Privacy at CloudOTP

Last updated September 1, 2026

CloudOTP is a non-commercial hobby project published under the display name Young Lion Labs. Young Lion Labs is the project publisher's chosen name, not a claim that this service is operated by an incorporated company. This policy covers the CloudOTP extension, Android companion app, and hosted service at getcloudotp.com. For privacy questions or deletion requests, contact support@getcloudotp.com. Operators of independently self-hosted deployments are responsible for their own privacy policies.

Data used to provide the service

Google sign-in provides a Firebase user identifier, email address, and basic profile details. These identify your private sync space and show which account is signed in.

Account labels, issuer names, TOTP settings, and encrypted TOTP secrets are stored in Firestore under your user identifier. The TOTP secret itself is encrypted with AES-256-GCM before upload. For a small set of recognized service issuers, CloudOTP can download reviewed artwork from its public, read-only Firebase Hosting catalog. The extension and Android app verify the asset's SHA-256 digest and cache it locally. Clients do not request third-party favicons, submit arbitrary labels for icon lookup, or write icon records to your Firestore data. The hosting provider receives the requested public asset path and ordinary network information.

If you enable optional SMS-code sync with a compatible CloudOTP Android companion, the detected verification code and sender label are encrypted on the device before upload and can be decrypted only by your unlocked CloudOTP vault. Your six-digit vault PIN is not stored. If you opt into device unlock, a copy of the vault key and a WebAuthn credential identifier are stored locally in extension storage; they are not uploaded to CloudOTP.

Google/Firebase provides sign-in, database storage, and website hosting. These providers receive the requests needed to operate the service, including network information such as your IP address. Account metadata, timestamps, a one-way secret fingerprint used to detect duplicates, and SMS record timing, expiry, and device identifiers are not encrypted before sync. Authentication tokens are kept in session-only extension storage. To allow you to reopen the popup briefly without re-entering your PIN, the unlocked vault key is also cached in session storage with a ten-second reuse window. Expired cache entries are removed when next checked; signing out clears the cache.

Imports and code generation

Authenticator export files, pasted otpauth URIs, QR images, camera frames, decrypted secrets, and generated one-time codes are processed locally in the extension. CloudOTP does not upload the original import file or generated code.

When you click a code to autofill it, the extension examines input-field attributes in the active page to identify a verification field. This website content is processed locally, not sent to CloudOTP or Firebase. The selected code is shared with that page when filled, or written to your clipboard if no suitable field is found. CloudOTP does not continuously monitor your browsing history.

SMS sync handles only detected verification codes and sender labels, not full message bodies or your general SMS history. The extension periodically checks your private Firestore collection for new encrypted records while you are signed in, displays unexpired records, and updates its badge count. Opening the SMS tab or clicking refresh also performs this check.

On Android, SMS synchronization is off by default. If you explicitly enable it and grant Receive SMS permission, the app examines newly received messages locally for likely verification codes. It does not read existing SMS history, send messages, access contacts, or collect call logs. Disabling the feature or signing out removes the protected SMS synchronization key from that device.

Limited Use of extension data

CloudOTP's use and transfer of information received through Chrome APIs follows the Chrome Web Store User Data Policy, including its Limited Use requirements. Extension user data is used only to provide or improve its authenticator features. It is not sold, used for personalized advertising, used to determine creditworthiness, or used for lending.

Transfers are limited to those needed to provide the service, comply with law, or protect security, as allowed by that policy. Human access to user data is limited to its permitted exceptions, such as your explicit consent for specific support, security investigations, or legal obligations. Website analytics is separate and requires your consent as described below.

Analytics, advertising, and sale of data

The website uses Google Analytics only after you choose “Allow analytics.” It measures page visits, installation-button interest, navigation, section views, FAQ opens, and support-link clicks. The site works without analytics. You can decline or withdraw consent at any time using “Analytics preferences” in the footer. Browser Do Not Track and Global Privacy Control signals keep analytics off.

With consent, Google Analytics receives a randomly assigned cookie identifier and standard browser/device information; network requests also expose your IP address to Google. Our event data uses fixed page names and action categories, not email addresses, account labels, OTP codes, PINs, secrets, import contents, URL query strings, or referrer URLs. We disable Google signals and advertising personalization. Google may automatically record session and engagement events while analytics is enabled. See Google’s Privacy Policy.

Your analytics choice is stored in this browser for up to 180 days. Analytics cookies expire after 90 days without automatic renewal. Withdrawing consent stops future collection and clears these cookies; it does not delete events Google has already received. This extension release does not send analytics events. Website consent does not opt you into any future extension analytics. CloudOTP does not contain advertising or sell personal information.

Account and data deletion

You can request deletion of your CloudOTP account and all associated cloud data by emailing support@getcloudotp.com from the Google email address used with CloudOTP. State that you want the CloudOTP account and its data deleted. Do not include authenticator secrets, one-time codes, your vault PIN, or recovery codes. We may ask you to confirm control of the signed-in email address before deletion. Once verified, the Firebase account, encrypted vault records, SMS synchronization records, and associated account metadata are deleted. Data retained for a legal or security obligation, if any, will be limited to that purpose and retention period.

Retention

Synced authenticator records remain until you remove the relevant account or request deletion from the deployment operator. Local generated-artwork caches remain in application storage until app data or extension storage is cleared. SMS-code records include a 24-hour expiry time and stop appearing in the extension after expiry. Signed-in CloudOTP devices periodically delete expired records; database removal may occur later if none of the user's devices reconnect. Signing out removes the extension session but does not delete the cloud vault.

Security and recovery

No system is risk-free. The six-digit PIN is intended as a convenient local UI lock and is not strong protection against offline guessing. CloudOTP cannot currently recover a forgotten PIN. Keep service recovery codes in a separate safe location and prefer phishing-resistant security keys where supported.

Permissions

The extension requests identity for Google sign-in, storage for the vault, verified generated-artwork cache, and short-lived session, clipboard write to copy codes, and camera access only when you choose QR scanning. Host access to CloudOTP's Firebase Hosting domain retrieves the read-only artwork catalog and approved assets. The alarms permission schedules periodic checks for new encrypted SMS verification-code records while you are signed in and updates the extension badge; it is not used to inspect browsing activity. The active-tab and scripting permissions are used only after you click a code: CloudOTP temporarily checks the current tab for a verification-code field and fills it, falling back to the clipboard when no suitable field is found. It does not request persistent access to every website.

The Android app requests Receive SMS only after showing a prominent disclosure and receiving your explicit consent. QR scanning starts only when you tap the scan action. You can revoke SMS access in Android settings or disable synchronization inside CloudOTP at any time.

Contact

For support, privacy questions, or data deletion requests for CloudOTP, email support@getcloudotp.com. Never include authenticator secrets, one-time codes, vault PINs, or recovery codes in your message. If you use a self-hosted deployment, contact its operator instead.