Privacy

One user-chosen value, for one active transfer

Remote Fill handles only the destination context and value needed to move text into the field the user explicitly selects.

Effective 2026-10-07 · Protocol version 5

Single purpose

Insert one selected value without synchronizing a vault

The extension can transfer a value into one selected Chrome field or locally generate and deliberately insert a password into one focused supported field. The web receiver can instead place a transferred value into the clipboard only after a deliberate user action. The separate website password generator creates a value locally without starting a transfer. None of these modes provides advertising, analytics, identity, credential storage, browsing-history collection, or background page inspection. A separate no-data presence marker runs only on the product home and extension test pages.

Data handled

What the product processes

User-selected value: The phone temporarily processes the text the user chooses to send. That value may contain personal information, authentication information, or other website content. It is encrypted on the phone before upload and decrypted only by the selected desktop endpoint: the extension for field insertion or the web receiver for deliberate copying. The browser and operating system control their clipboard after a web copy.
Locally generated password: The website generator, password-transfer page, and extension popup can generate a password or passphrase with browser cryptographic randomness and an embedded word list. The generated value and optional personal seed are not sent to the Remote Fill relay or stored in extension or browser storage. The extension popup keeps its generated value only while the popup remains open and inserts it directly only after the user presses Fill field directly. The extension generator never reads from or writes to the clipboard and never invokes copy or paste, avoiding a generator-created clipboard-history entry. The destination page can then read the inserted value and may prompt an installed password manager after its own save or submit step. The standalone website generator's copy remains only until the user regenerates, clears, reloads, or leaves; its separate, deliberate Copy action creates a clipboard copy controlled by the browser and operating system, which the page cannot reliably erase. During a password transfer, the server receives only the encrypted transfer envelope; an unedited generated value may remain visible in the open phone page for up to two minutes after Send so the user can save it, and can be copied or cleared earlier.
Destination context: The extension uses the active page origin and field type. In web mode, the user may enter a destination website and choose a value type. The context is authenticated end-to-end, shown to the phone, and carried only in the QR fragment or an encrypted remote-share envelope; it is excluded from the relay reservation schema.
Remote-share metadata: When web transfer displays its share option, the relay temporarily processes an eight-character code, deployment slot, ephemeral public keys, capability hashes, request identifier, and an opaque encrypted invitation. The code and pending requests expire with the transfer and are not written to persistent storage.
Installation test marker: Only on / and /test, the extension sets the literal value installed so the product page can offer testing and the test page can display whether it is ready. The marker sends no extension ID, version, account, browsing history, selected-field data, or security authority and creates no separate request.
Transfer metadata: Short-lived random route, expiry, capability hashes, presented bearer capabilities, cryptographic public material at the endpoints, and opaque encrypted envelopes are processed to operate the transfer. No account or persistent user identifier is created.
Connection metadata: Hosting and network providers necessarily process routine connection information such as IP address, timing, and HTTP delivery metadata to deliver the website and service. The extension normally reaches the relay through remotefill.com and may retry the same reservation through the API-only rf.asanowharton.com fallback when the primary transport cannot be established. QR codes, share links, phone pages, and authenticated transfer context remain on remotefill.com. Remote Fill disables application and origin access logging for transfer requests and does not use connection metadata for advertising or profiling.

Use, sharing, and retention

No sale, advertising, or unrelated reuse

Data is used only to provide, secure, and troubleshoot the user-requested transfer.
Hosting and network providers process encrypted traffic and routine connection metadata only as necessary to operate the service. Remote Fill does not sell transferred data or share it with advertisers, data brokers, or unrelated third parties.
The active relay state is held in memory, works once, and expires within two minutes. The service creates no recoverable transfer history and intentionally persists no transferred plaintext.
Humans are not given access to transferred values. Support and vulnerability reports must use synthetic examples and must not include passwords, private keys, capability tokens, or other sensitive content.

Chrome Web Store Limited Use

Use is limited to the disclosed transfer

Remote Fill's use of information received through Chrome extension APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Information is used only to provide or improve the single user-facing transfer purpose, is not used for personalized advertising or credit decisions, and is not sold.

User control

Start, cancel, copy, or let it expire

A transfer begins only after the user chooses a field in extension mode or creates a QR in web mode. Web mode may also show a short-lived share link representing the same invitation. Opening that link starts the encrypted rendezvous for that browser; entering the code manually requires Continue. The sender must review a recipient warning before Send. The desktop can cancel while the invitation is visible. The phone clears the transfer input when Send is pressed. A generated, unedited password is the sole exception: its local display remains for at most two minutes after Send, or until the user clears or reloads the page. The standalone generator has no transfer lifecycle: regenerate replaces its value, and Clear, reload, or leaving removes it from the page. The relay removes encrypted envelopes after delivery or expiry. The extension never submits a destination form. The web receiver hides the value by default, automatically clears it after one minute, and overwrites its mutable copy immediately after a successful clipboard write.

For privacy or technical questions, email contact@asanowharton.com or use the support page. For suspected vulnerabilities, follow the security reporting guidance. This policy will be updated before any material change to data handling is released.

Use only what you are authorized to transfer

By using Remote Fill, you agree to transfer only values and access accounts you are authorized to use. You may not disrupt the service, attempt unauthorized access, or use it unlawfully.

Except where applicable law does not permit this restriction, and unless Asano Wharton, LLC gives prior written permission, you may not reverse engineer, decompile, disassemble, translate, adapt, copy, modify, create derivative works from, or use the service, software, protocol, or documentation to discover or reproduce its source code, object code, algorithms, security mechanisms, or underlying structure. Public availability of code or documentation does not grant a license to use, reproduce, or commercialize it. Nothing in this paragraph restricts rights that cannot lawfully be waived, including qualifying interoperability activity or good-faith security research conducted within applicable law and the published security-reporting guidance.

You are responsible for confirming the destination, reviewing the inserted value, and choosing whether to submit the destination form. Remote Fill does not authenticate the destination website, guarantee that a transfer will complete, or control what the destination does after insertion.

The service is provided on an “as available” basis and may be changed, suspended, or withdrawn. To the fullest extent permitted by law, Asano Wharton, LLC disclaims implied warranties and liability for indirect or consequential loss arising from use of the service. These terms are governed by Ohio law. Questions may be sent to contact@asanowharton.com.