Privacy Policy — Lero Lero – Form Filler

After the user invokes the extension on a page, it can read metadata necessary to detect and fill form controls, including field type, label, name, id, placeholder, autocomplete metadata, accessibility labels, selectors, validation constraints, select options, and radio or checkbox values.

The visual Profile Editor intentionally does not capture the current text value of text inputs or textareas in its inspection snapshot. Some non-text form metadata, such as available select or radio values, can be included because it is required to configure and preview filling rules.

This website and form metadata is not sent to the Lero licensing API.

After the user invokes the extension, it uses the current page URL locally to resolve which saved profile applies to that page and to create URL matching rules. It does not request Chrome history access, maintain a browsing-history database, or send page URLs to the licensing API.

The extension stores user settings and profiles in chrome.storage.local. Profiles may contain URL matching rules, CSS selectors, generator choices, templates, dependencies, and fixed values entered by the user.

A user can choose to place personal information in a fixed value or template. If they do, that value remains local to their Chrome extension storage unless the user explicitly includes that information in an AI request or submits the filled form to the website they are using.

When Pro licensing is enabled and the user activates a license, the extension stores the following information locally:

For activation, validation and refresh, and status, the extension sends the license key, installation identifier, and basic platform information (operating-system family and processor architecture) to the Lero licensing service at https://lero.hewerthomn.com. Deactivation sends the license key and installation identifier. The service stores the installation identifier as a SHA-256 hash. Platform information is used only to help the user distinguish active installations. The extension does not send the full User-Agent, hostname, browsing history, form contents, or profile data for this purpose.

Pro can connect to Ollama running locally on 127.0.0.1:11434 or localhost:11434, Google Gemini, and a user-selected HTTPS API that implements the supported OpenAI-compatible /models and /chat/completions contract.

Remote-provider API keys are stored separately from profiles and settings in extension-origin IndexedDB. The SecretRepository encrypts secret values locally with AES-256-GCM using a non-extractable Web Crypto key generated for the extension origin. Secrets are not included in profile or configuration exports, licensing requests, provider descriptors exposed to webpage scripts, or logs.

Non-secret provider settings such as model selection, enabled state, and a configured OpenAI-compatible base URL can be stored locally in chrome.storage.local.

Lero Lero does not send form data to an AI provider merely because a provider is configured. When the user explicitly invokes an AI-assisted action, the extension may send the prompt and the minimum field or form context required for that requested action directly to the selected provider.

For Guided Fill, this bounded metadata can include the field label, semantic or control type, text locale or style, validation constraints, and format guidance derived from an HTML pattern or placeholder. Structured placeholders are reduced to a format mask where possible; natural-language placeholder guidance is treated as bounded untrusted metadata.

For Gemini and OpenAI-compatible remote providers, that content leaves the browser and is processed by the provider under the provider’s own terms and privacy policy. The Lero licensing backend is not in this data path and does not receive the provider prompt, response, or API key.

For Ollama, requests are sent only to the explicitly enabled local loopback endpoint. Lero Lero has no internet fallback when Ollama is selected.

The visual field picker and Profile Editor may keep a temporary page-inspection snapshot in chrome.storage.session, including field metadata and source tab or window identifiers needed to return to or highlight the selected field. Guided Fill keeps current form values only in transient page or runtime state needed to perform the active fill interaction. These values are not persistently captured by default.

Generated names, addresses, identifiers, text, dates, emails, and other fictitious values are created locally unless the user explicitly chooses an AI-backed generation action. Values inserted into a webpage are not sent to the developer and are not persisted by the extension merely because they were generated or filled.

Website and form data is used only to provide the extension’s disclosed form-filling features: detecting fields, generating suitable fictitious values, applying user-configured rules and templates, resolving local profiles, previewing or highlighting rules, Guided Fill, and optional user-invoked AI assistance.

License and installation data is used only to confirm Pro entitlement, enforce the allowed activation count, refresh the signed entitlement, and deactivate an installation when requested.

BYOK provider credentials are used only to authenticate direct requests to the provider selected by the user. AI request content is used only to fulfill the specific AI action the user invokes.

Lero Lero does not use handled data for advertising, profiling, creditworthiness, unrelated marketing, or behavioral analytics.

Lero Lero does not sell, rent, or transfer handled data to advertisers or data brokers.

A Pro-enabled build sends licensing data described above only to the first-party Lero licensing service at https://lero.hewerthomn.com.

When the user explicitly invokes a remote AI action, request content is sent directly to the selected third-party AI provider for app functionality. Provider API keys are sent only to their corresponding configured provider and are never sent to the Lero licensing service.

Stripe may separately process purchase and payment data on Stripe-hosted Checkout. Payment-card data does not pass through the Chrome extension.

The extension requests the following Chrome permissions:

A production Pro-enabled package additionally requests https://lero.hewerthomn.com/* as its mandatory host permission so trusted extension contexts can call the licensing API. It does not use <all_urls> for licensing.

AI network access is optional and requested only when the user enables a provider. Ollama loopback origins are optional, Gemini uses https://generativelanguage.googleapis.com/*, and the generic OpenAI-compatible feature requests only the exact HTTPS origin selected by the user at runtime.

Optional AI host access is not used to obtain persistent browsing access to websites. Normal page and form access continues to use activeTab after a user gesture.

The extension does not request the history, cookies, downloads, identity, or broad tabs permissions for these flows.

The extension uses Manifest V3, does not use remotely hosted executable code, and does not use eval or new Function. Scripts injected through chrome.scripting are packaged inside the extension. AI and licensing responses are treated as data, not executable code.

Pro entitlements are cryptographically signed by the Lero licensing service using RSA-SHA256. A production package pins only the corresponding public verification key; the private signing key remains on the server and is never included in the extension package.

Provider secrets stay in trusted extension contexts. AI provider modules and licensing credentials are not injected into webpage execution contexts.

Lero Lero – Form Filler uses data obtained through Chrome extension capabilities only to provide or improve its disclosed single purpose and user-facing form-filling, Pro licensing, and explicitly invoked AI-assisted form-filling features. Its use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

For questions about this policy, use the support or contact channel published on the Lero Lero – Form Filler Chrome Web Store listing.