legal & trust

privacy policy.

Privacy by design. We never sell your data, we hash your OTP codes with SHA-256, and self-hosters retain 100% data sovereignty on their own servers.

Last updated: September 2026

1. Overview & Commitment

WA OTP ("we", "our", or "the Service") is an open-source WhatsApp and Telegram OTP Gateway created by Lucky Yaduvanshi and hosted under CodaiPro. We respect the privacy of developers, operators, and their end-users. We do not sell, rent, or monetize personal data.

2. Information Processed

When using the hosted gateway or integrating via our API, we process only the minimum information necessary to execute two-factor authentication:

  • Phone Number / Telegram Chat ID: Used solely to dispatch the requested OTP via the Meta Cloud API or Telegram Bot API.
  • One-Time Password (OTP) Codes: Cryptographically generated and stored exclusively as a SHA-256 hash. Plaintext codes are never written to the database.
  • Account Credentials: Developer email and hashed password stored securely in PocketBase for dashboard access.
  • API Usage Logs: Timestamps, delivery status codes, channel used, and request IDs for rate-limiting and audit trails.

3. Cryptographic Storage & Security

Security is implemented at the database layer:

  • Hashed OTPs: An operator inspecting the database can only view SHA-256 digests. Even in the event of unauthorized database access, OTP codes cannot be reversed.
  • Single-Use Burn: Once verified, an OTP code is immediately marked as burned and cannot be reused.
  • Auto-Invalidation: Issuing a new OTP to a phone number automatically invalidates any existing active codes for that number.
  • Encrypted Tokens: Meta and Telegram provider tokens are Fernet-encrypted at rest using a 32-byte master key.

4. Data Retention

OTP codes automatically expire after 300 seconds (5 minutes). Delivery logs are retained temporarily for troubleshooting and rate limiting. Users may delete their account and associated API keys at any time through the dashboard.

5. Self-Hosted Installations

When you deploy WA OTP via Docker Compose on your own server, zero telemetry or data is transmitted to our servers. You maintain 100% ownership, governance, and control of your database, logs, and user communications.

6. Contact

For questions regarding this privacy policy or data security practices, contact the maintainer at luckyyaduvanshi.in or via the CodaiPro team at codaipro.com.