Privacy Policy

Last Updated: July 23, 2026

Secure Authenticator ("the Extension") respects your privacy. This Privacy Policy explains what information is handled by the extension and how it is protected.

Overview

Secure Authenticator is a browser extension for generating Time-based One-Time Passwords (TOTP) and HMAC-based One-Time Passwords (HOTP) for two-factor authentication (2FA). The extension is designed with a privacy-first approach and operates primarily on your device.

Information We Collect

We do not collect personal information such as:

• Name
• Email address
• Phone number
• Mailing address
• Payment information
• Location data
• Browsing history
• Analytics data
• Advertising identifiers

The extension stores only the authentication data that you voluntarily add, including OTP secrets and related account information. This information remains stored locally on your device.

How Your Data Is Stored

Authentication data is stored locally using the Chrome Extension Storage API. When enabled, your vault is encrypted using industry-standard AES-256-GCM encryption with keys derived using PBKDF2.

Your authentication data is never uploaded to our servers because we do not operate any servers for storing user vaults.

Clipboard Access

The extension accesses the clipboard only when you explicitly perform actions such as:

• Copying a generated OTP code.
• Importing OTP accounts from clipboard content.

If enabled, copied OTP codes may be automatically removed from the clipboard after a user-configurable timeout for additional security.

QR Code Import

When you choose to import an account from a QR code displayed on a webpage, the extension temporarily accesses the active tab solely to read and decode the QR code. No webpage content is collected, stored, or transmitted.

Notifications

Optional browser notifications are used only for user-requested reminders, such as OTP expiration alerts or automatic vault lock notifications.

Data Sharing

We do not:

• Sell your data.
• Share your data with advertisers.
• Share your data with analytics providers.
• Transfer your data to third parties.
• Use your data for marketing.

Remote Code

The extension does not download or execute remote code. All functionality is packaged within the version submitted to the Chrome Web Store.

Data Security

We implement reasonable security measures to help protect your locally stored authentication data, including:

• Local encrypted storage.
• AES-256-GCM encryption.
• PBKDF2 key derivation.
• Optional master password protection.
• Automatic vault locking.
• Optional clipboard auto-clear.

Your Control

You remain in complete control of your authentication data. You may:

• Add or delete accounts at any time.
• Export your vault.
• Delete your vault.
• Uninstall the extension to remove its locally stored data.

Children's Privacy

The extension is not directed toward children under the age of 13 and does not knowingly collect personal information from children.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any updates will be reflected by revising the "Last Updated" date on this page.

Contact

If you have questions regarding this Privacy Policy, you may contact the developer through the contact information provided on the Chrome Web Store listing.