OM Authenticator does not collect, transmit, sell or share user data.

The extension has no analytics, telemetry, advertising SDK, remote scripts, network requests, content scripts or host permissions. TOTP secrets, service names and logins are kept in an encrypted local vault. The nonextractable local encryption key remains in the Firefox profile. QR images and backup files are processed locally after an explicit user action and are not uploaded.

Firefox Sync is not used. Private Browsing is not supported. The optional topSites permission is requested only after an explicit user action and is used locally for service-icon suggestions.