1. Scope and responsible developer
This policy applies to the OTPManager browser extension and this official website. OTPManager is developed by Samler-Lee. Privacy questions can be sent to samler@foxmail.com.
2. Data processed locally
Depending on the features you use, the extension processes the following data inside your browser:
- TOTP secrets, issuer names, account labels, favorite state, domain bindings, site recognition rules, and deletion history.
- Your encrypted vault and encrypted sync credentials in the extension’s IndexedDB storage.
- A temporary unwrapped 256-bit vault data key in browser session storage while the vault is unlocked. The master password itself is not stored there.
- Security preferences, device identifiers, synchronization state, and backup settings.
- Website hostnames and local page signals around input fields, such as autocomplete attributes and nearby labels, to recognize one-time-code fields.
This processing is required to display codes, match them to the current website, fill a selected input, protect the encrypted vault, and apply your settings.
3. Website access and autofill
On pages where the extension has access, a content script examines input elements and nearby text locally to determine whether a field is likely to accept an authenticator code. The page hostname and a feature request may be sent to the extension’s background process. This is communication inside the installed extension, not a transfer to the developer.
The content script does not receive your TOTP secret or remote-storage credentials. When you invoke filling, it may receive a generated code that matches the current hostname and insert it into the selected field. OTPManager does not build or transmit a browsing-history profile.
4. QR code scanning
Scanning starts only after you use the scan command. The browser captures the visible area of the active tab under its temporary active-tab permission. The image is decoded in memory, accepted only when it contains a supported otpauth://totp value, and is not saved or uploaded by OTPManager.
5. Optional remote sync and backups
If you configure WebDAV or S3-compatible storage, the extension connects directly from your browser to the provider and endpoint you selected. OTPManager transmits the encrypted vault, encrypted history snapshots, and protocol requests needed for synchronization. The developer does not proxy or receive those requests.
Your selected provider may process network metadata such as your IP address, request time, object path, object size, and encrypted content according to its own policy. Provider credentials are kept inside your encrypted vault. You are responsible for the provider account and its retention, access, and deletion controls.
7. Retention and deletion
- Local encrypted data remains until you delete it, clear extension storage, or uninstall the extension. Export first if you need a copy.
- The temporary unlocked data key is cleared when you lock the vault, the configured auto-lock timeout expires, or the browser session ends.
- Remote vaults and backups remain under the retention settings and deletion tools of your chosen provider. Disabling sync does not automatically delete provider-side objects.
- This website stores no cookies and sends no product telemetry.
8. Your choices and rights
You can use OTPManager without remote sync, restrict or revoke site access in browser settings, disable automatic detection, lock the vault, export your data, delete entries, clear local data, and remove remote objects through your provider. Depending on your jurisdiction, you may also contact the developer to ask privacy questions or exercise applicable rights; because the developer does not hold an account database, there may be no server-side record to retrieve or erase.
9. Security, children, and changes
Security safeguards and their limits are described on the security page. OTPManager is a general-purpose utility and is not directed to children. Material policy changes will update the effective date and be published at this URL before or with the applicable extension update.