Refill — Privacy Policy

Last updated: 3 July 2026

Refill is a browser extension that fills in web forms using a profile you write yourself or that is saved from forms you fill in. This page explains exactly what data the extension touches, where it goes, and what it never does.

What Refill stores

• Your profile — whatever you type or paste on the options page (e.g. name, email, phone, address, preferences), plus any fields it later learns automatically from forms you fill in and submit yourself.
• Your AI provider API key — the Groq or Mistral key you paste in during setup ("bring your own key").
• Error logs — only if you turn on Testing mode (off by default), for your own debugging.

All of this is stored using your browser's local extension storage (chrome.storage.local), on your own device only. There is no server operated by us, and we never receive, see, or have access to any of it.

What gets sent to a third party, and why

Refill is "bring your own key": you choose either Groq or Mistral as your AI provider and supply your own API key for it. The only data that ever leaves your browser is sent directly from your browser to that provider's API, using your key, for these specific purposes:

• When you save your profile, the text you wrote is sent so the AI can turn it into structured fields (name, email, etc.).
• When you click "Fill this page" or use "Paste answers", your structured profile data and the labels of the form fields on the current page are sent so the AI can decide what value belongs in which field.

This request goes straight from your browser to Groq's or Mistral's own servers — it never passes through us or any server we operate. We don't see the contents of that request or its response. See Groq's or Mistral's own privacy policy (whichever you choose) for how they handle API requests.

Your API key is sent only in an HTTPS request header directly to your chosen provider's API. It is never logged, never included in a URL, and never sent anywhere else.

What Refill deliberately ignores

Values that look like passwords, credit card numbers, CVVs, national ID/SSNs, or passport numbers are actively filtered out and never saved to your profile, even if they were typed into a form you submitted. Password-type fields are excluded outright.

Your control over your data

Nothing expires automatically. You can delete any individual saved field, or clear your entire profile, from the options page at any time — this is immediate, local, and permanent. Uninstalling the extension removes everything Chrome stored for it.

What we don't do

We don't sell or rent your data, run ads, use analytics or tracking scripts, or share anything with data brokers. We don't operate any backend server that your data passes through.

Children's privacy

Refill is not directed at children under 13, and we don't knowingly collect data from them.

Changes to this policy

If this policy changes, the "Last updated" date above will change too.

Contact

Questions or concerns: jstephens650@gmail.com