IIT KGP ERP Auto Login ("the extension") is an unofficial Chrome extension. IIT Kharagpur and the ERP team did not make it.
Google user data the extension accesses
With your permission, the extension uses the Gmail API with the read-only scope https://www.googleapis.com/auth/gmail.readonly. It uses this access only to:
search your mailbox for the ERP sign-in OTP mail (by default, mail from erpkgp@adm.iitkgp.ac.in with the subject "OTP for Sign In"; you can change this search on the settings page);
read the matching mail to take the one-time password (OTP) from it;
show the sender, subject and OTP of the latest match on the settings page when you press "Find latest OTP mail".
The extension reads mail in your browser only. It does not store mail content. It keeps only the IDs of matching mails for the duration of one login attempt, so that it can tell a new OTP mail from an old one.
How the extension uses and shares Google user data
The OTP is typed into the ERP login form at https://erp.iitkgp.ac.in/. That is the only place any data from Gmail goes.
The extension does not send Google user data to the developer or to any other person or server. It has no server, no analytics and no tracking.
The extension does not sell Google user data, use it for advertising, or use it to train AI or machine learning models.
No person reads your mail.
IIT KGP ERP Auto Login's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Other data the extension stores
Your ERP roll number, ERP password, security questions and answers, Gmail address and settings. They are stored in your Chrome profile on your computer. The roll number, password, security questions and answers, and Gmail address are encrypted with AES-GCM (256-bit) before they are stored. The encryption key is kept in the extension's own storage and cannot be exported. This data is not synced. The ERP details go only to the ERP login form, and the Gmail address goes only to Google, to choose the account at Google sign-in.
The Gmail access token, stored with chrome.storage.session. Chrome deletes it when the browser closes. The token expires after about one hour.
The time of the last automatic login attempt, used to limit attempts to one every 2 minutes.
Your control
Remove the extension in chrome://extensions to delete all data it stored.