Privacy Policy

Last updated: November 5, 2026

totp is a self-hosted authenticator browser extension. This policy explains what data it accesses, stores, and transmits. The short version: nothing leaves your device.

Data we collect

We do not collect any personal data. There is no account, no analytics, no telemetry, and no crash reporting.

Data we store (locally only)

The extension stores the following in your browser's local extension storage (chrome.storage.local / chrome.storage.session):

• Your authenticator accounts (issuer, name, secret keys), encrypted with a key derived from your master password (AES-256-GCM, PBKDF2).
• A random salt and an encrypted verifier used to check your master password.
• The derived encryption key in session storage (memory-only, cleared when the browser closes).

This data never leaves your browser or device. Clearing the extension's data removes it permanently.

Data transmitted

The extension makes no network requests of any kind. It does not contact any servers, APIs, or third parties. QR code scanning is performed entirely offline on screenshots of the tab you are viewing, using a bundled library.

Permissions

• Storage — to save your encrypted vault and session state locally.
• Active tab / Scripting — to capture a screenshot of the current tab (for QR scanning) and, if you choose, draw a region-selection overlay on the page.
• Notifications — to alert you when a region scan finds a QR code after the popup has closed.

Screenshots are processed in memory only and are not saved or uploaded.

Third parties

We do not share, sell, or transfer any data to third parties, because we never receive any data in the first place.

Children's privacy

The extension does not target children and collects no data from anyone, including children.

Changes to this policy

If the extension's data practices change, this policy will be updated and the revision date above will be changed. Any future version that transmits data off-device will be disclosed clearly here and in the extension listing before it ships.

Contact

Questions about this policy: open an issue on github.com/dshaw0004/totp or contact the project maintainer.