Privacy

Updated 21 October 2026

Google data accessed

OTP Bridge requests the Gmail read-only permission. That permission technically allows reading the connected mailbox. During normal operation, the bot lists recent messages and retrieves their headers and text or HTML content to identify verification codes. It does not send, modify or delete Gmail messages.

Use and sharing

The bot forwards a matching code only when the sender is on the administrator’s configured allowlist. The Telegram message includes the code, the connected Gmail address, the sender and the message time. Everyone with access to the destination Telegram chat may read those details. Google data is used only to provide this forwarding feature; it is not sold, used for advertising or used to train AI models.

Storage and retention

Google authorization tokens are stored as private files on the administrator’s computer or server. A local database stores the connected account address, processed Gmail message identifiers, processing status and scan checkpoints to prevent duplicate delivery. The application does not intentionally retain email bodies or codes in that database or its logs. Operational logs can contain account addresses and message identifiers. These local records remain until the administrator deletes them.

Forwarded messages are stored by Telegram under its own policies and the chat’s settings. Removing the app’s Google access does not delete messages already delivered to Telegram.

Data protection

The application connects to Google and Telegram over HTTPS. Authorization files are restricted to the operator or service account on the host. The administrator is responsible for access to the host and for membership of the destination Telegram chat.

Your choices

Revoke access through Google Account connections to stop future authorized access. Contact the administrator who connected your account to request deletion of local tokens and account records. Contact the Telegram chat administrator about messages already delivered there.

Limited use

The application’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.