took effect.
Smaller corrections, such as a typographical error or a clearer sentence that changes nothing of substance, take effect immediately. The App does not explicitly inform you about them, and they need no notice period.
17. Entire agreement
This licence is the whole of what is agreed between us about the App. It includes the App Store terms in clause 24, and it works alongside the open-source component terms referred to in clause 8. It replaces anything said or written beforehand. Our privacy notice and disclosure policy describe how we act; they are referred to here but are not part of this contract.
If you are not a consumer, you confirm you have not relied on any statement, description or assurance not set out in this licence, including anything on our website, in our documentation or in marketing material.
If you are a consumer, this does not affect your rights, and nothing here affects liability for anything said fraudulently.
18. Transfer
You may not transfer this licence to anyone else.
We may transfer it, together with our rights and obligations under it, to anyone who acquires the business or the assets to which this licence relates, or to a company that takes over the business through a merger, a change of legal form or a similar reorganisation. Your rights are not reduced by such a transfer, and we will make sure the transferee is bound by this licence on the same terms.
19. Your responsibilities
The App treats anyone who can unlock your device as you. Approving a request requires your device's Face ID or Touch ID. Opening the App also accepts your device's passcode where Face ID or Touch ID is unavailable. The App has no other way to tell who is holding the device. So:
- Only you may use the device on which you use the App. One person, one device. Do not let
anyone else use the App on your device, and do not use it on behalf of anyone else.
- Do not give anyone your device's passcode, and do not add anyone else's face, fingerprint or
any other means of unlocking to your device.
- Do not give anyone a setup code that a Relying Party gives you.
- Approve a request only if you started it yourself. If you receive a request you did not
start, decline it and inform the Relying Party.
- If your device is lost or stolen, or you think someone else has used the App on it, **inform the
Relying Party immediately**. Clause 7 describes why only the Relying Party can assist in such a case.
- Keep the App up to date, as clause 12 requires.
Modified devices
You must not use the App on a device whose operating system has been modified, for example by jailbreaking it, and you must not use a modified copy of the App. Either can let other software act as you in the App.
If the App detects signs that your device has been modified, it stops working on that device, for every account enrolled on it, and offers no way to override this. It works again only once those signs are gone, for example after you restore the device's original operating system. If restoring erases the device, you will need to enrol again with each Relying Party, as clause 7 explains.
Detection can be less than 100% accurate. If the App stops on a device that has not been modified, tell us at the address in clause 25. That is a defect in the App, and clause 12 applies to it.
Compensation
You agree to compensate us for any loss we suffer, or claim we face, because you used the App unlawfully, in breach of this licence, or in breach of export control or sanctions law.
This is limited to what actually results from your own acts, and it does not apply where the loss was caused by us.
20. General
Survival. Clauses 6, 9, 11, 12, 14, 17, 19, 21, 22, 23 and 24 continue to apply after this licence ends, along with anything else that by its nature is meant to. Clause 9 in particular survives: a researcher who reports a weakness after uninstalling the App keeps the protection it gives.
No waiver. If we do not enforce something, or delay in doing so, that is not a waiver of it and does not prevent us enforcing it later.
Severability. If any provision is held invalid or unenforceable, the rest continues to be in force. Where you are not a consumer, the invalid provision is treated as replaced by the closest valid one achieving the same purpose; where you are a consumer it is simply removed, and nothing here asks a court to rewrite it.
No partnership. Nothing here makes either of us the agent or partner of the other.
21. Governing law and disputes
This licence is governed by Bulgarian law.
If you are a consumer, this choice does not deprive you of the protection of the mandatory rules of the law of the country where you are habitually resident, and you may bring proceedings in the courts of that country. Otherwise the courts of Bulgaria have exclusive jurisdiction.
22. Language
This licence is made in English, which is the authoritative version. Any translation is provided for convenience only, and in the event of any inconsistency the English text prevails.
23. What the App is designed for
The App is general-purpose, off-the-shelf software.
It is not designed for high-risk use. We do not represent it as fit for use in the operation of life-support or other medical systems, nuclear facilities, aircraft navigation or communication, weapons systems, or any other environment in which a failure of the App could lead to death, personal injury, or severe physical, mental health or environmental damage.
Determining whether the App is suitable for a particular deployment, and implementing appropriate security measures around it, is the responsibility of the Relying Party operating that deployment.
Nothing in this clause affects the liabilities that clause 14 states are neither excluded nor limited.
24. Terms required for distribution through the App Store
- This licence is between you and Ydentifi only; Apple is not a party to it. Ydentifi, not
Apple, is solely responsible for the App and its content.
- Your use of the App must comply with the App Store Usage Rules in the Apple Media Services Terms
and Conditions.
- Apple has no obligation to furnish any maintenance or support for the App. **Ydentifi, not Apple,
is solely responsible for any maintenance and support of the App itself**; the authentication service remains the Relying Party's.
- You must comply with applicable third-party terms of agreement when using the App.
- If the App fails to conform to any applicable warranty, you may notify Apple, and Apple will
refund the purchase price (if any). To the maximum extent permitted by law, Apple has no other warranty obligation whatsoever with respect to the App.
- Ydentifi, not Apple, is responsible for addressing any claims relating to the App, including
product liability, failure to conform to legal requirements, and claims under consumer protection or similar legislation.
- Ydentifi, not Apple, is responsible for the investigation, defence, settlement and discharge of
any third-party intellectual property infringement claim relating to the App.
- Apple and its subsidiaries are third-party beneficiaries of this licence and may enforce it
against you.
25. Contact
Ydentifi Ltd., Todor Aleksandrov No. 46, floor 2, 2700 Blagoevgrad, Bulgaria. Company number 208962261.