Authenticator Pro ("the extension") is a two-factor authentication (2FA) code generator and autofill tool. This policy explains what data the extension handles, why, and what it does not do.
1. Summary
- All of your accounts, secret keys, and settings are stored locally on your device, inside your browser's extension storage.
- The extension does not operate any server, and does not transmit your data to the developer or to any third party.
- Optional features (such as backing up an encrypted file to your own Google Drive/OneDrive/Dropbox account) only ever talk directly to the cloud provider you explicitly authorize — never to us.
2. Data the extension stores
- Authentication information — the 2FA secret keys ("seeds") you add or scan, and, if you choose to set one, a master password used to encrypt them (AES + Argon2). This is stored in your browser's local
chrome.storage, optionally encrypted, and is never sent anywhere. - Preferences — theme, autolock timer, and similar settings, stored locally.
3. Data the extension reads but does not store
- Active tab URL — read only to match the site you're on against your saved accounts (Smart Filter) and to know where to autofill a code. It is not logged, recorded, or transmitted.
- Page content (input fields) — the autofill content script inspects input field attributes (name, id, placeholder, label, autocomplete) on the page you're viewing, only to locate the correct 2FA field to fill in when you trigger autofill. This happens entirely in your browser and is never sent anywhere.
- Screen capture — when you use the QR-scan feature, the extension captures the visible tab or your webcam to read a QR code image locally (via on-device image decoding). The image is discarded immediately after decoding and is never uploaded.
4. Optional cloud backup
If you choose to enable it, the extension can back up an encrypted copy of your accounts file directly to a cloud storage provider you authorize (Google Drive, Microsoft OneDrive, or Dropbox), using that provider's own OAuth sign-in. That file is encrypted before it leaves your device, and it is transferred directly between your browser and the provider you chose — it never passes through, or is visible to, the developer of this extension.
5. What we never do
- We do not sell or share your data with third parties.
- We do not use your data for advertising or analytics.
- We do not use your data to determine creditworthiness or for lending purposes.
- We do not track your browsing history.
6. Permissions
The extension requests browser permissions (such as storage, tabs, activeTab, scripting, alarms) strictly to implement the features described above — local storage, autofill, QR scanning, and auto-lock. A full breakdown of each permission and why it's needed is available on request or in the extension's Chrome Web Store listing.
7. Changes to this policy
If this policy changes, the "Last updated" date above will be revised. Continued use of the extension after changes constitutes acceptance of the updated policy.
8. Contact
Questions about this policy or the extension's data practices can be sent to: DAVIDRT20