LocalBox2FA Privacy Policy

All TOTP code generation happens locally using your browser's Web Crypto API (HMAC). Saved secret keys and their settings are stored in the extension's storage area (chrome.storage.local) and are never sent to us, except when you explicitly enable cross-device sync (see below). We do not use cookies, analytics, telemetry or advertising SDKs, and we do not read your browsing activity.

Encryption at rest (optional)

By default, saved secret keys are stored unencrypted. You can enable a master password in the extension settings, after which every secret field is sealed with AES-GCM (256-bit). The encryption key is derived from your password with PBKDF2-HMAC-SHA256, 600,000 iterations and a random 16-byte salt.

• Only the secret key is encrypted. Account names, digit count, period and algorithm remain readable so the list can still be browsed (and searched or renamed) while locked. No codes can be computed while locked.
• Neither the master password nor the derived key is ever written to storage or transmitted anywhere. The key lives in the popup's memory only and is destroyed when the popup closes, so the password is required every time the popup is opened.
• The master password cannot be recovered. If you forget it, the only way forward is to erase the saved records from the lock screen and start again (an exported backup can be re-imported).

Cross-device sync (optional, Premium)

Sync is off by default and is only available with a Premium licence. When you turn it on, the extension writes to chrome.storage.sync, which your browser vendor (Google, or Microsoft for Edge) replicates to other computers signed in to the same browser account. We operate no sync server and never receive this data.

• What is synced: each record's encrypted secret, its account name, digit count, period, algorithm and timestamps; small markers for deleted records so that a deletion propagates instead of being undone by another device; and the vault metadata (salt, iteration count and an encrypted verifier) that lets a second device check the master password.
• What is never synced: the master password, the derived encryption key, the licence key and generated codes. The verifier only lets a device confirm that a password is correct; it does not reveal it.
• Sync requires a master password. Without one it cannot be turned on, so secrets never leave the device in plaintext.
• Account names, digit count, period and algorithm travel unencrypted, because they stay readable in the list (so it can be browsed, searched and renamed while locked).
• To protect the transfer itself as well, enable your browser's own sync passphrase; otherwise the data is held by your browser vendor under its terms. Sync is not a backup and is not a substitute for an exported backup file.

Before you activate a Premium licence, the extension performs no network requests at all — no licence validation and no sync take place. Activation contacts the licence server only when you submit a key.

Cross-device sync is outside this count. The extension writes to chrome.storage.sync and your browser vendor's own sync service carries the data; the extension makes no direct network request for sync and sends nothing to us.

With a licence, the extension contacts the licence server at api.annmax1983.com in exactly three situations:

If the server cannot be reached, the cached licence keeps working until the next successful check.

Your TOTP secrets and generated codes are never part of any request.

Our license server records the IP address of these requests solely for rate limiting and abuse prevention — never for profiling, advertising, or sharing with third parties.

• No cookies, analytics, telemetry, crash reporting or advertising.
• No access to browsing history, tabs, bookmarks, downloads or the content of any website — the extension does not request those permissions.
• No injection into pages: the extension has no content scripts and runs only in its own popup.
• No data sharing with third parties. The licence server is operated by the extension's developer.
• The one exception is cross-device sync, and only if you turn it on: sealed records are carried by your browser vendor's account sync service (Google or Microsoft). We are not a party to that transfer and cannot decrypt the sealed secrets.

• storage — to keep your saved records, your licence status and the install identifier in the extension's local storage area, and, if you enable sync, to write sealed records to the browser's synced storage area.
• clipboardWrite — to copy a generated code to the clipboard and to clear it again 30 seconds after copying while the popup stays open, or when auto-lock engages. The extension cannot read the clipboard.
• https://api.annmax1983.com/* — to reach the licence server, and only for the licence requests described in section 2.

Nothing else is requested.

Export can write either a plain-text file or an encrypted backup. The plain-text file contains your secret keys in the clear and is readable by anyone who opens it. The encrypted backup is a .lb2fa envelope sealed with AES-GCM 256 under a password you choose at export time; that password is independent of your master password and is required to restore the file. Both files are created by your browser and saved straight to your downloads folder — neither is uploaded anywhere. Store them securely: anyone who obtains a plaintext file can generate your codes, and an encrypted backup is only as strong as its password.

• Licence data (licence key, install identifier, last verification time) is kept in the extension's local storage. Click Remove in Settings to clear it, or uninstall the extension.
• Uninstalling the extension or clearing its local data permanently erases every account stored on this device. If cross-device sync is on, a copy remains in your browser account and can be restored by reinstalling the extension and entering the same master password. Export a backup anyway.
• Synced data lives in your browser account. Turning sync off stops further syncing but leaves the existing copy in the cloud; use Delete synced data in Settings to remove every synced record, which also turns sync off on this device. Other devices keep the copies already in their local storage and turn sync off once they see that the cloud copy is gone. Uninstalling the extension does not by itself remove the synced copy, so delete it first if that is what you want.
• Removing the master password (Settings → Turn off encryption) decrypts the records back to plaintext. This is not possible while sync is turned on.

If this policy changes, the revised version will be published on this page with a new date. Material changes will be noted in the extension's release notes.

Questions about this policy? Email support@annmax1983.com or open an issue on GitHub.