Last updated: October 2026
When using OTPilot without a cloud account, no vault data is transmitted to any server. Your vault (passwords, 2FA secrets, notes and other items) is stored in your browser's local storage (chrome.storage.local), each item encrypted with its own key, protected by your master password. We have no access to this data.
To offer "Unlock to fill" on sign-in pages while the vault is locked, the extension also keeps a small unencrypted index on your device with each login's name and saved web addresses (never usernames, passwords or secrets). It never leaves your browser, but anyone with access to your browser profile could see which sites you have logins for.
If you enable email-code auto-fill, OTPilot reads the visible content of your open webmail tabs (Gmail, Outlook, Yahoo Mail, Proton Mail, Fastmail, Zoho Mail) to find one-time login codes. This happens entirely on your device — the email content is never sent to us or any third party. A detected code is held in memory only (for up to 10 minutes) so it can be filled into the matching login field, then discarded. We do not read, store, or transmit your emails. You can turn this off in the extension's Settings.
To show each account's logo, OTPilot may send that account's domain (e.g. github.com) to our server, which fetches and caches the site's public favicon. Only the domain is sent — never your secrets, codes, or browsing activity — and the icon is then cached in your browser for offline use.
| Data | Purpose | Accessible to us? |
|---|---|---|
| Email address | Authentication | Yes |
| Encrypted vault items (one per password, note, 2FA code…) | Cloud sync | No — E2E encrypted |
| Per item: id, revision, last change, whether it counts toward the free limit | Sync, plan limits | Yes (no content) |
| Registered devices (name, OS, browser) | Device management | Yes |
| IP address | Rate limiting, security | Temporary logs only |
| Subscription / billing info | Payment processing | Via Stripe only |
On a team plan you can share a collection: its items are end-to-end encrypted with a collection key that our server never sees; each member receives that key wrapped to their own device key. The collection's name is encrypted too. For collections we store the encrypted items, the encrypted name, who belongs to each collection and with which role (view / edit / manage), and team activity entries (created, members added or removed).
You can also share an individual 2FA code with teammates. Shared codes use a two-of-two key split: the secret is encrypted with a key whose halves are split between the recipient's device and our server, so neither can read it alone. To generate the live 6-digit code, our server momentarily reconstructs the key in memory — this is the only case where the server touches shared secret material, and only the resulting code is returned (the secret is never stored in clear or logged). Revoking a teammate deletes the server's half, making their half useless instantly. We also store: team membership, your email (to show teammates who shared what), your public key (to wrap shared keys to you), and a team activity log (who invited/shared/revoked). Recipients receive an email when a code is shared with them.
For GDPR requests, contact: privacy@otpilot.app
Account data is retained while your account is active. Upon deletion, all synced data (vault items, devices, sync history, team memberships) is deleted immediately and permanently; items you placed in a team collection stay with that collection for its other members. Stripe billing records are retained as required by applicable financial regulations.
Privacy questions: privacy@otpilot.app