The short version
- Everything happens on your device — there is no OttoKey server.
- While you are signing in, OttoKey checks your newest emails, takes the code out of the one that has it, and fills it in.
- Nothing is stored on the internet, sold, or used to train AI.
- The whole extension is open source, so you can check all of this yourself.
- You can revoke access in one click, anytime.
What OttoKey can access
OttoKey connects to the inbox providers you choose — Gmail and Outlook/Hotmail — using each one's official sign-in. You can link up to five inboxes at once. For each, OttoKey requests permission to read and tidy mail:
- Gmail —
https://www.googleapis.com/auth/gmail.modify - Microsoft (Outlook/Hotmail) —
Mail.ReadWrite
Here is exactly how that access is used, described the way the code actually works:
- A search only runs when a sign-in page asks for a code, or when you press Fetch yourself. There is no background scanning.
- During a search, OttoKey lists your most recent messages from the last 15 minutes and reads their text looking for a verification code. It has to look at the recent ones because it cannot know in advance which email the code is in.
- The moment a code is found, the search stops. Nothing about the other messages is kept, logged or sent anywhere.
- Only if you turn on Tidy up inbox — which is off by default, and asks you to confirm before it switches on — does OttoKey then move that one email to your Trash, where it stays recoverable for 30 days.
OttoKey never sends email as you, never permanently deletes anything, and never touches an email it did not read a code from.
Don't take our word for it
Every line of OttoKey is public at github.com/amogus0471/OttoKey, under the MIT licence. You do not have to read all of it to check the claim that matters — manifest.json lists every server the extension is permitted to contact, and there are exactly two: Google's mail API and Microsoft's. Chrome itself enforces that list, so the extension cannot send your mail anywhere else even if it wanted to. There is no analytics library, no error reporter and no third-party code in the extension at all.
What OttoKey does with it
Strictly one thing: find your 2FA code and fill it in. That means:
- No advertising, ever.
- No training of AI or machine-learning models.
- No human reading your email — extraction is automatic code running in your browser.
- No accounts, no sign-up and no payment details. OttoKey is free and has nothing to log you into.
Where your data lives
On your computer, in your copy of Chrome. OttoKey has no database and no backend.
- Your emails, codes, and login token are never sent to a developer server.
- Your data is never shared, sold, or transferred to anyone.
- Recent codes are kept only in your browser's local storage, and you can clear them anytime.
Data security
We take reasonable measures to keep your information safe:
- All communication with each provider's mail API happens over encrypted HTTPS/TLS, so your data is protected in transit.
- Your verification codes and login token are stored securely on your local device, inside Chrome's protected extension storage — never on any external server.
- Because there is no backend, there is no central database that could be breached or leaked.
Data retention & deletion
OttoKey keeps data only as long as it is needed to do its job, and no longer:
- A verification code is read and used immediately. Only a short local history of recent codes is kept so you can copy them again, and you can clear it any time with "Delete history". If you enabled tidy-up, the email the code came from is moved to your Trash, where your provider keeps it recoverable for 30 days.
- Your access is held as a temporary token in local storage. When you log out, the token and stored account details are deleted right away.
- When you uninstall the extension, Chrome removes all of OttoKey's local data automatically, and its access to your account ends.
Google API compliance
OttoKey's use of information from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Staying in control
You can cut off OttoKey's access whenever you like from your account's connected-apps settings — for example Google or Microsoft. Uninstalling the extension removes its access and deletes all of its local data too.
Questions?
Email the developer directly at [email protected].