Privacy Policy

OTPfill is a Mac app that finds verification codes in your email and types them into login forms. It is operated by Supersonic Software, Inc. ("we"). This policy explains what the app and our servers handle, why, and how long we keep it.

The short version

• We read your email only to find verification codes, only while a code field is open, and only recent messages.
• We don't store the content of your emails and we don't log it.
• We don't sell your data, show you ads, or use your email to train AI models.

When OTPfill reads your email

OTPfill checks your connected inboxes in two situations: when you click into a field that looks like a verification code field, it looks at messages received in the last three minutes and keeps checking for up to 90 seconds; when you press the fill shortcut, it looks at messages from the last ten minutes. It doesn't read your inbox at any other time.

Message subjects, senders, and text are fetched through our server, passed to the app on your Mac, and used there to find the code. Our server handles this text in memory only. It isn't written to a database or to logs.

What we store

On our servers (Google Cloud, United States):

• An install record: a random identifier for your copy of the app. We keep only a hash of the token your app uses to sign in.
• Connected inboxes: the provider (Gmail, Outlook, or IMAP) and the email address. For Gmail and Outlook, a reference to the connection held by Composio (see below). For IMAP, the server name, your username, and your app password, encrypted with AES-256-GCM.
• Usage and plan: the number of codes filled this month, your license key, and your Stripe customer and subscription IDs.
• Request logs: Google Cloud records the time, path, and IP address of requests to our server. These never include email content.

On your Mac:

• The app's sign-in token, in your Keychain.
• Your settings, such as the fill shortcut.
• The last few codes it found, in memory only. They're gone when you quit the app.
• The code it just filled, on your clipboard, so you can paste it again if a site needs that.

Accessibility access

macOS asks you to allow Accessibility access so OTPfill can see which text field is focused and type a code into it. The app looks at the focused field's label and the text next to it to decide whether it's a code field, and reads the web address of the page to match codes to the site you're on. It doesn't record your screen, read other fields, or log what you type.

Services we use

• Composio connects your Gmail and Outlook accounts over OAuth and holds the access tokens. Requests to read your mail pass through Composio.
• Google Cloud hosts our server and database.
• Stripe processes payments. Your card details go to Stripe directly; we never see them.
• Google, Microsoft, and your IMAP provider deliver your mail, under their own privacy policies.

Google user data

OTPfill's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to find verification codes for you. We don't transfer it to others except as needed to provide that feature, to comply with the law, or as part of a merger or acquisition, and no person at OTPfill reads it unless you ask us to for support and give permission.

How long we keep things

Inbox connections stay until you remove them in the app. Removing an inbox deletes its record and revokes the Composio connection. Install records and usage counts stay while you use OTPfill. Billing records are kept as long as tax and accounting law requires. To delete everything, email us from the address you connected and we will do it within 30 days.

Your rights

You can ask us for a copy of the data we hold about you, to correct it, or to delete it. Depending on where you live, you may have further rights under laws such as the GDPR or CCPA. Email hello@otpfill.com and we'll respond within 30 days.

Children

OTPfill isn't meant for children under 16, and we don't knowingly collect their data.

Changes

If we change this policy in a way that affects how your email is handled, we'll tell you in the app before the change takes effect. The date at the top shows the latest version.

Contact

Supersonic Software, Inc. · hello@otpfill.com