Snapshots are stored locally and collected only when you press Collect. Free use includes unlimited snapshots and fills plus JSON backup. Premium adds optional cross-device sync through your browser account; no form data is sent to us.
Last updated: October 2026
VKT Form is a browser extension that saves and fills web form data. By default, all data is stored locally in your browser using storage.local, and no data is uploaded to any server. Premium users can optionally turn on cross-device sync, which stores snapshots in their browser account's built-in sync service, operated by the browser vendor (Google for Chrome, Microsoft for Edge, Mozilla for Firefox). We do not operate a sync server, and we never receive your snapshots.
VKT Form collects the following data only when you manually click the "Collect" button:
Important: The extension does NOT automatically collect any data. All scanning is user-initiated, and the scan runs only on the tab you are looking at.
By default, everything the extension stores lives in your browser's storage.local, under these keys:
| Storage Key | Content |
|---|---|
vkf_records | Your saved form snapshots, keyed by the snapshot name you choose. Each snapshot holds: its name, the normalized URL and raw URL of the page, creation and last-update timestamps, a field count, and the field entries (name, id, type, value, collection-time structural hints, DOM order index, hidden flag) |
vkf_license_vktform | Your license key, its activation status and expiry, and a randomly generated install identifier used to count activation slots |
vkf_settings | Your preferences — keep the URL hash when matching snapshots, type through the debugger API for framework-rendered forms, and whether cross-device sync is enabled |
vkf_tombstones | Deletion markers (snapshot name and deletion time) created when you delete a snapshot, so the deletion can propagate to your other devices. Entries are pruned after about 180 days |
vkf_sync_meta | Local sync status: the time of the last sync attempt and the last error, if any. This item is not uploaded |
Local data is never transmitted externally unless you turn on Premium cross-device sync. The export/import feature simply writes a JSON file to your own disk and reads one back — that file never leaves your machine unless you move it yourself.
Cross-device sync is off by default. It requires an active Premium license and must be enabled by you in Settings → Cross-device sync. It uses storage.sync, the browser's own sync facility, which is operated by your browser vendor and associated with the browser account you are signed in to. We have no access to this data and do not receive a copy of it.
When sync is enabled, the following items are written to storage.sync:
vkf_sync_<hash>_metavkf_sync_<hash>_<revision>_<index>. This includes every captured field value, including sensitive fields, in plain text.vkf_sync_tombstones, so deletions propagate to your other devicesThe browser enforces a quota of 8 KB per item and about 100 KB in total. Large snapshots are split into chunks to fit. If a snapshot does not fit, it remains saved locally and the side panel reports that it could not be synced.
Data in storage.sync is stored and transmitted by your browser vendor under its own terms and privacy policy. It may appear on other devices signed in to the same browser account, subject to the vendor's sync behavior and latency.
Turning sync off stops future syncing but does not erase copies already stored in your browser account. To remove those, delete the snapshots while sync is on, or manage/clear the extension's synced data through your browser account settings.
VKT Form does not filter out sensitive fields. If a password, payment card, one-time code (OTP), or other credential is present as a fillable field on the page when you click "Collect", its value is captured and stored — locally, in your browser, in plain text (it is not encrypted).
If you enable Premium cross-device sync, these values are also uploaded to your browser account's sync service as part of the snapshot, exactly like any other field. They are never sent to our servers.
Please be aware of this when using the extension on pages containing credentials, and prefer deleting the snapshot once you no longer need it. VKT Form is a form-snapshot tool, not a password manager.
| Permission | Reason |
|---|---|
storage | Save form snapshots and settings locally; when Premium sync is enabled, also use the browser's sync storage |
activeTab | Access the current tab only when you click a button |
sidePanel | Display the extension's side panel UI — Chrome / Edge only; the Firefox build shows this interface in the browser sidebar and does not request this permission. |
scripting | Inject the collection/auto-fill script on demand, only when you click a button |
debugger | Read and fill form fields reliably on framework-rendered pages (Vue/React). Used only on the tab you act on, only while the action runs — Chrome / Edge only; Firefox provides no extension debugger API, so this is not available there. |
Host permissions (<all_urls>) | Let the tool work on whichever site you choose to collect or fill forms on. All processing stays local |
The extension uses chrome.scripting and the chrome.debugger API to interact with form fields on the page you are acting on. Form data is never transmitted to our servers. The only requests the extension makes are license-key validation (see below), and — only if you enable cross-device sync — the browser's own account sync. The debugger API is used only on Chrome / Edge; Firefox has no extension debugger API, so that filling strategy is not available there.
License key validation communicates with api.annmax1983.com to verify premium status. The request contains the license key, a randomly generated install identifier, the plugin ID, and basic browser metadata (browser name and major version, interface language, time zone and user-agent string). No form data or browsing history is transmitted. Our license server records the IP address of these requests solely for rate limiting and abuse prevention — never for profiling, advertising, or sharing with third parties.
When cross-device sync is enabled, snapshot data is handled by the browser vendor's account sync service (Google for Chrome, Microsoft for Edge, Mozilla for Firefox). That processing is governed by the vendor's terms and privacy policy, not ours. We do not receive, store, or have access to that data.
You delete snapshots from the extension's side panel — each snapshot row has a delete button, and it asks for confirmation first. (There is no popup UI and no "delete everything" button; snapshots are removed one at a time.)
If sync is enabled, deleting a snapshot also removes it from storage.sync and records a deletion marker so your other devices remove it too. Deletion markers are pruned after about 180 days. If sync is off, only the local copy is deleted; copies already in your browser account are not affected.
To erase local data at once, uninstall the extension — the browser removes its local storage with it. Uninstalling does not guarantee that copies previously synced to your browser account are removed, because that storage is controlled by the browser vendor; delete snapshots while sync is on, or clear the extension's synced data in your browser account settings. No data is retained on our servers, because none was ever sent to them.
If this policy changes, the revised version will be published on this page with a new date. Material changes will be noted in the extension's release notes.
Questions about this policy? Email support@annmax1983.com or open an issue on GitHub.