Privacy Policy

1. Who provides the extension

The extension developer can be contacted at e@shiplang.com. The developer works with ShipLang, which provides AI development software and login and payment technology. This extension is the developer's product and does not represent ShipLang.

2. Authentication accounts and browser storage

Authenticator processes the account names, issuers, shared secret keys, OTP type, algorithm, digit count, time period, and counter values that you enter, import, or obtain from an authenticator QR code. These values are used to generate TOTP or HOTP verification codes, display accounts, and support editing, copying, filling, importing, and exporting.

Authentication account records and preferences are saved using Chrome extension sync storage. If Chrome Sync is enabled, Chrome may synchronize this data through your Google account under your browser settings. Account data is therefore not limited to storage on one device. The extension does not add its own encryption layer to these stored account records.

Local extension storage holds login and membership information, a cloud-sync password when configured, pending-operation state, and a legacy icon cache. The cloud-sync password is stored locally so the extension can reuse it for the optional cloud service. Exported files contain account data, including secret keys; the extension does not encrypt these files.

3. The current web page

The extension reads the active tab's URL to prioritize accounts that match the current website. When you request QR scanning, its page script reads page images and canvases and decodes authenticator QR content in the browser. Browser restrictions, protected pages, inaccessible images, or unsupported QR content may prevent scanning.

When you choose to fill a code, the page script inspects candidate verification fields and inserts that code into a suitable field. The destination website then handles the value you submit according to its own privacy policy. The extension does not transmit page images or general browsing history to the cloud-sync or membership service as part of QR scanning or account matching.

4. Optional login, membership, and cloud synchronization

Login and membership

When you open login or payment, the extension opens a hosted page on crx.shiplang.com. It sends the product ID, extension ID, version, interface language, and, when present, your service user ID and locally recorded membership expiry. The hosted service returns account and membership information that is stored locally in the extension. ShipLang's login and membership service stores the email address, avatar, and membership expiry needed to provide that service, together with the identifiers required to associate the result with the product.

The extension does not collect payment card numbers in its own interface. Login and payment pages may use external identity or payment providers. If you choose Google login, Google's Privacy Policy applies. If the hosted checkout offers Stripe or PayPro Global and you choose that provider, its respective Stripe Privacy Policy or PayPro Global Privacy Policy applies to the information supplied there.

Cloud synchronization of authentication accounts

Cloud synchronization is a separate optional feature hosted at shiplang.com/Totp/. Once you sign in and configure a cloud-sync password, synchronization sends your product ID, account email or user identifier, sync password, and authentication records to that service. Authentication records include secret keys, issuer, account label, algorithm, and OTP type. The service returns stored authentication records so the extension can merge them with browser storage. Subsequent account additions, edits, and individual deletions may also be sent when these cloud credentials are configured.

The current integration uses HTTPS requests with these values in request query parameters. HTTPS protects transport, but query parameters can be present in service or intermediary logs. The integration is not end-to-end encrypted; the receiving service can process the submitted secret keys. Local code generation does not require this separate cloud feature.

Uninstall and support

After a service user ID is available, the extension may register an uninstall feedback page on crx.shiplang.com, including that ID, the extension version, and interface language. The browser opens this page if you uninstall the extension. Opening an email support link opens Gmail's compose page; the extension does not send an email automatically. Information you choose to send is handled by your email provider and the support recipient.

5. Permissions and their purposes

• Storage: saves authentication accounts, preferences, login state, membership state, and cloud-sync configuration using Chrome extension storage.
• Active tab: temporarily reads the active tab's URL after you invoke the extension so it can prioritize matching accounts. The extension communicates with that tab's page script for scanning and filling, and can open its built-in demo page.
• Website access: page scripts run on ordinary HTTP and HTTPS web pages to scan authenticator QR codes and fill verification fields across different websites. File URLs and protected browser pages are excluded. A separate host permission for https://shiplang.com/* permits the optional cloud-sync requests. The extension does not use this access to sell browsing history or display advertising.

The extension's source does not include advertising trackers or an analytics service. External websites, identity providers, payment processors, Chrome Sync, and the hosting platform have their own processing practices.

6. Retention, deletion, and your choices

You can remove individual authentication accounts in the extension or use its clear-data action to remove account records and preferences from extension sync storage and remove the locally saved cloud-sync password and icon cache. Chrome Sync and other signed-in devices may affect when synchronized changes propagate. Removing the extension clears its device storage under Chrome's normal behavior; browser sync data is also subject to your Chrome and Google account controls.

Local account removal or clearing all local data should not be treated as a request to erase every server-side record. In particular, bulk clearing does not automatically request deletion of the service account or all cloud records. Stop using optional cloud synchronization and request server-side deletion separately if you want those records erased.

ShipLang states that login and membership data is retained until you request deletion, is protected, and is not retained in backup after deletion. To request access, correction, or deletion, email support@shiplang.com and include the extension name or download link and an explanation of your request. ShipLang states that requests are handled within 7 days. For cloud authentication records, specify that your request also covers OTP secret keys and the associated cloud-sync account. This policy does not promise a separate verified retention period for cloud service logs or payment-provider records; contact the applicable service about those records.

For help with browser data or this extension, contact e@shiplang.com. Keep any exported backup files under your control and delete them when no longer needed.

7. Changes and contact

This policy may be updated when extension behavior or service integrations change. The effective date above identifies this version. Questions about the extension's privacy practices can be sent to e@shiplang.com; questions about hosted login, membership, or cloud account deletion can be sent to support@shiplang.com.