Security
Your data, under your control
Most "AI form fillers" send your personal information to a model in the cloud. FillOnce doesn't. Here's exactly how we keep your data private.
Never sent to a third-party AI
Your saved details (names, IDs, addresses, your family's information) are never sent to a third-party AI, and never used to train anything. Field matching runs on our own servers using deterministic rules by default. When enabled for an account, an optional small label-embedding model we host ourselves can help on unmatched labels; it never sees your saved values, which stay encrypted. To match a form we receive its field labels only.
Saved details: encrypted with your key
Your details, the names in your vault, and your documents are encrypted with a key derived from your passphrase. Once you set your passphrase, we store only the encrypted version: without your passphrase or recovery key, not even our own team can read it. The exceptions are listed under "What we do see" below.
Documents: encrypted in your browser before upload
Forms are parsed and filled in your browser; document files are encrypted with your key before upload, so Supabase stores ciphertext we can't open. Import reads the file in your browser and never uploads it, but the values it extracts are sent to our API in readable form to match them to your vault, held in memory for that request, not stored or logged, then encrypted in your browser before they are saved. Field labels reach our API for matching too. One exception to "we can't open your documents": Word → PDF fills approved answers into the Word file in your browser, then sends that plaintext document and its filename to our LibreOffice conversion service in the United States; the result is returned and neither copy is kept. Delete any document, or your whole account, at any time.
What we do see
To match a web form, the extension sends us its field labels and the address of the page you are filling, and we remember them so the next visit is faster. It never sends values already on the page, hidden fields, or passwords. Once your password protects your saved details, your saved values stay encrypted with a key only you hold, and we never receive them in readable form. Older accounts that haven't finished that one-time setup are prompted to complete it.
You stay in control
Confidential and restricted fields require your review before they are written into an exported document. The extension never submits a form for you. Export or delete your vault, documents, and account at any time. You can self-host the app on your own Next.js + Supabase stack if you want data to stay on infrastructure you operate (not a turnkey managed offering).
What never reaches us
These are encrypted in your browser or never sent. The exceptions are listed above.
Built for families, schools, and anyone handling sensitive paperwork
Camp forms, school registrations, medical intake, legal and job paperwork, the documents that ask for the most personal details are exactly the ones you shouldn't hand to an AI. We designed FillOnce so you never have to.