Security
Most "AI form fillers" send your personal information to a model in the cloud. FillOnce doesn't. Here's exactly how we keep your data private.
Your stored vault values, names, IDs, addresses, your family's details, are never sent to a third-party AI, and never used to train anything. Field matching runs on our own servers using deterministic rules by default. When enabled for an account, an optional small label-embedding model we host ourselves can help on unmatched labels, it never sees your saved values, which stay encrypted. To match a form we receive its field labels only.
Your details, the names in your vault, and your documents are encrypted with a key derived from your passphrase. We store only ciphertext, without your passphrase or recovery key, even our own admins can't decrypt your data.
Forms are parsed and filled in your browser; document files are encrypted with your key before upload, so Supabase stores ciphertext we can't open. Import reads the file in your browser and never uploads it, but the values it extracts are sent to our API in readable form to match them to your vault, held in memory for that request, not stored or logged, then encrypted in your browser before they are saved. Field labels reach our API for matching too. One exception to "we can't open your documents": Word → PDF fills approved answers into the Word file in your browser, then sends that plaintext document and its filename to our LibreOffice conversion service in the United States; the result is returned and neither copy is kept. Delete any document, or your whole account, at any time.
To match a web form, the extension sends us its field labels and the address of the page you are filling, and we remember them so the next visit is faster. It never sends values already on the page, hidden fields, or passwords. With your zero-knowledge vault set up (Settings → Vault security), your saved values stay encrypted with a key only you hold, and we never receive them in readable form. Older accounts that haven't finished that one-time setup are prompted to complete it.
Confidential and restricted fields require your review before they are written into an exported document. The extension never submits a form for you. Export or delete your vault, documents, and account at any time. You can self-host the app on your own Next.js + Supabase stack if you want data to stay on infrastructure you operate (not a turnkey managed offering).
Some things are encrypted in your browser before they ever leave your device.
Camp forms, school registrations, medical intake, legal and job paperwork, the documents that ask for the most personal details are exactly the ones you shouldn't hand to an AI. We designed FillOnce so you never have to.