Privacy Policy
In short.
- Your details, your family's and company's details, your documents, signatures and filled PDFs are stored and read on your iPhone. They are not sent to our servers or to AI. Photos and files of your forms stay on your iPhone too, unless you choose the optional photo restore described below.
- To understand a public blank form, the app sends that blank form — its printed text, field names and layout, with no answers of yours — to an AI model through our server. The AI returns a plan of which kind of detail goes where. Your iPhone fills in the values.
- Photo restore is optional, is part of the paid plan and needs its own consent. If you use it, the one form page you choose, which can show earlier answers written on it, is sent to the cloud so an empty copy can be drawn. The empty copy stays on your iPhone. Your saved details, identity documents, typed answers and signatures are never sent.
- Voice answers are optional and need their own consent. If you turn them on, a short recording of the answer you say is sent for transcription and is not stored on our servers. It can contain whatever you say.
- iCloud backup is optional and goes to your own private iCloud, not to us.
- Purchases go through Apple. RevenueCat records them for us under a random install ID, not your name or email.
- No ads. No tracking. No general app-usage analytics SDKs. RevenueCat provides subscription statistics. We don't sell personal information or share it for advertising. The service providers below process requests for the features you choose.
- Fillsafe is for adults 18 and older.
1. Who we are
Fillsafe: PDF Form Filler ("Fillsafe", "the app") is an iOS app provided by Valerii Loveiko, an independent developer using the Loveiko Labs name ("we", "us"). This policy explains what the app keeps on your iPhone, what it sends, to whom, why, and for how long.
Fillsafe doesn't have accounts. We don't ask for your name, email or phone number to use it.
2. What stays on your iPhone
These are stored on your iPhone, encrypted, with the key kept in the iPhone's Keychain. They are read and used on the iPhone and are not sent to our servers or to AI (the only exception is a form page you choose to send for photo restore, section 5):
- Saved details of you, your family members, children and companies — for example names, addresses, dates of birth, tax and ID numbers.
- Documents you photograph or import (for example a passport, driver's license or bank letter) and the text read from them. Text is recognized on the iPhone with Apple's Vision framework; on iPhones that support it, Apple's on-device models may help sort what was read. This document-reading route sends nothing to AI; optional iCloud backup is described separately below.
- Your forms: photos and files of forms you bring in, their recognized text, your answers, drafts, signatures and finished PDFs.
- Files shared into Fillsafe from other apps wait in an encrypted queue on the iPhone until you import or delete them.
- Your consent record: which version you agreed to, when, and each box separately.
Sensitive fields such as passport or Social Security numbers are optional. The app works without them.
If you turn on Face ID lock, Face ID is handled by iOS; the app only receives "yes" or "no".
3. What is sent, and why
Understanding a public blank form (smart filling)
When you fill a form from Fillsafe's catalogue of official forms, the app first downloads the blank form from the agency's website and checks that the file is exactly the one expected. Only for such an independently downloaded, unfilled public form, and only after you agree on the consent screen, the app sends to our server:
- the blank form's printed text, field names, field types and positions, and images of its pages;
- the form's country and language;
- a copy of the form filled with a fictional person, "Jordan Sample", so the AI can check the layout.
Our server asks an AI model to describe the form and return a plan of which kind of detail goes in which field and in what format (for example "date of birth, MM/DD/YYYY"). The plan contains no values. Your iPhone then fills in your saved details on the device, and you check each answer before it goes into the form.
Never part of this request: your saved details, documents, photos or files of your own forms, their recognized text, your answers or signatures. Before each request the app checks that none of your saved values are inside it and blocks it if they are.
The plan for a public blank form contains no personal details, so we keep it in a shared cache and reuse it to fill the same blank faster for everyone.
Downloading official forms
Forms are downloaded directly from the agency's website, without cookies or IDs. Like any website, the agency's site sees your IP address. If the agency's site doesn't respond, the app asks our server to fetch the same official file by its catalogue number. This request also carries the install ID and IP address used for service limits; it carries no saved profile values or identity documents.
Links you paste
A link you paste is downloaded straight from that site, without cookies, IDs or anything else from the app. A link that contains one of your saved details isn't opened. A form downloaded from a link you pasted is treated as your own file: it is not sent to AI for smart filling.
Service limits
To keep the service fair and costs under control, our server counts requests per day using a random install ID and a salted hash of your IP address. The counts contain no content.
4. Voice answers (optional)
Voice answers are off unless you tick the separate, optional voice box. With it on, when you tap the microphone and stop, the app sends a short recording of the current answer (up to 30 seconds, or 60 for an address or explanation), the kind of answer (for example "date") and the language, through our server and OpenRouter to Google's Gemini model on Google Vertex AI in the United States, to type out what you said.
- The recording can contain personal details you say aloud.
- Your saved details, documents, earlier answers and the filled PDF are not attached.
- We don't store recordings or transcripts on our servers or in logs. The route requires OpenRouter's zero data retention setting and uses no other provider as a fallback.
- The temporary recording on your iPhone is deleted once it has been sent or when you cancel.
- The text is a suggestion: you check and edit it before it goes into the form.
- We don't use recordings to identify you or to build a voiceprint.
You can withdraw voice consent in Settings at any time; requests in progress are cancelled and nothing more is sent. Typing, documents and saved forms keep working.
5. Photo restore (optional)
Photo restore turns a photo or scan of a form, often one already filled in, into an empty copy that you then fill with your own details. It is part of the paid plan, it is off until you agree on its separate consent screen, and Fillsafe works without it.
- What is sent: only the form page you choose and see in a preview, as a JPEG of up to 2000 pixels with camera and location details removed. The page can show earlier answers written on it, and they go with it. If a result needs repair, parts of the same page, the empty copy we drew and a short note, if you write one, may be sent again.
- Never sent: your saved details, identity documents, answers you type and signatures. Your iPhone fills the empty copy with your details locally.
- Who receives it: our server on Cloudflare, then OpenRouter, then Anthropic's Claude Haiku 5.5 on Google Vertex AI in the United States. TypeSafe's Jev model, through OpenRouter, checks the result against the page. The empty PDF is drawn on our own Cloudflare server, without AI.
- Why: only to draw the empty copy and check it. We don't use pages or results to train models, and the route has no other provider as a fallback.
- How long: each request requires OpenRouter's zero data retention setting and denies data collection. We don't store the page or the result. After the answer we keep only hashed IDs, counts and amounts that apply fair-use limits per form, per day and per month. The empty copy is stored on your iPhone with your form, and your original photo stays there too.
- Withdraw: Settings → Restore from photo → Withdraw consent. Requests in progress are cancelled and nothing more is sent. Your forms and saved details stay on your iPhone.
6. iCloud backup (optional)
If you turn on iCloud backup in Settings, an encrypted copy of your details, documents, forms, saved PDFs, signatures and the key to open them is saved in your own iCloud private database (Apple CloudKit), so you can restore on another iPhone. We have no access to it, and our servers and AI never receive it. Apple's iCloud protection applies; with Advanced Data Protection off, Apple's standard data protection applies. Turning backup off keeps the last copy; Settings → Delete the iCloud copy removes it once iCloud confirms.
7. Purchases and the install ID
Subscriptions are sold by Apple. We never receive your card details, name or Apple ID.
- The app creates a random install ID. It isn't linked to your name, email or Apple ID.
- The app reports your purchases to RevenueCat under that ID. RevenueCat tells the app and our server whether your subscription is active, shows us subscription statistics and helps restore purchases.
- Our server sends the install ID with requests so it can apply the limits of your plan.
8. Service providers
These companies help run Fillsafe for the purposes below. Their privacy policies and applicable service terms also describe their processing.
| Provider | What they receive | Why, and where |
|---|---|---|
| Cloudflare | Requests from the app, the install ID, public blank forms, voice recordings if you use voice, form pages if you use photo restore; your IP address | Hosts our server and its cache, and draws the empty PDF for photo restore. United States and Cloudflare's global network. Request logging is off. |
| OpenRouter | Public blank-form requests; voice recordings if you use voice; form pages if you use photo restore | Routes requests to permitted AI model hosts. Requests require zero data retention and data collection denied. OpenRouter is a US-based service provider; routing requirements and endpoint policies apply. |
| Google (Gemini on Vertex AI) | Public blank-form requests; voice recordings if you use voice | To describe public blank forms; this route does not pin a region. Voice answers use the pinned Google Vertex US endpoint. |
| Anthropic (Claude, on Google Vertex AI or Amazon Bedrock) | Public blank-form requests and page images; the form page you choose if you use photo restore | To read the layout of a public blank form and check it with the fictional sample, and, with photo restore, to draw the empty copy. Google and Amazon are US-based providers; the public-form route does not pin a region. Photo restore uses Google Vertex AI in the United States only. |
| TypeSafe (Jev model) | If you use photo restore, the page you sent and the empty copy, through OpenRouter | To check that the empty copy matches the page. Requires zero data retention. |
| RevenueCat | The install ID, purchase and subscription history, App Store country, technical details of requests (such as app and iOS version and IP address) | Subscription status, statistics and restoring purchases. United States. Kept under RevenueCat's terms while we use it, deleted when we ask. |
| Apple | Payment details (from you, through the App Store); your iCloud backup if you turn it on | Payments, subscriptions, iCloud storage. Apple's privacy policy applies. |
Provider policies: Cloudflare · OpenRouter · Google Cloud · Anthropic · Amazon Web Services · RevenueCat · Apple.
We may also disclose information if the law requires it, or to protect someone's safety. If the business is sold or merged, this policy continues to apply to your data.
9. How long data is kept
| Data | Where | How long |
|---|---|---|
| Saved details, documents, forms, signatures, PDFs | Your iPhone | Until you delete them or the app |
| iCloud backup | Your iCloud | Until you delete the iCloud copy |
| Voice recording | Your iPhone, then in transit | Deleted after sending or cancel; not stored on our servers |
| Form page sent for photo restore, and the result | In transit; not stored on our servers | Processed for the request only |
| Hashed IDs, counts and amounts for photo restore limits | Our server | No content. A later request removes old daily and monthly counts; during inactivity there is no fixed deletion deadline |
| Empty copy from photo restore | Your iPhone, with the form | Until you delete the form |
| Confirmed voice answer | Your iPhone, with the form | Until you delete the form |
| Fill plans of public blank forms (no personal data) | Our server's cache | Kept and reused for everyone |
| Layouts of public blank forms (no personal data) | Our server's cache | 180 days |
| Official form files (public) | Our server's cache | 30 days |
| Fill-plan receipts (no personal data) | Your iPhone and our server | 7 days |
| Daily request counts (hashed install ID and hashed IP) | Our server | A later request deletes buckets older than two calendar days. During inactivity there is no fixed deletion deadline |
| Subscription status | Our server | Paid status is valid for up to 6 hours before a recheck (unpaid: 60 seconds). A later successful check removes records expired for more than 7 days. During inactivity there is no fixed deletion deadline |
| Purchase records | RevenueCat | Under RevenueCat's terms while we use it |
10. What we don't do
- We don't sell or "share" personal information for advertising, and we don't track you across apps or websites.
- We don't use advertising, general app-usage analytics or crash-reporting SDKs. RevenueCat provides purchase and subscription statistics as described above.
- We don't send your saved details or identity documents to AI. A page of your own form goes to AI only if you choose photo restore and agree. We don't use any of it to train models. Our AI requests require providers that don't keep the request and don't use it for training.
- We don't give legal, tax or immigration advice.
11. Your choices and deleting data
- AI consent: Settings → AI & Privacy → Withdraw consent. Nothing more is sent; requests in progress are cancelled; everything on your iPhone stays usable, and you can fill fields by hand.
- Voice consent: withdraw it separately under Voice answers.
- Photo restore consent: withdraw it separately under Settings → Restore from photo.
- Delete everything: Settings → Delete everything removes your data from this iPhone. It works offline, keeps the separate iCloud copy, and does not cancel your subscription.
- Delete one person, document or form: swipe or use Delete in My documents or Forms.
- iCloud copy: Settings → Delete the iCloud copy.
- Records kept by install ID (purchases at RevenueCat, daily counts): use Settings → Write to us to request deletion. The draft email includes your install ID, app version, iOS version and app language so we can find your records. Your documents, form answers and recordings are not attached. You choose whether to send the email. Apple purchase records remain subject to Apple’s policies and legal retention requirements.
12. Your privacy rights
Depending on where you live (for example California and other US states, the European Union, the UK), you may have the right to know what personal information we have, to get a copy, to correct or delete it, to object to or restrict processing, and to withdraw consent. We don't sell personal information or share it for cross-app advertising; no advertising opt-out is needed. We won't treat you differently for using your rights.
Most of your data never reaches us: it is on your iPhone (a page you send for photo restore is processed for the request and not stored by us), where you can see and delete it yourself. For what we or our providers hold (purchase records and counts by install ID), write to us from the address below. We'll answer within 30 days, or within the time your law sets. If you're in the EU or UK, you can also complain to your data protection authority.
Legal basis (EU/UK): performing our contract with you (running the features you use), your consent (AI features, voice answers and photo restore, withdrawable at any time), and our legitimate interest in keeping the service secure and within limits.
13. Where data is processed
Data on your iPhone stays on your iPhone. Requests pass through Cloudflare's global network and OpenRouter to Google Vertex or Amazon Bedrock. These are US-based service providers. The public blank-form route does not pin an inference region. Voice recordings and photo-restore pages are routed only to the Google Vertex US endpoint. These services may process data outside your country. Applicable provider data-processing terms and transfer safeguards govern those transfers; contact us for information.
14. Children
Fillsafe is for adults 18 and older and is not directed to children. Parents and guardians may save their children's details to fill in forms for them. Those saved details stay on the parent's iPhone, encrypted, with optional iCloud backup. They are not attached to blank-form AI requests or photo restore. If an adult chooses voice input, the recording can contain the details they say. If you believe a child has used Fillsafe, write to us.
15. Security
Data on your iPhone is encrypted with a key in the iPhone's Keychain, and you can add a Face ID lock. Connections to our server use HTTPS. Our server does not store voice recordings or transcripts. Content logging is off; operational logs can contain the route, model, timing, usage, cost and outcome, without your document contents or answers. Service-limit and purchase-status records are described above. No system is perfectly secure; keep your iPhone protected with a passcode.
16. Test features
Some features, such as searching official websites for a form, are tested only with invited TestFlight testers and are not part of the App Store version. If any of them comes to the App Store version, we will update this policy and ask for consent in the app before it is used.
17. Changes to this policy
We may update this policy and will change the date at the top. If a change affects what is sent or to whom, we ask for your consent again in the app before it applies.
18. Contact
Loveiko Labs · loveykovl@gmail.com