Autofill Extension Privacy Policy

This policy describes the GoRefer Autofill browser extension only, version 1.0.0 (Manifest V3). The GoRefer web application, the public client intake form and every other GoRefer product are covered by the GoRefer Privacy Policy.

Every statement below describes what the shipped extension code actually does.

1. Who the Extension Is For

GoRefer Autofill is a tool for tax professionals. The person who installs it and signs in is a preparer or firm administrator with an existing GoRefer account. The personal information the extension handles belongs to that firm's clients, not to the installing user, and it is information the firm already holds in its GoRefer account.

The extension does not create new client records, and it obtains client data from no source other than the firm's own GoRefer account. It does not operate at all without a successful sign-in.

2. What the Extension Handles

2.1 Sign-In Credentials

Your GoRefer email address and password are sent to GoRefer's API to obtain a session. If your account has two-factor authentication enabled, the one-time code you enter is sent to the same API. Your password is never stored by the extension — it is held in the sign-in form's memory for the duration of the request and is not written to any storage area.

2.2 Your Account Profile

After sign-in the extension holds your user id, email address, display name, role, firm id, firm name and profile-picture URL, together with the access and refresh tokens for the session.

2.3 Client Records

For the firm you are signed in to, the extension retrieves and caches the client list: client id, first and last name, email address, phone number, firm id, tax year, status, created and updated timestamps, intake completion percentage and status, and the assigned preparer's id and name.

2.4 Tax Intake Data, Including Sensitive Personal Information

When you open a client and start an autofill, the extension requests that client's tax intake in decrypted form from GoRefer's API. Depending on what the client submitted, that record can contain:

• Social Security Numbers — taxpayer, spouse and each dependent
• Dates of birth — taxpayer, spouse and each dependent
• Bank routing numbers and account numbers, account type and bank name
• Employer Identification Numbers and other business-identity fields
• Names, home address, phone number, email address, occupation
• Filing status, dependents and their relationships
• Income, deduction, credit, healthcare, education, rental, investment and prior-year figures

This is the most sensitive category of data the extension touches, and it is the reason this policy exists. Decrypted intake data is never written to browser storage. It is held in memory only for as long as the panel has that client open.

2.5 Autofill Activity Records

For each autofill run the extension records the client id, client name, tax software, tax year, the names of the intake sections that were filled, the number of fields, the duration and the outcome.

No field values are recorded. Social Security Numbers, bank numbers and dates of birth do not appear in the local fill history or in the activity record sent to GoRefer's server — only section names and a field count.

2.6 Client Notes, Assistant Messages and Presence

• Notes you read or add for a client, including their text and author, are exchanged with GoRefer's API and cached locally.
• Assistant messages. If you use the in-panel assistant, your typed message, the client id you have open and the recent conversation history are sent to GoRefer's API. What happens to that message on the server, including any AI model provider GoRefer uses to generate a reply, is governed by the GoRefer Privacy Policy.
• Presence. While a client is open, the extension periodically sends that client id to GoRefer's API so colleagues in the same firm can see who is viewing the record, and reads back the list of other viewers.

2.7 Which Page You Are On

The extension reads the hostname of your active tab in order to tell whether you are on a supported tax-software site and which one. Nothing about your browsing is stored or transmitted.

2.8 What the Extension Does Not Collect

• No browsing history. The extension never enumerates tabs or history. It queries only the active tab, and holds host permissions for GoRefer's API plus a fixed list of tax-software domains — never <all_urls>.
• No page content. The content script never reads the contents of the tax-software page and never transmits page data. Its field-detection routine returns the names of intake sections it found selectors for — never any value from the page.
• No keystroke, mouse or screen recording.
• No device fingerprinting, advertising identifiers or cross-site tracking.
• No cookies. Every API request is sent with credentials omitted; authentication is by bearer token only.

3. Where Data Is Sent

The extension transmits data to exactly one host: https://api.gorefer.io.

Every network call is built from a single API base URL, and the extension's Content Security Policy restricts outbound connections to that one origin. Chrome enforces that policy, so a request to any other host would be blocked by the browser itself.

There are no analytics SDKs, no telemetry services, no crash reporters, no advertising networks, no tag managers and no third-party scripts of any kind in this extension. No web fonts or other assets are fetched from any external host. The extension has an analytics screen; it displays your own firm's autofill statistics returned by GoRefer's API and involves no third party.

Requests are additionally hardened: non-HTTPS API URLs are refused, redirects are rejected rather than followed so a bearer token cannot be forwarded to another host, no referrer is sent, and every request times out.

What GoRefer's servers do with data once it arrives, including any onward disclosure to service providers, is described by the GoRefer Privacy Policy.

4. How Long Data Is Kept

• Session tokens are held in Chrome's session storage area. Closing Chrome ends your session and clears them; you sign in again next time.
• The client list cache expires 24 hours after it is written.
• Decrypted intake data is never persisted — it lives in memory only.
• Fill history (section names and counts, never values) and your settings persist locally until you sign out or remove the extension.
• Signing out or uninstalling clears the extension's local data from your device. Records held server-side by GoRefer are governed by the GoRefer Privacy Policy.

5. Browser Permissions and Why Each Is Required

• storage — keeps you signed in between openings of the panel, caches the client list, and stores your settings and fill history.
• alarms — schedules three background jobs a Manifest V3 service worker cannot hold timers for: refreshing your access token before it expires, re-syncing the client list, and refreshing the unread-notification count.
• sidePanel — the extension's entire interface is a Chrome side panel, so your client's data stays visible beside the return while the fill runs and while you verify it.
• tabs — reads the active tab's hostname to identify the tax software, sends the fill instruction to that tab, and opens GoRefer billing links. It does not enumerate your tabs, read history, or access tab contents.
• Host access to api.gorefer.io — the only host the extension communicates with.
• Host access to tax-software domains — the sites listed in section 6, so the fill can write into their forms.

6. What Happens Inside Your Tax Software

The content script is injected into pages on these domains, and only these: Drake Tax, TaxSlayer Pro, Intuit ProConnect, TurboTax, MyTaxPrepOffice, TaxAct Professional, Blue Hero Tax, OLT Pro, My Tax Office and Cloud Tax Office.

On those pages the script:

1. Checks the hostname first. If the frame is not on a recognised tax-software host, it does nothing at all.
2. Waits for your explicit instruction. Nothing is written until you choose a client and start a fill from the panel.
3. Locates form fields by CSS selector and writes your client's intake values into them, highlighting each field as it fills.
4. Reports back a count. The panel receives how many fields were filled and skipped, per section — not their values.

It does not read the page, does not scrape or transmit page content, and does not observe your typing. Fills are best-effort: vendors change their forms without notice, so some fields will be skipped. Review the return before you file it.

GoRefer is not affiliated with, endorsed by, or partnered with any of the tax software vendors named above. Their names appear only to identify where the extension operates.

7. Security

• All communication with GoRefer's API is over HTTPS; plaintext URLs are refused.
• Authentication is by bearer token with no cookies, and redirects are rejected so a token cannot be forwarded to another host.
• A Content Security Policy limits scripts to the extension's own package and outbound connections to GoRefer's API. All code is packaged in the extension; none is loaded remotely.
• Refresh tokens are held in session storage, so closing the browser ends the session.
• Decrypted client intake data is never written to disk.

GoRefer's platform-level security commitments are described in the GoRefer Privacy Policy.

8. Your Rights, and Your Clients' Data

The extension is a window onto data your firm already holds in its GoRefer account. It is not a separate system of record, and deleting the extension does not delete anything from your GoRefer account.

You can clear the extension's local data at any time by signing out or removing the extension. For access, correction, export or deletion of the underlying client records — including requests made by a client under laws such as the CCPA/CPRA or the GDPR — use the process in the GoRefer Privacy Policy or contact us at the address below.

As a tax professional you have your own obligations for taxpayer data, including IRS Publication 4557 and the FTC Safeguards Rule. This extension is a tool you operate; it does not discharge those obligations for you.

9. Children's Privacy

The extension is a professional tool and is not directed to children. It does handle dependents' information, including minors' names, dates of birth and Social Security Numbers, but only because a tax return requires it and only as supplied by the firm's adult client. The extension collects nothing from a child directly.

10. Changes to This Policy

Material changes will be reflected here with an updated version and date, and noted in the release notes for the affected extension version. Your continued use of the extension after a change constitutes acceptance of the updated policy.

11. Contact

Questions about this policy, or a request concerning data handled by the extension:

GoRefer Inc.
Email: privacy@gorefer.io
Support: support@gorefer.io
Website: https://gorefer.io