OTPilot privacy policy
OTPilot is a Chrome extension. When a page asks for a code that was emailed, it finds that code in the Gmail account already signed in on this browser and types it into the field. This policy describes what the extension does with information. It does not send data to the developer or to any other server.
What it accesses
It reads Gmail through the account already signed in on this Chrome profile. It does not ask for your Google password and it does not use a separate Google sign-in. When a page asks for an emailed code, it checks for two minutes. Each check searches one account for messages in the inbox or in spam that arrived after the previous check. If the page names the address the code was sent to, that account is the one checked. If the page names no address, only the first signed-in account is checked. From those messages it reads the sender name, sender address, subject, preview, and date.
When the subject, the preview, or the sender looks like a sign-in code, and the preview does not already show the digits, it opens that one message. It reads the message text only to find the code, the From line, and the Date line. At most three messages are opened on a check. Messages older than 10 minutes are ignored, as are shipping notices and promo codes.
On other sites, it looks for a one-time-code field. It reads the site’s hostname, the page title, and a short stretch of text around that field, so it can tell an emailed code from a text-message code or a code from an authenticator app. It types the code into the field. If you turn on “Press submit too”, it clicks the verify button on that page. It does not read passwords or payment fields. It does not run this on Gmail itself.
Outlook, iCloud, text messages, and authenticator apps are not read. Mail that was forwarded into Gmail is read the same way as any other Gmail message.
Chrome’s install dialog says the extension can read and change data on all sites, and on mail.google.com. That is Chrome’s standard warning for a content script that has to find a code field on whatever site is asking for one, and for the Gmail access described above. The page address is used only inside the extension.
What it stores
Settings are saved with chrome.storage.local on your browser: whether automatic fill is on, whether only a matching site is filled, and whether submit is pressed for you. The same storage holds the latest 12 fills. Each entry is the time, the site’s hostname, the sender name, the sender address, the subject, whether the code was filled or offered first, and the code with all but the last two digits hidden.
A plain-text note of the last check is saved with chrome.storage.session. It includes subjects, senders, a short masked preview, and a masked code. During those two minutes, the messages found for the current look are kept in the same session storage, including the full code, so the code is not lost if the extension restarts before it can be typed. That record is removed when the two minutes end. Session storage is discarded when the browser session ends. “Deliver a test code” in the popup saves a made-up code in that same session storage. That code can be typed only on 127.0.0.1 or localhost.
Checking for an extension update uses Chrome’s own update service and stores only the version result on the device. The extension does not use chrome.storage.sync.
Nothing is sold, transferred, or sent to a server run by the developer. The extension has no account, no analytics, and no advertising. The only servers it contacts are mail.google.com, using the Gmail session already in this browser, and Chrome’s update service.
Why
The extension uses this information only to find an emailed sign-in code and type it into the page that asked for it. While “Only matching sites” is on, a code whose sender does not match the site is not typed until you agree.
Control
Uninstalling the extension removes the settings, the recent list, and the session note from the device. There is no account to delete and no copy held by the developer.
Chrome Web Store User Data Policy
Use of this data follows the Chrome Web Store User Data Policy, including the Limited Use requirements. The information is used only to fill an emailed sign-in code, which is the extension’s single purpose. It is not used for advertising, credit, or lending, and no person reads it.
Contact
Questions about this policy: use the contact form on leadomator.com.