I just open-sourced the mobile client of Toqen.app.
One thing I wanted to make very clear — the app does not collect personal or sensitive user data (no email, phone number, location, etc.).
Only device-bound identifiers and cryptographic keys required for authorization.
You can verify this directly in the code:
https://github.com/toqenapp/mobile-react-native
This is also the part of the system where access actually gets confirmed:
user decision
device signature
real-time verification
I am sharing it because I realized something while building this:
The more you talk about security, the harder it is for people to trust you - unless they can actually see how things work.
So this is my attempt to make that layer transparent.
iOS (App Store): search for “toqen.app”
Android (closed testing): https://forms.gle/f9FcbHyHJiajmFWV7
I am still figuring a lot of things out, so I would really appreciate any feedback or critique.
Building continues.
One thing I am still trying to understand:
Does open-sourcing something like the auth layer actually increase trust, or do most people decide based on other signals anyway?
Would be interesting to hear how you approach this.