Fill It Out

Local-first by design. Your profile lives in your browser — not on our servers. Cloud features are off until you explicitly turn them on, and your profile is encrypted before it ever leaves your device. We can't read your data. We don't sell it. We don't train AI on it.

The 10-second version:

Profile data: stored only in your browser (IndexedDB/Dexie)
Documents: session-only — deleted when the browser closes
Cloud sync (optional): AES-256-GCM encrypted before upload
Cloud AI (optional): field labels + doc context only — never raw profile values unless you allow it
Local AI: runs entirely on your device
No ads, no trackers, no data sales — ever

1. What Stays On Your Device (the default)

Everything below lives in your browser's local storage and never leaves your device unless you enable a cloud feature:

Profile fields — names, emails, phone numbers, addresses, links, and any custom values you save
Field-matching data — mathematical vectors (embeddings) of your field keys used to map forms locally
Fill history & usage counters — which sites you filled, how many fields, which engine was used
Corrections — fields you marked as wrongly filled (used to avoid repeating the mistake on that site)
AI models — local LLM and embedding models downloaded once and cached on disk; all inference runs on your GPU, offline-capable

2. Session Documents (uploads)

Documents you upload in the popup (resume, bio, notes) are:

Read in your browser (PDF/DOCX/TXT parsing happens locally)
Trimmed to your plan's character limit and held as session context only
Automatically deleted when you close the browser — we never keep a copy, and neither does the extension. Your original file stays where you saved it.

3. What Leaves Your Device — and Exactly When

A. Signing in (required to use the extension)

Your email and authentication tokens go to Supabase (our backend) — that's all.
Signing in does not upload your profile, documents, or browsing data.

B. Cloud Sync (optional, paid plans, off by default)

Your profile fields are encrypted on-device with AES-256-GCM before upload.
The key is derived from your session + device fingerprint — we cannot decrypt your profile. If you lose access, we cannot recover it either.

C. Cloud AI (optional, paid plans, off by default)

Form structure — field labels, names, and types — may be sent to generate answers for fields local matching couldn't solve.
Session document text may be included for open-ended questions ("Tell us about yourself").
Profile values marked as sensitive (passwords, SSN, payment data) are never sent — blocked by field-type detection and per-field sensitivity flags, with an additional privacy redaction pass before anything goes out.
Cloud AI providers (DeepSeek / OpenRouter) process the request transiently; they are instructed not to train on it, and our prompts carry no account identifiers.

D. Wrong-fill feedback (only when you click the red ✕)

When you correct a filled field, we store: the site's anonymized fingerprint, the field's selector/label, the fill technique used, and up to 200 characters of the wrong value.
This powers the "avoid the same mistake next time" feature and helps us improve matching in future releases. It is sent only on your explicit click.

E. Payments (optional)

Checkout is handled entirely by Stripe — card details never touch the extension or our servers.
We store only your Stripe customer ID and plan tier to unlock features.

F. Error & usage logs

Crash/error logs: error type, message, and extension version — deduplicated, no form contents.
Usage counters: fills per month and AI calls per month, used to enforce plan limits.
Aggregate, anonymous usage statistics may be kept to improve the product; they contain no field values.

4. What We Never Do

Sell, rent, or share your personal data with advertisers or data brokers
Train AI models on your data
Track your browsing history or collect page contents outside active fill operations
Fill or transmit password fields, or store them in plain text
Use your data for any purpose other than filling forms for you

5. Third-Party Services

Supabase — authentication, encrypted sync, plan limits
Stripe — payments
HuggingFace — one-time download of local AI models (no data sent back)
DeepSeek / OpenRouter — optional cloud AI answers (only when Cloud AI is enabled)

6. Retention & Deletion

Local data: kept until you delete it (Dashboard → Clear data) or uninstall the extension
Session documents: deleted automatically when the browser closes
Cloud-synced profile: kept until you delete your account (deletion removes it from our servers)
Error logs: deduplicated and pruned regularly (target: 30 days)
Feedback rows: kept until reviewed and resolved, then aggregated anonymously

7. Your Controls

Cloud AI toggle — off means every fill happens on-device
Cloud sync toggle — off means nothing is uploaded
Per-field sensitivity — mark any profile field as private and it's redacted from cloud calls
Clear usage history / clear all data — one click in the Dashboard
Account deletion — email us and we remove server-side data within 30 days

8. Children

Fill It Out is not directed at children under 13 (or the age of digital consent in your region), and we do not knowingly collect their data.

9. Changes

If this policy changes materially, we'll say so in the extension's release notes and update the date above. Continued use after the update means you accept the new policy.

10. Contact

Privacy questions, deletion requests, or anything else: fio@atsclick.com or GitHub Issues.

This extension is distributed via the Chrome Web Store and complies with its User Data and Limited Use policies: data is used solely to provide the form-filling feature you see, and is never transferred for unrelated purposes.