LukaOTP Privacy Policy

Last updated: August 21, 2026

LukaOTP (the "Extension") is a locally operated time-based one-time password (TOTP) authenticator. This Privacy Policy explains how the Extension handles user data.

At a glance: the Extension does not collect, transmit, sell, or share user data; encrypted account data remains on your device only.

Data Collection

The Extension does not collect any user data. In particular, it does not collect:

• Account names, TOTP secrets, or generated verification codes
• Usage activity, click analytics, or crash reports
• Device identifiers, IP addresses, or location information
• Data for advertising, tracking, profiling, or analytics

The Extension does not sell or share user information with third parties.

Data Storage

Account data that you choose to add, such as service names, account names, and TOTP secrets, is encrypted with AES-256-GCM and stored only in your browser's local chrome.storage.local storage.

• The encryption key is derived locally from your master password using Argon2id.
• Your master password is never stored on disk or in browser storage. The derived key and decrypted account data exist only in memory while the Extension is running.
• There is no cloud synchronization, backup service, or remote copy of your account data.
• If you forget your master password, the encrypted data cannot be recovered. Removing the Extension or clearing browser data permanently removes the locally stored encrypted data.

Network Communications

The Extension makes no network requests and has zero network communication. TOTP generation, encryption, decryption, and QR-code processing are performed locally, including by code packaged with the Extension.

The Extension does not load, execute, or retrieve remote code. It does not depend on remote servers, APIs, or content delivery services to operate.

QR Code Scanning

When you explicitly select "Scan Current Tab," the Extension uses Chrome's temporary activeTab permission to capture the visible content of the current tab and detect a TOTP QR code locally in memory. The captured image is not uploaded, written to disk, or retained after processing. The Extension does not inject scripts into websites or continuously access tabs.

You may also choose a local QR-code image through the Extension's built-in image import page. That image is processed locally in the same way and is not uploaded or retained.

Permissions

The Extension requests only the following permissions:

• storage: to save your encrypted account data locally in chrome.storage.local.
• activeTab: to scan the currently visible tab only after you explicitly request a QR-code scan.

The Extension does not request access to websites, browsing history, the clipboard, or persistent background activity.

Third-Party Services

The Extension does not use third-party SDKs, analytics providers, advertising networks, cloud-storage providers, or other external services.

Children's Privacy

The Extension is not directed to children. It does not knowingly collect personal information from anyone, including children.

Changes to This Policy

If this Privacy Policy changes materially, the updated policy will be published on this page and the "Last updated" date will be revised. Any future feature that changes how data is handled, such as optional cloud synchronization, will be clearly described before it is made available.

Contact

If you have questions about this Privacy Policy, please contact the developer through the contact options on the Extension's Chrome Web Store listing.