Last updated: 31 August 2026
OneFill fills paper forms using details you have saved about the people in your life.
details — all of it stays in OneFill's private storage on your device.
server and on to OpenAI, used to answer one request, and not kept by us.
The rest of this document is the precise version.
OneFill is published by Michael Reizelman. Contact: michael.reizelman14@gmail.com.
Everything you enter about a person is stored only in OneFill's private storage on your phone, and is never transmitted to us:
We never receive this information. It is not backed up to us, and Android system backup is switched off for the app, so it is not copied off your device that way either.
Uninstalling OneFill deletes all of it. Deleting a person or a saved form inside the app removes that record from your device permanently.
To work out what a form is asking for, OneFill sends the photograph of the page.
It goes to our server, which passes it to OpenAI for reading. Alongside the image we send only a minimal roster describing which people exist:
p_1),child, teen, adult, senior),self, child).No names, dates of birth, ID numbers, or saved answers are ever sent. That is enforced by the structure of the request, not by policy alone. The reply describes only what each field on the page asks for and where it sits — it never contains an answer.
Please note: if you photograph a form that has already been filled in, whatever is written on that page is part of the image and will be sent. If a page contains information you do not want transmitted, do not scan it.
written to disk. Our service has no database. Request and response bodies are excluded from our logs; we record only counts and timings.
period for abuse monitoring under their own terms, which govern that processing. We do not permit it to be used to train models.
| Service | Purpose | What it receives |
|---|---|---|
| OpenAI | Reads the form page | The page image and the minimal roster above |
| RevenueCat | Manages subscriptions | Purchase and subscription status, tied to a randomly generated anonymous ID — not to your name or email |
| Google Play Billing | Processes payment | Handled by Google under Google's own privacy policy; we never see your payment details |
| PostHog (if enabled) | Product analytics, EU-hosted | Subscription screen events only — which plan was viewed or purchased. It cannot carry names, form contents, or answers; screen recording and screen-view tracking are switched off |
We use no advertising SDKs, no ad identifier, and no crash-reporting service.
Where GDPR or UK GDPR applies, we process the form image to deliver the service you asked for (contractual necessity), and purchase data to meet our obligations to you.
Because we hold no account and store nothing about you on our servers, most access, correction and erasure requests are satisfied on your device: the data is yours, held locally, and you can delete any of it at any time. For anything else, contact michael.reizelman14@gmail.com.
OneFill is for adults. It is not directed at children, and children should not use it.
An adult may of course store details about a child — that is a core purpose of the app. That information is treated exactly like all other saved data: it stays on the device and is never transmitted. Only the age bracket (for example child) is ever sent, and only so the app can tell a parent from a child on a form.
Traffic between the app and our server uses HTTPS; release builds cannot make unencrypted connections. On your device, saved data is held in the app's private storage, which Android isolates from other apps and encrypts at rest as part of device encryption. Keep a screen lock on your phone — it is what protects that data if the device is lost.
Our server keeps IP addresses briefly and only in memory, purely for rate limiting. They are never written to disk and disappear when the service restarts.
If this policy changes materially we will update the date above and note the change in the app.