1. Introduction
FormWizard ("the Extension") is a browser extension developed and maintained by FlowAssist ("we", "our", "us"). We take your privacy seriously. This policy describes the limited data the Extension interacts with, how it is processed, and your rights.
By installing and using the Extension, you agree to the practices described in this policy.
2. Data Collection
The Extension is designed to operate entirely on your local machine. We have designed it with a zero-data-collection-by-default principle.
- No personal information — The Extension does not collect, transmit, or store your name, email address, IP address, or any personally identifiable information.
- No browsing history — We do not track, log, or transmit the websites you visit, the content of pages you browse, or any browsing patterns.
- No form content — The Extension reads form field metadata (element types, names, IDs, CSS selectors) solely to determine how to fill them. The actual data you enter or fill into forms is never transmitted anywhere.
- No advertising or analytics — The Extension contains no third-party analytics SDKs, tracking pixels, advertising libraries, or telemetry of any kind.
3. What Data Is Processed Locally
The only data processed by the Extension — all of which stays on your device — includes:
- Field metadata: HTML element attributes (name, id, type, class, placeholder) of form fields on pages where you activate the Extension. This is used exclusively to match fields to your saved profiles.
- Profile configurations: The form fill profiles you create (field value mappings, profile names, presets) are saved locally via
chrome.storage.local.
- Extension preferences: Your settings such as theme preference, default profile, and keyboard shortcuts.
4. Data Storage & Sync
- Local storage: All profiles and settings are stored in your browser's local storage area (
chrome.storage.local). This data persists across browser sessions but never leaves your device unless you explicitly take action.
- Chrome Sync: If you are signed into Chrome and have Chrome Sync enabled, you may choose to sync your profiles via Chrome's sync infrastructure. In that case, your data is handled according to Google's Privacy Policy. FormWizard does not initiate or control this sync — it is governed entirely by your Chrome settings.
- Export/Import: You may export your profiles as a JSON file (manual action). That file is yours to store, share, or transfer. We have no access to exported files.
5. Permissions Explained
The Extension requests the following Chrome permissions, each used strictly for core functionality:
storage — Required to save your profiles, presets, and preferences to your browser's local storage. Without this permission, the Extension cannot remember your settings between sessions.activeTab — Required to read form field metadata from the currently active tab, but only when you explicitly click the Extension icon or press its keyboard shortcut. The Extension does not read tabs in the background.scripting — Required to inject the autofill logic into the page when you choose to fill a form. The injection occurs only on your explicit action.alarms — Used optionally to check for extension updates. No data is transmitted.
We do not request or use tabs, webRequest, cookies, history, bookmarks, or any permission that would allow access to your browsing activity beyond the active tab at the moment of use.
6. Third-Party Services
The Extension does not integrate with any third-party services, APIs, CDNs, or external resources at runtime. All extension code runs locally from the installed package. There are no external network requests made by the Extension except:
- Update checks: Chrome's built-in extension update mechanism (manifest version check) — this is handled entirely by Chrome, not by our code.
- Webhook calls: If you explicitly configure a webhook URL in your profile settings, the Extension will send a POST request to that URL when a form is filled. This is an opt-in feature; no webhook is called unless you configure one. You control the destination URL entirely.
7. Security
We follow security best practices for browser extension development:
- All code is statically analyzed before release.
- No dynamic code execution (
eval, innerHTML, remote scripts).
- Content scripts use a strict CSP (Content Security Policy).
- We use the least-privilege principle for permissions — only what is absolutely necessary.
8. Your Rights (GDPR & CCPA)
Depending on your jurisdiction, you may have the following rights regarding your data:
- Right to know — You have the right to know what personal data is collected about you. As detailed above, we collect none.
- Right to deletion — Since all data is stored locally in your browser, you can delete it at any time by uninstalling the Extension or clearing your browser's local storage.
- Right to data portability — Your profiles are yours. Export them anytime via the Extension's export feature as a JSON file.
- Right to non-discrimination — We do not discriminate against users who exercise their privacy rights.
Because the Extension does not collect or transmit personal data to our servers, there is no personal data for us to delete or provide upon request. All your data is on your device, under your control.
9. Children's Privacy
The Extension is not directed at children under 13 (or under 16 in the EU/UK). We do not knowingly collect any data from children. If you believe a child has provided us with data, contact us immediately and we will delete it.
10. Changes to This Policy
We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
Material changes will be communicated via the extension's update notes in the Chrome Web Store.
11. Contact
If you have questions, concerns, or requests regarding this privacy policy or your data, contact us: