FormOS
Create account

Last updated 23 October 2026

Privacy Policy

FormOS keeps your documents in a private vault, reads them for you, and uses them to fill forms. This page explains what we collect, why, who handles it, and the choices you have.

01Who we are

FormOS is a document vault and autofill service run from Pune, Maharashtra, India. In this policy, "FormOS", "we" and "us" mean the people who operate the FormOS website, web app, Chrome extension and WhatsApp assistant.

For questions about your data, write to hello@formos.ai.

02What we collect

Information you give us

  • Account details: your name, email address, optional phone number, and a 6-digit PIN. We store only a hashed form of the PIN, never the PIN itself.
  • Documents: the files you upload or send (for example an Aadhaar card, PAN card, licence, passport or marksheet), the text read from them, and the fields found in that text (name, date of birth, document numbers, address and so on).
  • Corrections: any detail you edit by hand.
  • Messages: questions you ask in the app chat or on WhatsApp, and the files you send there.
  • WhatsApp number: the number you link and verify so the assistant can recognise you.
  • Contact form: what you write to us. The form opens your own email app, so we receive it only if you send it.

Information collected as you use FormOS

  • Sign-in and security records: device name and identifier, sign-in times, IP address and approximate browser details, used to keep your account safe and to show you your active sessions.
  • Authenticator data: your authenticator secret (stored encrypted) and recovery codes (stored hashed).
  • Sign in with Google or GitHub: if you use either, we receive your name, email address and account identifier from that provider. We do not receive your password for it.

We do not use advertising trackers or analytics cookies, and we do not sell your data.

03How we use it

  • To store your documents and read the details in them.
  • To answer your questions and fill forms using those details, in the app, in the Chrome extension and on WhatsApp.
  • To check eligibility for jobs, scholarships and schemes when you ask.
  • To sign you in, send you verification and PIN reset codes, and protect your account from misuse.
  • To keep the service running, fix faults, and meet legal duties.

We use your details for these purposes and not for advertising. Our staff and administrators can see account information such as your name, email, role and activity, and can manage accounts. They cannot see the contents of your documents, the personal details read from them, or your authenticator secrets.

04Security V1 and Security V2

You choose how your documents are protected.

  • Security V1: files are stored privately on our storage provider and are served to you only after you sign in. FormOS reads them on our servers so it can extract details quickly. Sensitive values such as Aadhaar and PAN numbers are masked until you confirm it is you.
  • Security V2: your files and the details read from them are encrypted on your own device with a key made from your PIN, before they reach us. We store only the encrypted result and cannot read it. Because we cannot read it, V2 documents are never sent to an outside AI service, and a lost PIN cannot be recovered by us.

Other protections include a re-authentication step before sensitive actions, authenticator-based two-step sign-in, rate limits and lockouts on wrong guesses, and private storage with no public file links. No system is perfectly secure, so please keep your PIN and recovery codes private.

05Who else handles your data

We use a small number of service providers to run FormOS. They process data only to provide their service to us.

  • Cloud hosting and file storage: Cloudflare R2 holds uploaded files, and MongoDB holds account records and extracted details.
  • AI services: for Security V1 accounts, document text and your questions may be sent to AI providers (currently OpenRouter and CleanAPI, and the models they route to) to read documents, tidy extracted fields and answer questions. For Security V2 accounts we do not send your document contents to them. Where numbers or emails would be involved, V2 requests are blocked from the AI path.
  • Email delivery: Brevo sends our verification and reset emails.
  • Sign-in providers: Google and GitHub, only if you choose them.
  • WhatsApp: messages you exchange with the assistant travel through WhatsApp, which has its own privacy policy. The assistant answers only from a number you have linked and verified.

We may also disclose information if the law requires it, or to protect the safety of people or of the service. We do not sell personal data.

06WhatsApp and the Chrome extension

WhatsApp. Files you send to the FormOS number are saved to your vault. Details such as Aadhaar and PAN numbers are shown masked unless you confirm with your PIN in the chat. Anyone who can see your chat can see what is in it, so protect your phone, and delete PIN messages after sending them. Documents sent to you from the app go only to your own verified number.

Chrome extension. The extension asks our servers for your saved details when you press a fill button and puts them into the form on the page you are viewing. It stores a sign-in token and a device identifier in your browser, and it does not read or send the content of the pages you visit.

07How long we keep it

We keep your account and documents until you delete them or ask us to delete your account. You can delete any document yourself in the app, which removes the file and the details read from it. Sign-in and security records are kept for a limited time for safety and audit purposes. Backups and logs may take a short while longer to clear. Some records may be kept longer where the law requires.

To delete your whole account, write to hello@formos.ai from the email address on the account.

08Your rights and choices

You can see your documents and the details read from them in the app, correct them, download the originals, and delete them. Under the Digital Personal Data Protection Act, 2023 and other laws that apply to you, you may also ask us to:

  • tell you what personal data we hold about you and how it is used;
  • correct or complete it;
  • erase it and close your account;
  • withdraw consent you gave, for example to WhatsApp access to an encrypted vault, which you can switch off at any time in the app;
  • send a grievance to us and, if you are not satisfied, to the Data Protection Board of India.

Write to hello@formos.ai and we will reply within a reasonable time. We may need to confirm it is really you first.

09Cookies and browser storage

FormOS keeps a sign-in token, a device identifier and your light or dark choice in your browser's own storage so the site works and remembers you. These are needed for the service and are not used to follow you across other websites. You can clear them from your browser settings, which signs you out.

10Children

FormOS is for people aged 18 and over. If you are younger, a parent or guardian must set up and manage the account. If you believe a child has given us personal data without a parent's consent, write to us and we will delete it.

11Changes to this policy

We may update this policy as FormOS changes. When we make an important change we will tell you in the app or by email, and the date at the top will change. Using FormOS after a change means you accept the updated policy. Our Terms of Service explain the rules for using the service.

12Contact us

FormOS, Pune, Maharashtra, India. Email hello@formos.ai.

Also read our Terms of Service.