Apps & Extensions Privacy Policy

Forms → Telegram is a Google Workspace add-on that sends each new response of a Google Form you own to a Telegram chat of your choice, using your own Telegram bot. It runs inside your Google account via Google Apps Script. There is no server operated by 301.st in the delivery path: the response goes from your Google account straight to the Telegram Bot API. We never receive, store, or see your form responses or your bot token.

Google user data accessed. The add-on accesses only the following Google user data, and only inside your own Google account:

That is the complete list. Form access is limited to the single form the add-on is used in — it cannot read your other forms, and it has no access to Google Drive files, Gmail, Google Calendar, contacts, or any other Google service.

The add-on requests only the minimum scopes it needs. None are “restricted”:

Your bot token is stored in the form's Apps Script document properties, scoped to that form, inside your Google account. It is never sent anywhere except to Telegram's API to deliver your messages.

Data protection mechanisms for sensitive data. The sensitive data the add-on handles are your form responses and your Telegram bot token. They are protected as follows:

• Processing stays inside your Google account: all code runs on Google Apps Script within your own account, protected by Google's infrastructure security and your account's own protections (password, 2-Step Verification). 301.st operates no server, database, or analytics in the path and holds no copy of your data — there is nothing on our side to breach.
• Encryption in transit: the add-on makes exactly one kind of network call — HTTPS (TLS-encrypted) requests to the official Telegram Bot API (api.telegram.org) to deliver your messages. Form data is never sent anywhere else.
• Encryption at rest: your bot token and settings live in document-scoped Apps Script properties inside your Google account, stored on Google infrastructure with Google's at-rest encryption. The token is never included in delivered messages and is never transmitted to anyone except Telegram's API.
• Least-privilege access: the add-on requests the narrowest OAuth scopes available for its features (see the table above); none are “restricted” scopes, and form access is limited to the current form only.
• Access control: the stored settings, including the bot token, are readable only by the add-on's code running under the authorization of the form's editors — people you have already trusted with the form and its responses.
• No retention: responses are read from the submit event and handed to Telegram at delivery time; the add-on keeps no copy of them.
• Revocation at any time: remove the add-on's access at myaccount.google.com/permissions, delete the stored bot token from the setup panel, or revoke the token itself in Telegram via @BotFather → /revoke.

Limited Use. Forms → Telegram's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not transfer your Google user data to others except as necessary to provide or improve the add-on's single purpose (delivering your form response to your Telegram destination), or as required by law; we do not use it for advertising; we do not allow humans to read it except with your affirmative consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized; and we do not use it to develop, improve, or train generalized AI or machine-learning models.

Redirect Inspector records HTTP redirect chains — URLs, status codes, and timing — strictly locally, in the browser's extension storage. This may include addresses of pages you visit; that data never leaves your device, is capped in size, is removed by the "Clear" button, and is deleted when you uninstall the extension.

By default the extension makes zero network requests. Two optional, user-initiated exceptions:

• News notifications (opt-in): if you enable them, the extension periodically fetches our public article feed at https://301.sh/posts.json (about every 6 hours) to show a browser notification about new posts. The request carries no identifiers and no browsing data. Disabling the toggle stops the requests and returns the notifications permission to the browser.
• Manual URL check: when you paste a URL to check it, the browser performs an ordinary navigation in a background tab (your cookies apply and the visit appears in your browser history, like any page you open); the tab closes automatically once the chain is recorded. The extension itself sends no requests.

When you uninstall the extension, the browser may open a feedback page on 301.st; that visit is a regular website visit governed by the site's own terms.

OTP.pink is an offline authenticator: it keeps the keys of your two-factor accounts and shows their one-time codes. It makes no network requests of any kind — not to 301.st, not to any other server, not to the page you are on. There is no account to create and nothing to sync, and no welcome or uninstall page is opened.

• What it stores, and where. The keys, account names, sites, folders and tags you add are kept in the browser's extension storage, encrypted with a key derived from your passphrase. Two sites are recorded with an account by its use: the site of the page a key was added from, automatically, and a site where you copied its code, only when you accept the offer to tie it — both encrypted in the vault like the rest, and never transmitted. Automatic backups are kept in the same browser, encrypted the same way. A small device record is stored unencrypted: the theme, the automatic lock time, a clock correction, a random device id, when this browser last made an encrypted export together with a digest of the encrypted vault at that moment (to remind you to export again after changes) and until when that reminder is snoozed, and two switches of features that are not in this version; it contains no name, contact information or online identifier, and OTP.pink never transmits it.
• Pages you visit. OTP.pink can read a tab only after you open it there — with its toolbar button, its context-menu item or your keyboard shortcut — and only while the browser keeps that access for the tab; while it can, it looks again each time a page loads in that tab. It looks for a 2FA key: in the page's text, links, form fields and pictures, and if needed in a picture of the visible part of the tab. What it reads is processed in your browser's memory and never transmitted; only the accounts you choose to add are kept.
• The address of the current tab. OTP.pink uses it to list that site's codes first. By default it is available only on the tab where you opened OTP.pink. An optional setting lets it follow the active tab; turning that setting on asks the browser for the “tabs” permission, and turning it off gives the permission back. The browser's permission covers the addresses and titles of all tabs; OTP.pink reads only the address of the active one.
• The clipboard. A code you copy is placed on the clipboard, and OTP.pink clears the clipboard 30 seconds later unless you change or turn off the delay. It never reads the clipboard, so the clearing also removes anything you copied after the code.
• Exports. A file is written only when you ask for one, as an ordinary browser download. The encrypted export needs your passphrase to open; an unencrypted export or a printed recovery sheet holds your keys in readable form and is created only after a separate confirmation.
• Removal. Uninstalling OTP.pink deletes the vault, the backups and the settings it kept in your browser. Files you exported stay where you saved them.

301.st never receives any of this data, so there is nothing for us to access, sell or delete on our side.

When you use an App, it interacts with the platforms you have chosen — for example, Google (Forms, Apps Script, the Workspace Marketplace), the Chrome Web Store, and Telegram (the Bot API and, for Forms → Telegram, your own bot). Those platforms process data under their own terms and privacy policies, which govern their handling of it.

This policy describes how 301.st's Apps handle the data they touch. It does not describe the full practices of every external platform your use may involve.

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, to object to or restrict its processing, and to not be discriminated against for exercising those rights. Because our Apps are designed so that your data generally stays on your device or in your own accounts and does not reach us, most of this data is already directly under your control.

Where we do hold data relating to you — for example, an email you send to support — you can exercise these rights by contacting us at privacy@301.st. We do not sell personal information.