Security at SuperEasyOTP
We handle OAuth credentials and mailbox notifications with care. Message bodies are normally processed in the extension—not archived on our servers.
Credential storage
Google refresh tokens and related account data are stored encrypted on the backend. Access is limited to operating SuperEasyOTP (connection, renewal, Gmail change signals).
Local processing
Recent inbox content and sign-in detection run on your device inside the Chrome extension. We do not maintain a server-side mailbox archive for product features.
Transport and operations
API traffic uses HTTPS. Infrastructure access is restricted to operational needs. Hosting details appear in our Privacy Policy.
Phishing and links
Recognized codes or links are not proof of a legitimate sender. Check addresses and destinations before you act—especially for sign-in links.
Open source
SuperEasyOTP is an open source project. Reviewing the code helps you understand what the extension and API do. Source links are published on the homepage when available.
Report an issue
Email amit@hopiumstudio.com with reproducible steps using synthetic or your own test data. Do not access other people's data. External security review is pending.