Code Fill is a Chrome extension from Epiphani Studios ("we," "us") that enters the verification
code you just received by text into the sign-in page that asked for it. It works as a pair with the
Code Fill Mac helper, a small program on your Mac that reads recent texts in Messages and hands the
newest verification code to the extension. This policy covers the extension and the helper. Our
Epiphani Studios privacy policy covers this website and your studio account.
What Code Fill reads
Your recent texts. When a sign-in page is waiting for a code, the Mac helper opens
the Messages database on your Mac and looks through incoming texts from the last five minutes for
the newest one that contains a verification code. It uses the text itself, its sender, and its time.
The sign-in page you are on. The extension reads the page's input fields and the
wording around them to recognize a verification code field and the sentence asking for a code. This
reading happens inside your browser.
Where the information goes
Code Fill works entirely on your Mac. A code travels from Messages, to the helper, to the extension
in Chrome, and from there into the code boxes of the sign-in page you are on, the same place you would
have typed it. That website receives the code the way it receives anything you type.
Only the code reaches the page. The text of the message and its sender stay with the helper and the
extension's background process.
The code fills in automatically when the text names the site you are on. For any other site, Code
Fill shows a "Fill the code from Messages" button and fills when you click it.
Epiphani Studios does not collect, receive, or store your texts, your codes, or the pages you
visit. Code Fill sends nothing to our servers or to any third party.
What is kept on your Mac
The extension keeps nothing between uses. The code and message text are held in memory for the
moment of filling.
The helper writes a short log to ~/Library/Caches/codefill/host.log. Each line records the
time, how old the code was, and which route answered. The log carries no code and no message text.
While a request is in progress, the helper's background job leaves a small answer file in the same
folder. It is deleted as soon as the extension has read it.
Permissions you control
Full Disk Access. macOS asks you once to allow the helper's background job to read
Messages. The job runs under /usr/bin/python3 and opens the Messages database read-only. You can
turn this off any time in System Settings, Privacy & Security, Full Disk Access.
Website access. The extension runs on http and https pages so it can find a code field
wherever a sign-in lives, including inside embedded frames. It checks each page for a field asking
for a verification code and fills only when it finds one. You press Log In yourself.
Native messaging. This is how Chrome talks to the Mac helper on your own Mac.
How we use it
Code Fill uses this information for one purpose: entering a texted verification code into the page that
asked for it. We do not sell or rent it, we do not use or transfer it for any other purpose, and we do not
use it to determine creditworthiness or for lending.
Removing Code Fill and its data
Remove the extension in Chrome at chrome://extensions.
Remove the helper by unloading its background job
(launchctl bootout gui/$(id -u)/com.jasonpaez.codefill-reader), then deleting
~/Library/LaunchAgents/com.jasonpaez.codefill-reader.plist,
~/.local/bin/codefill-host, ~/.local/bin/codefill-reader,
~/.local/bin/latest-code, and ~/Library/Caches/codefill.
Delete the helper's Chrome registration file,
~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.jasonpaez.codefill.json.
Children
Code Fill is not directed to children under 13, and we do not knowingly collect information from them.
Changes
If this policy changes, we will update this page and the date above.