Privacy policy
Publisher: dara · October 4, 2026
Listing accounts for the active site
When you open the toolbar popup, the HTTPS origin of the active tab, when available through the existing activeTab permission, is used only in memory to prioritize linked accounts. Paths, queries, fragments and browsing history are not stored, and saved account order is unchanged. The preference to wait for a fresh code is stored on your device.
Scope and publisher
This policy describes data handling by the 2FA CODE Chrome extension published by dara. Contact: daragrup7@gmail.com. Last updated: October 4, 2026.
Information processed on your device
The extension processes account names, optional usernames or email addresses, service names, TOTP setup keys, algorithm and code length/period settings, favorites, order, and optional linked HTTPS website addresses. These details are used to generate verification codes on your device. Appearance, language and account-name visibility preferences are also stored locally. Hiding names shortens their display; it does not change saved account details.
QR images, screenshots and clipboard
A QR image you select or paste into the account window is processed in memory to read its content. When you choose Capture from tab, the visible portion of the active tab is captured; it may contain other page content. The extension does not persist these images or unfinished import drafts. Clicking an account copies its current code to the system clipboard. Clipboard history and operating-system synchronization are outside the extension's control. The extension does not request clipboard-read access; paste events are initiated by you.
Storage and passwordless opening
Accounts are encrypted with AES-GCM in Chrome's local extension storage. There is no opening password; the decryption key is persistently stored in the same Chrome profile. Someone with access to your profile or computer may therefore access your codes. This is not a password-protected vault against profile access. Physical erasure of JavaScript memory or protection against a compromised device is not guaranteed.
Website matching and code filling
Saving a website address in an account profile requests optional Chrome access to that HTTPS address. Saving a registrable root domain or its www spelling requests access covering its subdomains within the same registrant boundary; saving a specific non-root subdomain covers only that exact address. URL paths, queries and fragments are not retained. The extension identifies visible verification fields on permitted, matching sites. It checks input types, labels and visible accessibility descriptions. For generic labels such as Pin or Code, a bounded set of visible headings and instructions in the same small form or card is also checked locally; these texts are not stored or transmitted. Clicking Fill code writes the current code into the field; an unambiguous login-identity match suggests the corresponding account, while unclear matches require you to choose. The setup key is never sent to the web page. Once filled, the code is readable by the page's own scripts and may be used by that site's sign-in process. The extension does not submit forms; some sites proceed automatically after the code is complete. Page content and browsing history are not sent to the developer, and no persistent browsing history is recorded.
Suggesting an account from a login identifier
On permitted, linked HTTPS sites only, suitably marked visible username/email fields are read on your device and compared exactly with linked account identifiers. Password values and unrelated form fields are not read. The raw login identifier is processed temporarily in memory; it is not written to persistent storage or sent to the developer or a server. Only the matched internal account ID or an unmatched state, the exact website origin, tab ID and expiry time are kept in extension session memory restricted to trusted extension contexts. The suggestion is valid for five minutes; expired records are removed on the next operation. Closing the tab, navigating to a different origin, changing accounts/permissions, or restarting the browser clears the context. Filling still requires your explicit click. Account labels longer than five characters retain their first and last two characters with the middle masked; stored account details are unchanged.
Account key and QR export
At your explicit request from an account's menu, a setup key can be revealed or copied, or a locally generated QR code can be downloaded as a PNG. The exported image and copied key are not encrypted. You manage these files and clipboard contents. The QR generator is bundled; no external QR service receives the data.
Encrypted backups
An encrypted JSON backup is created only when you choose Download backup. Your chosen password derives a separate encryption key; neither the password nor the device key is included in the backup. You manage your backup files. Import processes the selected file and password locally, merging accounts with existing entries.
Transfers, analytics and third parties
The extension does not send account details, keys, images or backups to the developer or a cloud service. A code you ask to fill becomes available to the destination page, whose own data processing is governed by its policy. The extension has no advertising, tracking, analytics, developer server or cloud synchronization. User data is not sold, used for advertising or used for credit decisions. QR libraries are bundled, and no remote code is downloaded. Chrome Web Store, browser and operating-system processing is governed by the respective providers' policies.
Retention and deletion
Saved accounts remain in your profile until you delete them or remove the extension's local data. Delete account removes the local record without disabling 2FA at the service. Uninstalling the extension deletes its local data. Downloaded backups, exported QR images and source QR images are separate files that you must manage or delete yourself. The developer has no copy of your accounts and cannot recover them.
Limited use and contact
Data is used for local TOTP account management, code generation/copying, user-requested filling on permitted sites, explicit account key/QR export, and encrypted backups. Use is limited to these features in accordance with the Chrome Web Store User Data Policy and Limited Use requirements. Contact daragrup7@gmail.com with questions. Do not include real setup keys, verification codes, QR codes or backup passwords in support messages.
Website suggestions and permissions
Suggestions for Google, OVHcloud and Amazon use a limited list bundled with the extension. Suggestions are not saved automatically; you choose Use and Save. For unknown services you can select the active HTTPS page. Existing addresses are not overwritten, and no external catalog or domain lookup is used. Root domains and their eligible subdomains are matched using an offline Public Suffix List; different ports and other customers across private hosting boundaries are excluded. A specifically saved non-root subdomain does not expand to its parent or siblings. Chrome permission is checked for each actual address; previous exact-host grants require a new user approval to cover subdomains. If permission is denied, your explicitly requested profile save is preserved, while filling remains unavailable on an unpermitted address.
Login cards and temporary name display
Visible username/email fields in login cards without a form element may also be recognized using the structural presence of a password field in the same small card. Password values are not read. Visible identifiers are checked again when you press the sign-in button or Enter. Clicking the eye button in the account picker temporarily reveals account names; closing the picker or changing the target masks them again. This display state is not stored as a persistent preference.
Exporting selected accounts
The Export accounts command in Settings lets you export selected accounts or all accounts. The QR option collects locally generated QR images in one offline HTML file; the setup-key option writes service, account, key and authentication settings to a TXT file. Both files are unencrypted and you are responsible for storing them securely. Files are created only on your device and are not sent to the developer or an external QR service. Exporting does not remove accounts from the extension.