Privacy Policy

Operator and contact

Forms by WithFlows is operated by Lukasz Sopocko. For support, access, correction, or deletion requests, contact lukasz.sopocko@gmail.com.

Your choice to use cloud processing

Forms turns text you choose into suggestions for a web form. Before your first extraction, the extension asks you to allow cloud processing. After that, a keyboard shortcut in a form starts extraction. You can turn cloud processing off in the extension popup or Settings. This stops future extraction and mobile delivery to that extension and discards its pending preview.

Suggestions appear in a private extension panel over the webpage, with the toolbar popup available as a fallback. You choose the fields to fill. Approved values become available to the website, which handles them under its own privacy policy. Undo can restore unchanged fields for up to five minutes; it cannot retract information the website has already received.

What is sent for extraction

The extension sends your selected clipboard or mobile text, field names and labels, input types, hints, required flags, select choices, section labels, and bounded page context to the Forms API. Page context includes the page title, URL origin and path, form label, section legends, and step indicator. URL query strings and fragments are removed; paths and labels can still contain personal information. The Forms API forwards this extraction input to Groq for AI processing. Mock fills send form metadata and context to generate fictional examples.

The extension does not continually read your clipboard. It reads clipboard text only after you invoke the shortcut and choose the clipboard source, with cloud processing enabled. Existing field values are kept in the extension's temporary preview to show replacements and support Undo; they are not included in the extraction request body. Field hints or labels may themselves contain information supplied by a website.

Password, payment-card, and one-time-code controls and unsupported field types are excluded where they can be identified. Do not send secrets or information you are not permitted to share.

Mobile scans

The iOS app recognizes text from a scan on the device. When you choose to send that text, it passes through the authenticated Forms API to your signed-in extension. The API keeps an undelivered scan in memory for up to five minutes; delivered text is kept temporarily by the extension for up to five minutes. Delivery is best effort and can be lost on an API or browser restart. Other open tabs receive an availability notice, not the scanned text.

Accounts, payments, and service records

Clerk handles sign-in and account data, such as your email, name, and session identifiers. Extension access and refresh tokens live in browser session storage, restricted to extension pages and cleared on local sign-out or browser restart. Stripe handles payment details and subscriptions. Forms stores account identifiers, subscription identifiers, plan status, usage counters, webhook event identifiers, and short-lived abuse-prevention counters in its service database. We do not receive full payment-card details.

Preferences, your cloud-processing choice, and local usage totals are stored in the browser. Some preferences use Chrome sync if you enable browser sync. Temporary previews contain suggested and existing field values and are usable for up to five minutes; they are discarded on access after expiry, on account changes, on withdrawal of consent, or when you discard them. Browser session storage is cleared on restart.

Retention and service providers

The Forms API does not intentionally persist extraction source text or AI results in its database or application logs. Text remains in memory while a request or mobile delivery is processed. Account, subscription, and usage records remain until deletion or applicable billing obligations permit removal. API infrastructure may retain operational metadata such as IP addresses, timestamps, routes, status codes, and errors. Retention and processing by Groq, Clerk, Stripe, and hosting providers are governed by their terms and our configured service settings; we do not promise zero retention by these providers.

Provider policies: Groq, Clerk, Stripe, Fly.io, and Netlify. These services may process data outside your country.

Permissions and limited use

Access to HTTP and HTTPS pages enables the form shortcut, field detection, mobile availability notice, and approved filling. Clipboard access reads text you choose to process. Identity access supports sign-in. Storage keeps preferences and sessions. Active-tab access lets the popup show and disable Forms on the current website. API host access connects the extension to the Forms service. No remote JavaScript is downloaded and executed by the extension.

We use extension data to provide the described features, manage subscriptions, support users, and prevent abuse. We do not sell extension data, use it for personalized advertising, or use it to train our own general-purpose AI models. Our use of data accessed through Chrome APIs follows the Chrome Web Store User Data Policy, including its Limited Use requirements. AI processing providers handle submitted input under their own applicable service terms.

Your controls and changes

You can discard a preview, clear pending mobile text, disable Forms on a site, turn off cloud processing, sign out, or remove the extension. Removing the extension deletes its local browser data, but does not cancel a subscription or delete server-side account records. Use the billing portal to manage your subscription and contact the operator to request account deletion. We will explain any records that must be retained. Material changes to processing will be reflected in this policy and, where applicable, a renewed in-extension consent request.