TurboFill Privacy Policy

Last updated: July 6, 2026

TurboFill is a Chrome extension that helps users fill web forms with AI-suggested values. It uses information the user saves, page context from the current tab, and optionally context from other open or selected tabs.

Information TurboFill Collects

TurboFill may collect and process the following information:

• Account information: Google sign-in identity, including email address, display name, and Firebase user ID.
• Saved personal information: profile text the user enters into TurboFill, such as name, email, phone number, address, and other reusable facts the user wants TurboFill to use for forms.
• Saved instructions: user-written instructions for how TurboFill should fill forms.
• Form submission context: when “Automatically detect new information” is enabled, TurboFill may process an accessibility snapshot of a page where the user submits a form to update saved personal information.

TurboFill does not intentionally collect passwords, one-time codes, payment card numbers, authentication cookies, access tokens from page content, or file uploads for autofill. File inputs are not supported.

How TurboFill Uses Information

TurboFill uses this information to:

• authenticate the user with Google and Firebase;
• prepare AI autofill suggestions for the current page;
• use saved personal information and instructions when generating suggestions;
• use selected or available source tabs as context for a fill request;
• update saved personal information when the user enables automatic detection;
• show account status and free-trial credit usage;
• debug, secure, and operate the TurboFill service.

TurboFill does not sell user data. TurboFill does not use user data for advertising. TurboFill does not transfer user data to determine creditworthiness or for lending purposes.

When Information Is Sent Off Device

When the user runs autofill, TurboFill sends the relevant page context, saved personal information, instructions, and request text to the TurboFill API. The TurboFill API builds the AI request and sends it to the configured model provider to generate suggestions.

When automatic personal-info detection is enabled, a form-submit page snapshot may be sent to the TurboFill API and model provider to decide whether saved personal information should be updated.

Google and Firebase process sign-in, identity tokens, account records, stored settings, and usage records needed to run the service. The TurboFill API uses OpenAI’s Responses API for model calls. TurboFill sets store: false for supported OpenAI Responses API requests.

Improving TurboFill (Optional, Off By Default)

TurboFill includes an optional setting, “Help improve TurboFill,” in Account settings. It is off by default and only takes effect if the user turns it on. While it is on, TurboFill stores the autofill turns the user runs — the page and tab context sent to the model, the model’s suggestions, and whether the user accepted or rejected each suggestion — so that TurboFill’s suggestion model can be improved.

Before anything is stored for this purpose, the text is de-identified using Google Cloud Sensitive Data Protection (DLP), which removes detected identifiers such as names, email addresses, phone numbers, account and ID numbers, and similar values. Only the de-identified result is stored; the original text is not retained for this purpose. This is best-effort de-identification, not guaranteed anonymization. The user can turn the setting off at any time, and can request deletion of stored data (see User Choices).

Storage and Retention

TurboFill stores account records, saved settings, credit counts, and usage metadata in Firebase/Firestore. Saved settings are retained until the user changes them, deletes them, requests deletion, or the service removes them.

TurboFill stores authentication refresh tokens, cached settings, and UI state in chrome.storage.local on the user’s device. TurboFill stores per-tab completion state in chrome.storage.session, which clears when the browser session ends. Uninstalling the extension removes local Chrome extension storage.

Sharing

TurboFill shares information only with service providers needed to operate the product:

• Google Chrome identity and Firebase Authentication for sign-in;
• Firebase/Firestore and Google Cloud Functions for account, settings, usage, and API processing;
• OpenAI for AI model processing.

TurboFill may disclose information if required by law or to protect the security and integrity of the service.

User Choices

Users can:

• edit or clear saved personal information and instructions;
• turn off automatic personal-info detection;
• turn the “Help improve TurboFill” setting on or off (it is off by default);
• choose specific source tabs or run with the default source behavior;
• sign out of TurboFill;
• uninstall the extension to remove local extension storage.

To request deletion of cloud account data or ask privacy questions, contact matthew@turbofill.io.

Security

TurboFill transmits data over HTTPS. The OpenAI API key is stored as a Google Cloud Secret and is not shipped in the extension. Firebase ID tokens are used to authorize TurboFill API requests.

Changes

This policy may be updated as TurboFill changes. The effective date at the top of this policy will be updated when material changes are made.