Privacy Policy

Last updated: August 26, 2026

This Privacy Policy describes how Better Authenticator (“we”, “us”, or “our”) collects, handles, stores, and shares user data when you use our website at betterauthenticator.com, the Better Authenticator Chrome extension, our iOS app, and our related API (together, the “Services”).

If you do not agree with this policy, please do not use the Services. For questions, email [email protected].

This policy has dedicated sections for user data collection, handling, storage, and sharing. None of these topics is omitted.

The use of information received from Google APIs and Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

1. Who we are

Better Authenticator is an authenticator product that stores your TOTP (time-based one-time password) accounts and can autofill 2FA codes in your browser. We operate the Services at betterauthenticator.com.

2. User data collection

This section describes our user data collection practices. We collect only the information needed to provide and secure the Services:

Account information. When you sign in, we collect your email address and a unique user ID from our authentication provider, Clerk. We store these so we can identify your account.
Authenticator accounts. We collect labels, issuer names, and TOTP configuration (algorithm, digits, period) that you add. We also collect the TOTP secret keys you provide so we can generate codes.
Domain mappings. If you choose “Fill & Save Domain” in the Chrome extension, we collect the website hostname you associated with an authenticator account so we can autofill that site later.
Current-tab hostname (Chrome extension). The extension collects the hostname of the active tab only to match a saved domain mapping and request the correct one-time code.
OTP field presence (Chrome extension). The extension looks for one-time-code / OTP input fields on the page in order to autofill a 2FA code. It does not collect, scrape, store, or transmit other page content.
Session information. We collect authentication cookies and session tokens used to keep you signed in on the website and to sync that session to the Chrome extension.
Technical logs. Our servers collect request method, path, status code, timing, and whether a request was authenticated. We filter secrets, tokens, and email addresses out of application logs.

We do not collect your browsing history, full URLs beyond the hostname you save, page contents other than the presence of an OTP field, passwords, payment card details, location, health information, or personal communications. We do not use advertising identifiers, analytics SDKs, or tracking pixels.

Collection of hostname and OTP-field data begins only after you install the extension and use autofill or “Fill & Save Domain.” Account and authenticator data is collected only after you sign in and submit that information.

3. User data handling

This section describes our user data handling practices — how we process and use the data we collect, and how the Chrome extension handles data on your device.

We handle the information above to:

Create and maintain your account
Store your authenticator accounts and generate TOTP codes on the server
Autofill codes on websites you have mapped, when you ask us to
Authenticate you and protect the account (including Clerk’s failed-attempt protections)
Respond to support requests you send us
Operate, secure, and debug the Services

Chrome extension handling, specifically:

It handles the hostname of the current tab locally to match a saved domain mapping, then requests the matching one-time code from our API.
It handles one-time-code / OTP input fields only to insert a 2FA code. Other page content is not read, stored, or transmitted.
It handles cookies only to sync your Better Authenticator sign-in session from betterauthenticator.com (via Clerk). It does not read cookies from unrelated websites for any other purpose.
It handles extension storage to keep local session data needed to stay signed in.
Host access to websites you visit is handled solely to detect OTP fields and autofill codes on those sites. We do not sell this access or use it to build advertising profiles.
Chrome permission declarativeNetRequestWithHostAccess is handled only to adjust request headers on calls to Clerk’s authentication API so sign-in and sign-out work from the extension. It is not used to intercept or modify other websites.

TOTP secret keys are handled on the server. After you save a secret, it is not returned to the Chrome extension or website. The server generates the current code and sends only that short-lived code to your signed-in client.

We do not sell your personal information. We do not handle your data for advertising. We do not use it to train third-party AI models. We do not use the Chrome extension to collect data for an unrelated purpose. Use of Chrome API data is limited to providing the authenticator and autofill features described in the Chrome Web Store listing.

4. User data storage

This section describes our user data storage practices — where information is kept, how long it is retained, and how it is protected.

Account information, authenticator labels, domain mappings, and encrypted TOTP secrets are stored on our servers in a database operated by our hosting provider.
TOTP secrets are encrypted at rest using AES-256-GCM (Rails Active Record Encryption).
Data in transit is stored and transmitted only over HTTPS.
Session tokens and Clerk cookies are stored by the browser (and, for the extension, in chrome.storage.local) while you remain signed in.
On iOS, locally stored secrets and session material are stored in the system Keychain.
Technical logs are stored on our servers for a short period for security and debugging, then discarded as part of ordinary log rotation.
We retain account and authenticator data until you delete the relevant items in the app or ask us to delete your account.

Deleting the Chrome extension from your browser removes local extension storage. It does not by itself delete the accounts stored on our servers.

No method of transmission or storage is 100% secure. Please keep your sign-in credentials protected and only add authenticator accounts you intend to store with us.

This section describes our user data sharing practices. We share information only as needed to run the Services. We do not sell user data. We do not share user data with advertising platforms, data brokers, or information resellers.

Clerk, Inc. provides sign-in (email magic links / one-time codes and related session management). Clerk processes your email address and authentication events under Clerk’s Privacy Policy. We share account identifiers with Clerk so it can authenticate you.
Hosting and infrastructure providers store and serve the website, API, and encrypted database on our behalf. They process data only as our processors, not for their own purposes.
We may share information if required by law, legal process, or to protect the security of the Services or our users.

TOTP secret keys are not shared with the Chrome extension, the website, Clerk, or any other third party after you save them, except that our hosting provider stores the encrypted database that contains them.

6. Your choices

You can add, rename, or delete authenticator accounts and saved domains in the website.
You can sign out of the website and the Chrome extension at any time.
To delete your entire Better Authenticator account and associated stored data, email [email protected] from the address on the account. We will delete the data we store for that account, except information we must keep for legal or security reasons.
You may also request access to the personal information we hold about you at the same address.

7. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

8. International users

We may process and store information in the United States or other countries where we or our processors operate. If those locations have different data-protection laws than your country, we still handle the information as described in this policy.

9. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. The current version will always be available at https://betterauthenticator.com/privacy.

10. Contact

For privacy questions, data-access requests, or deletion requests, contact:

Better Authenticator
Email: [email protected]

Support instructions are also available at betterauthenticator.com/support.