Privacy Policy
Everything happens inside your browser. There is no server, no account, no analytics. Nothing is sent anywhere except directly to Google's own API in order to read your mail on your behalf.
What the extension accesses
Gmail messages, read-only. The extension requests a single
Google permission, https://www.googleapis.com/auth/gmail.readonly.
It searches your ten most recent messages from the last day that look like
verification emails, and reads them only to locate a code.
It cannot send, delete, modify or label mail. That is enforced by Google, not merely by this extension's own code. The permission granted does not allow it.
Page content on sites you visit. To recognise a one-time-code field, the extension inspects form fields on the page: their names, labels, input types, maximum lengths and the surrounding wording. This happens locally, and the results are never recorded or transmitted. It runs on all sites because a verification field can appear on any site.
What is stored, and where
Everything is stored by your browser, on your device.
| Data | Where | Removed when |
|---|---|---|
| Access token (short-lived) | Browser session storage | The browser closes |
| Refresh token | Browser local storage | You press Sign out |
| Your settings | Browser local storage | You uninstall the extension |
| A fingerprint of codes already tried on a site | Browser local storage | Ten minutes after the attempt |
The refresh token is kept in local storage deliberately, because it must survive a browser restart. Otherwise you would face a Google consent screen roughly every hour. Signing out deletes both tokens and asks Google to revoke the grant, so the extension also disappears from the permissions list on your Google account.
What is not stored
Email content is never written to disk. Message bodies exist only in memory, for as long as it takes to run the code-matching patterns over them and are discarded immediately afterwards. There is no history, no cache and no log of what was read.
One small exception, stated plainly: when a code is entered into a page, a short fingerprint of it is written to local storage against that site's hostname and removed ten minutes later. This stops a code the site rejects from being entered again, which matters because many sites submit by reloading the page. The code itself is not stored, though the fingerprint is a checksum rather than a security measure. It is never transmitted.
What is transmitted
Requests go to exactly three Google endpoints, and nowhere else:
accounts.google.com, to show Google's sign-in and consent screenoauth2.googleapis.com, to exchange, refresh and revoke tokensgmail.googleapis.com, to search and read your messages
There is no server operated by the developer of this extension. No analytics, no telemetry, no crash reporting, no advertising and no third-party service of any kind receives your data.
Limited Use disclosure
Auto Auth Filler's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data is used only to provide the extension's single user-facing feature, which is locating a verification code and entering it. It is not transferred to anyone, not used for advertising, not used to train any model and not read by any human.
Your control
- Automatic filling can be switched off in Settings, in which case the code is shown and the extension waits for you. On password fields it always waits.
- Individual sites can be silenced through the blocked-domains list in Settings.
- Signing out revokes access immediately.
- You can revoke access at any time, independently of this extension, at myaccount.google.com/permissions.
- Uninstalling the extension removes all stored settings and tokens.
Children
This extension is not directed at children and collects no personal information from anyone.
Changes and contact
Any change to this policy is published here with the date above updated, and the revision history is public in the project's Git repository. Questions can be raised as an issue there.