https://fillfast-web.vercel.app/privacy
Last updated: May 24, 2026

The short version
FillFast does not have user accounts.
Your profiles, field values, and uploaded files stay in chrome.storage.local on your own device.
When AI matching is enabled, only field labels and types from the current page are sent to our matching API — never your saved values.
We do not sell, share, or log personal data.
What FillFast stores locally
Inside your browser, FillFast saves: the profiles you create (name, key/value pairs, attached files as data URLs) and your extension settings (AI on/off, API base URL). This data lives in chrome.storage.local. You can delete it any time from the extension popup or by uninstalling.

What is sent to our server
When you click Fill This Page with AI matching enabled, the extension calls our API (/api/match) with:

The list of form field descriptors on the page — labels, placeholders, ids, names, autocomplete hints, and the option labels of dropdowns / radios / checkboxes.
The list of keys from your active profile (e.g. name, email). Keys are short labels you chose; we never receive the values.
The page title and URL, to help the model disambiguate fields.
The server forwards this to an LLM (OpenRouter, which may route to Gemini, Claude, or GPT depending on configuration). We do not retain the request body. The LLM provider's retention policy applies to their copy; we recommend reviewing it.

You can disable AI matching from the extension's Settings panel at any time. FillFast will fall back to entirely local string matching.

Events
If a webhook is configured, anonymous lifecycle events (extension_installed,form_filled) may be forwarded with the page hostname and a count of fields filled. No field labels and no values are included. You can disable events by clearing the API base URL in Settings.

Permissions, in plain English
storage — to save your profiles inside the browser.
activeTab — to read form fields on the tab you are looking at, only when you click the icon.
scripting — to inject the fill logic into pages on demand.
host permissions (<all_urls>) — because form-fill must work on any website you visit.
Contact
Questions or removal requests: hello@fillfast.app.