Privacy: what otp.pink counts, and what it does not

Two different things, two different answers.

• The OTP.pink extension sends nothing anywhere. Your vault stays in your browser, and the extension makes no network requests, so no one — 301.st included — receives any of it to keep or share. Its privacy policy is on 301.st, the publisher’s site.
• This site, otp.pink, counts its visits. That is all it records, and the rest of this page says exactly what.

What the counter records

The counter is clx, a 301.st product, running in the site owner’s Cloudflare account. On each page view the page sends one POST request to otp.pink itself, answered with an empty 204; you will see it in your browser’s developer tools. That request is the site, not the extension.

For each page view it keeps:

• the page’s path, without the query or the fragment — path segments that look like an e-mail address, a UUID or a long number are replaced;
• the host of the site you came from, if any;
• the country Cloudflare reports for the request;
• the browser, the operating system and the device class (desktop or mobile), read from the browser’s user agent.

It does not keep:

• cookies or local storage — it sets none;
• your IP address, your full user agent or the request body — they are written neither to the database nor to logs;
• anything that follows you across days. Unique visitors are counted with a hash of a random salt of the day, the site, the IP address and the user agent. The hashes and the salt are deleted when the day closes, so one person on two days counts as two visitors and cannot be followed from one day to the next.

How long it is kept

• In the site owner’s Cloudflare account: views with their breakdowns hour by hour for 31 days, and day by day for 400 days. The visitor hashes and the day’s salt last until the day closes.
• On clx.cx, which shows the owner the reports: totals only, without the breakdowns — the site’s hours for 2 days, and its days for 400 days.

Where it goes

The counter’s script and its request are served by otp.pink itself; no page of this site loads anything from another host. Blocking the counter changes nothing for you: the site works the same, the owner only loses the count.

The site is hosted on Cloudflare Pages. Like any host, Cloudflare sees the requests it serves; the counter does not hide your visit from Cloudflare. Its own policy is Cloudflare’s privacy policy.

Questions

Write to the contact on 301.st — the same as for the extension’s policy. How the extension itself is secured is on the security page.