Privacy Policy

What the Extension Does

The Extension is a two-factor authentication code generator. It stores the time-based (TOTP) and counter-based (HOTP) secrets you add, in an encrypted vault on your own device, and generates the one-time codes you use to sign in to websites that require two-factor authentication. It runs entirely within your local browser.

Information Collection and Use

The Extension does not collect, store, transmit, or share any personal information, browsing history, or user data with the Service Provider or any third party. There are no servers, accounts, analytics, telemetry, crash reporting, or trackers involved in the Extension’s operation.

The Extension requests no access to any website and its Content Security Policy sets connect-src 'none', which means the browser itself blocks the Extension from making any network connection. This is enforced by the browser, not merely by the Service Provider’s intent.

Permissions

The Extension requests the following Chrome permissions, used strictly for the purposes described below:

• storage — used to keep your encrypted vault and your settings (such as theme, language, and auto-lock timeout) locally in your browser, and to hold the vault’s decryption key in memory while the vault is unlocked. This data never leaves your device.
• activeTab — used for one feature only: adding an account by reading a QR code that a website is displaying. When you click “Scan QR code on this page”, the Extension takes a single screenshot of the visible tab and decodes it on your device to read the setup link. The image is held in memory, decoded, and discarded. It is never stored or transmitted. This permission is granted only in response to your click and expires when the tab navigates away.
• alarms — used to lock the vault automatically after the period of inactivity you choose. The alarm reads only a timestamp and your timeout setting.
• clipboardWrite — used to copy a one-time code to your clipboard when you tap it, so you do not have to retype it before it expires.

The Extension requests no host permissions. It cannot read, modify, or transmit the content of the pages you visit.

Data Storage and Retention

All data is stored locally on your device using the browser’s built-in storage APIs. The Service Provider has no access to this data.

Your two-factor authentication secrets are encrypted with AES-256-GCM before being written to storage. The key that decrypts them is itself encrypted using a key derived from your PIN with the Argon2id function; on devices that support it, a secret held in the device’s secure hardware is also mixed into that key, so that a copy of the vault taken to another machine cannot be opened.

Your PIN is never stored, in any form — neither as text nor as a hash.

While the vault is unlocked, its decryption key is held in the browser’s session storage, which exists only in memory and is erased when the browser closes. It is never written to disk.

Uninstalling the Extension removes all locally stored data.

Data You Export

The Extension can export your accounts. It never does so on its own: every export requires you to re-enter your PIN, and you choose the destination.

• Encrypted backup file — encrypted with a passphrase you set, which must be different from your PIN. Without that passphrase the file cannot be read, by the Service Provider or by anyone else. The Service Provider never receives the file or the passphrase and cannot recover either.
• QR codes shown on screen — displayed one at a time so you can scan an account into a phone authenticator. They are never written to a file. A QR code that a phone can scan necessarily contains the secret in readable form, so anyone who photographs or screenshots it gains access to that account.
• Printed sheet — opens your printer dialog and creates no file on disk. The printed page contains your secrets in scannable form and should be stored securely.

Once exported, the security of that data is in your hands. The Service Provider holds no copy and has no means of accessing it.

Third Party Access

The Extension does not share any information with third parties because no information is collected in the first place.

The Extension contains no third-party trackers, advertising, or analytics SDKs, and does not use remote code. All code, including the WebAssembly module used for password hashing, is contained within the Extension package and is not fetched at runtime.

Children

The Extension does not knowingly collect any data from anyone, including children under the age of 13.

Security

Since the Extension does not collect or transmit personal data, there is no user data at risk on the Service Provider’s end.

Locally, your secrets are protected by AES-256-GCM encryption with a key derived from your PIN using Argon2id, by an automatic lock after a period of inactivity, and by an increasing delay after repeated incorrect PIN entries. Standard browser security protections apply to all locally stored data.

No security measure is absolute. A PIN of six digits has a limited number of possible values, and on a device without compatible secure hardware a copied vault file could in principle be attacked offline. The Extension states this plainly in its settings when hardware protection is unavailable, and allows a longer PIN to be used.

Changes

This Privacy Policy may be updated from time to time. Any changes will be posted on this page. Continued use of the Extension after changes are posted constitutes acceptance of those changes.

This privacy policy is effective as of 2026-08-03.

Contact Us

If you have any questions regarding this privacy policy, please contact the Service Provider via email at chanph94@gmail.com.