Your data, under your control
Most "AI form fillers" send your personal information to a model in the cloud. FillOnce doesn't. Here's exactly how we keep your data private.
Never sent to any AI
Your stored vault values, names, IDs, addresses, your family's details, are never sent to an AI model, ours or anyone else's. They are never used to train anything. Field matching runs on our own infrastructure using deterministic rules plus a local, on-device model — it only ever sees a form's labels (its structure), never your data.
Vault values: end-to-end encrypted
Your details, the names in your vault, and your documents are encrypted with a key derived from your passphrase. We store only ciphertext — without your passphrase or recovery key, even our own admins can't decrypt your data.
Documents: encrypted in your browser before upload
Structured forms are parsed and filled in your browser; document files are encrypted with your key before upload, so Supabase stores ciphertext we can't open. Import extracts values on-device, then encrypts them before save. Field labels may briefly reach our API for matching; vault secrets and document bytes do not stay readable. Delete any document, or your whole account, at any time.
You stay in control
Confidential and restricted fields require your review before they are written into an exported document. The extension never submits a form for you. Export or delete your vault, documents, and account at any time. Self-hosting is supported if you want data to stay on your own infrastructure.
Built for families, schools, and anyone handling sensitive paperwork
Camp forms, school registrations, medical intake, legal and job paperwork, the documents that ask for the most personal details are exactly the ones you shouldn't hand to an AI. We designed FillOnce so you never have to.