OneTap — Privacy Policy

Last updated: June 18, 2026

OneTap is a Chrome extension that fills checkout forms with one tap. We built it privacy-first: your personal details are encrypted and stored only on your own device, and we never collect, sell, or share your data. This policy explains exactly what data is involved and where it goes.

What OneTap Collects

To detect and map the fields on a checkout page, OneTap sends a small amount of structural metadata about the form to our server for AI-powered field mapping:

Field labels, input types, and structural information (e.g. label: Email, type: text, placeholder: Enter email)
The page's hostname and path, used to cache the field layout so future fills are instant

This metadata contains no personal data. It describes the shape of the form — never the values you would type into it. Your name, address, and card details are not part of this request.

What OneTap Stores Locally

Everything personal stays on your device, encrypted:

Your profiles (names, email, phone, addresses, card details) are encrypted with AES-256-GCM and stored only in your browser's local storage.
The encryption key is derived from your master password using PBKDF2-SHA256 (600,000 rounds). The password itself is never stored anywhere.
An AI field-mapping cache is kept in session memory only and is cleared automatically when Chrome closes.

What OneTap Sends to Servers

Only form field metadata — labels, types, and structure — is ever sent over the network.
Card numbers and CVVs are explicitly sanitized to placeholders (e.g. [CARD PRESENT - 16 digits]) before any network request. The actual digits never leave your device.
Your names, addresses, emails, and phone numbers are never transmitted.

What OneTap Does NOT Do

Does not track your browsing history
Does not collect analytics or telemetry
Does not share your data with third parties
Does not serve ads
Does not sell any user data
Card numbers never leave your device

Data Storage Summary

All personal data is stored locally on your device, encrypted.
No user data is stored on OneTap's servers.
The only server communication is sending form-structure metadata for field detection.

Permissions

OneTap requests only the permissions it needs to work:

storage — to save your encrypted profiles on your device.
scripting — to place the autofill button and fill fields on the current page.
Host access (<all_urls>) — so one-tap checkout works on any e-commerce site you visit. OneTap only acts on a page when you click it.

Changes to This Policy

If this policy changes, we'll update the date at the top of this page. Continued use of OneTap after an update means you accept the revised policy.

Contact

Questions about your privacy? Email us at support@getonetap.co.

OneTap Privacy Policy