Your data and your choices.

1. Operator and contact

Gmail OTP Hub is privately operated by its administrator. For privacy questions, access requests, or deletion requests, contact [email protected].

2. Information accessed and collected

• Connected account: the Gmail address and connection settings needed to identify and connect your account.
• Google authorization: OAuth access and refresh tokens, granted permissions, and token expiry information.
• Messages: message headers, sender and recipient details, subjects, timestamps, identifiers, and message content needed to locate and extract OTPs. Gmail access can expose other content within the messages being processed.
• OTP records: extracted codes and associated message details, which may include subjects or snippets, used to identify and deliver a relevant code.
• Operations: connection status, errors, activity records, and technical logs needed to operate and protect the service.
• Website and support: hosting and network providers may process IP addresses and request information. Emails you send to support include the information you choose to provide.

This public static website contains no analytics scripts, advertising scripts, tracking pixels, or account-connection form.

3. Gmail permission and purpose

The app uses Google OAuth and Gmail IMAP. IMAP requires https://mail.google.com/, a broad permission that can allow reading, composing, sending, and permanently deleting email. Gmail OTP Hub uses message access to find and deliver OTPs. Its OTP feature does not require sending or deleting email. Background access uses refresh tokens so the service can continue processing authorized accounts without repeated sign-in.

4. Use and sharing

Information is used to connect accounts, identify and deliver codes, show account and service status, troubleshoot failures, and protect the service. Codes and related details may be available to the operator, authorized app users, and connected clients you authorize. Only grant access to people and tools you trust.

Data may be processed on the operator's main computer, replicated to a backup computer, and included in operational backups. Hosting, network, tunnel, and backup providers may process data as needed to provide their services. Cloudflare may handle app traffic where a Cloudflare Tunnel is used. No Gmail data is published on this public website.

Google user data is not sold, used for advertising, transferred to data brokers, used for credit decisions, or used to train general-purpose AI or machine-learning models. Human access is restricted to permitted purposes, such as support with your consent, security investigation, legal obligations, or other uses allowed by Google's policy. Disclosure may also occur where legally required.

5. Storage and protection

The app stores OAuth refresh tokens encrypted at rest and connects to Gmail over TLS. Access controls protect operational interfaces. Records and backups can contain sensitive account and OTP information; the operator is responsible for securing the deployed computers, storage, and backup destinations. No method of storage or transmission guarantees complete security.

6. Retention and deletion

OAuth credentials are retained while an account is connected. OTP codes, message-related records, operational logs, and backups are retained according to the deployment's configured cleanup and backup schedules; retention can differ by record type. Cleanup depends on the operator running the configured retention tasks. Backup copies may remain until those backups are rotated or deleted.

To request disconnection and deletion of your connected account, stored credentials, OTP records, and related data, email [email protected] from the connected address where possible. Do not include passwords, tokens, or OTPs. The operator may verify account ownership and will explain any information that must be retained for security or legal reasons and any remaining backup retention.

7. Revoke Google access

You can remove Gmail OTP Hub access through your Google Account connections. Revocation stops future authorized Google access but does not automatically erase records already stored by the app. Request deletion separately using the contact above.

9. Changes

Updates will be posted on this page with a revised effective date. If a new use of Google user data requires additional consent, that consent will be requested before the new use begins.