Privacy Policy — Email OTP Autofill

Last updated: 24 August 2026 · 中文版本 ↓

1. What this extension does

Email OTP Autofill retrieves the one-time verification code (OTP) that has just arrived in your own email inbox and fills it into the verification-code field of the page you are signing in to. It does nothing else. There are no ads, no analytics, and no tracking of any kind.

The system has two parts:

• The extension, running in your browser.
• The agent, a server that connects to your mailbox and extracts codes. You choose which agent to use: the instance we host at otp.razet.me, or one you run yourself from the open-source repository.

2. Data stored on your device

The extension keeps the following in chrome.storage.local. It stays on your computer and is not synced to any Google account:

3. Data sent from the extension to the agent

4. Data stored by the hosted agent

The agent we host keeps a single SQLite database. It contains:

Encrypted items use AES-256-GCM. Each secret gets its own random salt and initialisation vector, and its key is derived with scrypt from a master key supplied through the environment. That master key is never written to disk, so a copy of the database on its own cannot be decrypted.

5. Data held only in memory

When a verification code arrives, the agent keeps the following in memory only. None of it is written to disk, and all of it is lost when the service restarts:

• the verification code itself;
• which provider and which mailbox received it;
• the time it arrived and its stated validity window;
• the sender address, subject line, message id and folder — used to match the code to the site you are signing in to.

At most 100 recent items are held at a time; older ones are dropped. Codes stop being served once past their validity window, which is typically one to two minutes.

6. What we never collect

• No analytics, telemetry, advertising or tracking identifiers — none, of any kind.
• No browsing history and no list of pages you visit.
• No page content, form values, keystrokes, clicks, or mouse movement.
• No location data.
• No email bodies are stored or logged. The agent extracts the code and discards the rest.
• The agent performs no HTTP request logging. Note that the network infrastructure in front of it (reverse proxy, CDN) may record connection metadata such as IP addresses, as any web server does.

7. Third parties

To read your mail, the agent talks to the mail provider you chose, and to no one else:

We do not sell, rent, or transfer your data to anyone. We do not use it for advertising, for building profiles, or for training machine-learning models.

Be aware that the mailbox permissions above are provider-level read permissions: technically they allow reading your mailbox, because neither Google, Microsoft nor IMAP offers a "verification codes only" permission. The agent uses that access solely to find verification codes, and you can verify this in the source code and revoke the grant at any time from your Google or Microsoft account settings.

Google API Services — Limited Use disclosure

Email OTP Autofill's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained through the Gmail API is used only to provide the verification-code autofill feature you requested; it is never transferred to third parties except as required to provide that feature or as required by law; it is never used for advertising; and it is never read by humans except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

8. Retention and deletion

• Verification codes — memory only, gone within minutes and on every restart.
• Mail credentials and tokens — kept until you disconnect the mailbox or delete your account. Disconnecting deletes them immediately.
• Account record — kept until you ask for deletion.
• Session tokens — deleted at sign-out and on expiry.

To delete everything: disconnect each mailbox in Settings, then request account deletion through the contact channel in section 11. You can also revoke the agent's access at any moment from your Google account permissions or Microsoft account permissions, without involving us at all.

If you prefer to keep nothing with us whatsoever, self-host the agent. That path is supported as a first-class option, not an afterthought.

9. Security

• All traffic between the extension and the hosted agent uses HTTPS.
• Passwords are stored as salted scrypt hashes and verified in constant time.
• Mail credentials and OAuth tokens are encrypted at rest with AES-256-GCM under a key that is never written to disk.
• Each user's data is scoped to their own user id; one account cannot read another's codes or configuration.

No system is perfectly secure. If you find a vulnerability, please report it through the contact channel below rather than disclosing it publicly.

10. Paid features (planned)

Paid features are being considered but are not implemented today. No payment information of any kind is currently collected, transmitted, or stored.

When they ship, the intended design is:

• Payment will be handled entirely by an established third-party payment processor, on their own pages.
• The extension and the agent will never receive, see, or store card numbers or bank details.
• We would store only what is needed to know what you are entitled to: a plan tier, a subscription status and expiry, and an opaque customer identifier issued by the processor.
• The processor's own privacy policy would govern the payment data it holds.

This policy and the Chrome Web Store data disclosures will be updated before any paid feature is released, not after.

11. Changes and contact

Material changes to this policy will be reflected in the "last updated" date above and in the repository's commit history, which is public and auditable.

Questions, data-deletion requests, and security reports all go through the project's public issue tracker: github.com/priority3/email-otp-autofill/issues. We aim to respond to data-deletion requests within 30 days.

隐私权政策 — Email OTP Autofill

最后更新：2026 年 8 月 24 日 · ↑ English version

1. 这个扩展做什么

Email OTP Autofill 把刚刚发到你自己邮箱的一次性验证码（OTP）取出来，填进你正在登录的那个页面的验证码输入框。 它不做别的事。没有广告，没有统计分析，没有任何形式的追踪。

系统由两部分组成：

• 扩展，运行在你的浏览器里。
• agent，一个连接你邮箱、提取验证码的服务端。用哪个 agent 由你决定：我们托管的 otp.razet.me，或者你自己用开源仓库跑的实例。

2. 存在你设备上的数据

扩展在 chrome.storage.local 中保存以下内容。它们留在你的电脑上，不会同步到任何 Google 账号：

3. 扩展发送给 agent 的数据

4. 托管版 agent 存储的数据

我们托管的 agent 只维护一个 SQLite 数据库，内容如下：

加密项使用 AES-256-GCM。每条密文有独立的随机盐和初始化向量，密钥由环境变量提供的主密钥经 scrypt 派生。 主密钥从不落盘，因此单独拿到数据库文件也无法解密。

5. 仅存在于内存中的数据

验证码到达时，agent 只在内存中保存以下内容。它们不写入磁盘，服务重启即全部丢失：

• 验证码本身；
• 来自哪个服务商、哪个邮箱；
• 到达时间及其声明的有效期；
• 发件人地址、邮件主题、message id 和所在目录——用于把验证码匹配到你正在登录的站点。

同时最多保留 100 条，超出即丢弃。超过有效期（通常 1 到 2 分钟）后不再对外提供。

6. 我们从不收集的内容

• 没有统计分析、遥测、广告或追踪标识符——任何形式都没有。
• 不收集浏览历史，不记录你访问过哪些页面。
• 不收集页面内容、表单值、按键、点击或鼠标轨迹。
• 不收集位置数据。
• 不存储也不记录邮件正文。agent 提取出验证码后即丢弃其余内容。
• agent 本身不做任何 HTTP 请求日志。但需说明：位于它前面的网络设施（反向代理、CDN）可能像任何 Web 服务器一样记录 IP 等连接元数据。

7. 第三方

为了读取邮件，agent 只与你选择的邮件服务商通信，不与其他任何方通信：

我们不出售、不出租、不向任何人转让你的数据。不用于广告，不用于构建用户画像，不用于训练机器学习模型。

需要如实说明：上述邮箱权限是服务商层面的读取权限，技术上允许读取你的邮箱——因为 Google、Microsoft 和 IMAP 都没有提供「仅验证码」这种粒度的权限。agent 仅将该权限用于查找验证码，这一点你可以在源代码中核实， 也可以随时在 Google 或 Microsoft 账号设置中撤销授权。

Google API 服务 — 有限使用（Limited Use）声明

Email OTP Autofill 对从 Google API 获得的信息的使用和转移，遵守 Google API 服务用户数据政策， 包括其中的有限使用要求。具体而言：通过 Gmail API 获取的数据仅用于提供你所请求的验证码自动填充功能； 除为提供该功能所必需或法律要求外，绝不转移给第三方；绝不用于广告；除非获得你的明确同意、出于安全目的、 为遵守适用法律，或数据已经过聚合与匿名化处理，绝不由人工读取。

8. 保留与删除

• 验证码 —— 仅在内存中，数分钟内消失，每次重启即清空。
• 邮箱凭据与令牌 —— 保留至你断开该邮箱或删除账号为止。断开连接会立即删除。
• 账号记录 —— 保留至你要求删除为止。
• 会话令牌 —— 退出登录时删除，过期后失效。

完全删除的做法：在设置中逐个断开邮箱连接，然后通过第 11 节的联系方式申请删除账号。你也可以完全绕开我们， 随时在 Google 账号权限页 或 Microsoft 账号权限页 撤销 agent 的访问权。

如果你希望在我们这里不留下任何东西，请自建 agent。这是被当作一等选项支持的，不是附带功能。

9. 安全

• 扩展与托管 agent 之间的全部流量走 HTTPS。
• 密码以加盐 scrypt 哈希存储，恒定时间比对。
• 邮箱凭据与 OAuth 令牌以 AES-256-GCM 静态加密，密钥从不落盘。
• 每个用户的数据按其 user id 隔离，一个账号无法读取另一个账号的验证码或配置。

没有系统是绝对安全的。如果你发现漏洞，请通过下方联系方式报告，而不要公开披露。

10. 付费功能（计划中）

付费功能在考虑中，但目前尚未实现。当前不收集、不传输、不存储任何形式的支付信息。

上线时的预期设计是：

• 支付全程由成熟的第三方支付服务商在其自有页面上处理。
• 扩展和 agent 永远不会接收、看到或存储卡号与银行信息。
• 我们只存储确定你权益所必需的内容：套餐档位、订阅状态与到期时间，以及支付服务商签发的不透明客户标识。
• 支付服务商所持有的支付数据，适用其自身的隐私政策。

本政策与 Chrome 应用商店的数据披露，会在任何付费功能发布之前更新，而不是之后。

11. 变更与联系方式

本政策的实质性变更会体现在上方的「最后更新」日期，以及仓库的提交历史中——该历史是公开且可审计的。

咨询、数据删除请求与安全报告，请统一通过项目的公开 issue 追踪器提交： github.com/priority3/email-otp-autofill/issues。 数据删除请求我们会在 30 天内回复。