# Secure MFA Chrome Extension Privacy Policy

Effective date: August 5, 2026

Developer: bo.dong

Privacy contact: db7689206@gmail.com

This Privacy Policy explains how the Secure MFA Chrome extension ("Secure MFA" or the "Extension") accesses, processes, stores, and shares information.

## 1. Core principles

Secure MFA has no user account system, product backend, cloud vault, cloud backup, or cloud synchronization service. MFA secrets, one-time passwords, labels, settings, and encrypted backups are processed locally in the user's browser. We do not operate a server that receives, synchronizes, recovers, or analyzes this data.

The Chrome extension contains no advertising SDK, analytics, remote crash reporting, tracking pixel, or remote configuration service.

## 2. Information processed locally

When the user adds, imports, edits, or transfers an MFA record, the Extension may process TOTP secrets, current one-time passwords, issuer and account names, labels, TOTP parameters, local organization settings, encrypted backup files and passphrases, and temporary encrypted QR-transfer data and transfer codes.

This information is used only to generate codes, manage the local encrypted vault, create or restore encrypted backups, and perform user-initiated offline transfer to Android. It is not sold, used for advertising, or transmitted to us or any third party.

## 3. Local storage and security

- MFA records are encrypted before they are stored in the browser's local extension storage.
- The local vault key is wrapped using a key derived from the user's vault passphrase.
- Encrypted backups are created only when the user requests an export and are protected by a separate backup passphrase.
- Chrome-to-Android QR transfers are encrypted before display. Transfer codes are not embedded in the QR payload or persistently stored.
- Generated passwords are displayed only in the current page and are never stored.

No security measure can guarantee absolute security. Users should protect their device, Chrome profile, vault passphrase, backup files, and backup passphrases.

## 4. Visible-page QR scanning

When the user explicitly chooses to scan a QR code on the current page, Secure MFA temporarily receives access to that active tab and injects a self-removing region-selection overlay. After the user selects a region, Chrome captures the visible pixels of the active tab and the Extension crops and decodes only the selected region in memory.

Secure MFA does not inspect page DOM content, page text, URLs, titles, browsing history, hidden page areas, or other tabs. Screenshots and decoded values are not uploaded, shared, or persistently stored. Temporary image pixels and decoded values are cleared after success, failure, or cancellation.

## 5. Files and clipboard

- File access is limited to QR images and encrypted backup files explicitly selected or saved by the user.
- When the user copies a one-time password or generated password, it is written to the system clipboard. The operating system and other authorized software may be able to access clipboard contents.

## 6. Chrome permissions

- `storage` provides `chrome.storage.session`, which temporarily holds the unlocked-vault session key and expiry state for trusted Extension pages. This session data is memory-only and cleared on lock, expiry, or Chrome exit. Secure MFA does not use `chrome.storage.sync` for MFA data.
- `activeTab` grants temporary access only after the user starts the current-page QR scan.
- `scripting` injects only the isolated, self-removing region-selection interface and result message for that user-initiated scan.

Secure MFA requests no persistent host permissions and does not install persistent content scripts.

## 7. Sharing and third parties

We do not sell or share user data. Core Extension features do not send MFA data or browser data to us or any third party. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

## 8. Retention and deletion

Local encrypted data remains in the user's Chrome profile until the user deletes records, clears the Extension's storage, removes the Chrome profile, or uninstalls the Extension. Exported backup files remain under the user's control. Temporary screenshot, QR, transfer-code, plaintext bundle, and derived-key data is retained only for the current operation and cleared on cancellation, failure, timeout, completion, or page close.

Because Secure MFA has no account or product server, we cannot remotely view, recover, or delete a user's local vault.

## 9. Children's privacy

Secure MFA is not specifically designed for children, and we do not knowingly collect children's personal information through the Extension.

## 10. Policy changes

We may update this policy when features, dependencies, laws, or store requirements change. The effective date and public policy page will be updated when changes are made.

## 11. Contact

For questions about this policy or Secure MFA's data handling, contact:

- Developer: bo.dong
- Email: db7689206@gmail.com