This extension strictly stores credentials locally in the browser to automate the login process. The API token is only used to securely fetch end-to-end encrypted OTPs. No data is sold, transmitted to third parties, or collected by the developer.