OTPHop

Privacy policy

Last updated: November 3, 2026

This policy says what data OTPHop handles. OTPHop is operated by Edo Ventures LLP, a limited liability partnership registered in India (LLPIN ADA-3968), based in Hyderabad, India ("we", "us"). It matches the security model on our security page.

1. What stays on your phone

The phone app receives your SMS to find a code. It never sends the SMS text, the sender or your contacts. It cannot read your SMS history. It keeps a local log of the codes it forwarded, with a pause switch and an unpair button for each browser.

2. What the relay handles

  • Codes. The relay receives each code as ciphertext. It cannot read it, because the private key that decrypts it never leaves your browser. It keeps the ciphertext until your browser confirms it received the code or for 3 minutes, whichever is first. It logs no content.
  • Identifiers. No accounts and no email sign-up. The server holds only these identifiers: a salted hash of the phone's Android ID (for the trial), a hashed device token, channel ids, the browser name and the license key. A channel id is a random value that names one pairing between your phone and one browser.
  • Browser name. The pairing QR code holds a browser name, a label you can edit and that you see in the app and the popup, eg: "Chrome on Mac". The phone sends it to the relay when it pairs. The relay keeps it with the channel until you unpair that browser. Then it deletes the name with the channel.
  • Trial. The relay uses the Android ID hash to count the trial per phone, so that a reinstall does not restart it.
  • Request data. Like any server, the relay receives the network address of each request and the time it arrives, and it limits how often a request can repeat.

3. What stays in your browser

The extension stores the channel id, the key pair and the browser name for each pairing in the browser's own storage. It also keeps in the browser's session storage the ids of codes it already used, so that it never fills a code twice. It keeps the last filled code there for 3 minutes, so that the popup can offer a copy button. Session storage ends when the browser session ends. Unpairing removes all of this.

On web pages, the extension reads only the input field that has focus. It looks at the field's attributes and nearby label text to find out whether it is a code field. It does this on your device and sends nothing from the page. It does not read other fields, page text, the address of the page or cookies.

4. Payments

Gumroad is the merchant of record (legal entity: Gumroad, Inc., United States). Gumroad processes your payment details, name and email address when you buy. It handles them under its own terms and the Gumroad privacy policy. Gumroad also emails you the receipt and the license key. We do not receive your card details. When you enter the license key in the app, the relay sends the key to Gumroad to check it. Gumroad's answer includes the purchase email address and whether the purchase was refunded or disputed. The relay uses that answer only to accept or refuse the key and does not store the email address.

5. This website

The website is static. We do not use accounts, cookies, advertising or analytics scripts on it. It is hosted by Cloudflare, which processes request data such as network addresses to deliver and protect the site.

6. Sharing

We do not sell your data. We share data only with the providers that run the service for us: Gumroad for payments and license checks, and Cloudflare for hosting and the relay. We may also share data when the law requires it.

7. Your choices

You can unpair a browser, pause forwarding, or remove the app at any time. To ask for access to data we hold about you, or for its removal, write to support@otphop.com and include your license key or channel id so that we can find it.

8. Children

OTPHop is not meant for children under 16.

9. Changes and contact

We post changes to this policy on this page with a new date. Questions go to support@otphop.com.