Privacy Policy

Konstruct Perform is a Chrome extension that auto-fills web forms using profiles and scenarios you create. This page explains, plainly, what data the extension touches, where that data lives, and what we don’t do with it.

Last updated: 28 April 2026

TL;DR

• Everything you create — profiles, scenarios, tags, and settings — stays on your device, in Chrome’s local extension storage.
• Nothing is sent to us. There is no server, no analytics, no telemetry.
• The extension only reads form fields on a page when you ask it to fill, and only to write your own stored values back into those fields.
• The extension can only access sites you have explicitly authorised. Permissions are requested per-site at the moment you add a domain to a profile, never blanket-granted at install.
• We do not sell, share, or transmit any of your data.

What the extension stores on your device

All of the following live in chrome.storage.local — Chrome’s per-device, per-extension storage area:

• Profiles you create (name, optional avatar image, the list of domains the profile applies to, and the scenarios it owns).
• Scenarios within each profile (fieldsets, field selectors, field types, and the values you’ve chosen to fill).
• Tags you’ve defined and which profiles they’re applied to.
• Settings (theme preference, reduce-motion override, sparkle effects on/off, default field type, default selector strategy, highlight-fields toggle, run-complete sound preferences, etc.).
• Active and autoload profile selections for the side panel.

This data is local to the Chrome profile in which the extension is installed. It does not sync across devices unless you explicitly export and re-import it via the Import / Export page in Settings.

What the extension reads from web pages

When you click Fill for a scenario:

1. The extension scans the active tab for elements that match the selectors defined in that scenario (by id, name, CSS, or regex).
2. For each match, it writes the value you previously stored into the matched field, simulating a user input event so client-side validation runs.
3. It records a small per-run summary locally (number of fields filled, deferred, or not found, plus the run duration) so the side panel can show you the run report. This summary contains no field values and no page content.

The extension does not read or transmit:

• The text you type into form fields outside of a fill run.
• Any pre-existing field values on the page.
• Page contents beyond the elements it’s actively trying to fill.
• URLs of pages you visit (only the active tab’s hostname is checked against your saved profile domains, and only locally).

What we do not do

• We do not run analytics or send telemetry. The extension makes no network requests of its own.
• We do not include third-party trackers or advertising SDKs.
• We do not collect personally identifiable information.
• We do not sell, rent, share, or transfer your data to anyone.
• We do not sync your profiles to a remote service. (If you want a copy elsewhere, the Import / Export page lets you export to a JSON file you control.)

Permissions, in plain English

Konstruct Perform takes a privacy-first stance on Chrome permissions: the install dialog asks for nothing sensitive, and any permission that could be used to monitor you is requested at the moment you actually need it — for the specific site, for the specific feature — so you can say no without breaking the rest of the extension.

Granted at install (no scary prompts)

• activeTab — temporarily access the currently focused tab to read its form fields, but only when you trigger a fill from the side panel. No persistent access, no background monitoring.
• sidePanel — open the Konstruct Perform side panel alongside the active tab.
• storage — read and write the local data described above (profiles, scenarios, tags, settings).
• offscreen — host a tiny hidden audio context to play the optional run-complete chime (Manifest V3 audio playback requires the offscreen API).
• scripting — inject the form-fill content script on demand, rather than statically into every page. Without this permission the extension can’t work; with it alone, it can’t do anything you haven’t separately authorised below.

Requested per-site, only when you add a domain

• Host access for the domain you’re adding (e.g. example.com and its subdomains) — Chrome shows a runtime prompt naming the exact origin: “Konstruct Perform wants to read and change your data on example.com”. You can accept, deny, or revoke later via chrome://extensions. If you deny, that site simply won’t auto-fill; every other configured site keeps working.
• The form-fill content script registers itself only for origins you’ve authorised. We never inject a script into a site you haven’t specifically granted.

Requested when you enable Autoload

• tabs (the “Read your browsing history” permission) — only needed if you turn on a profile’s Autoload toggle, which fires scenarios automatically when you visit a configured domain. Required because background URL-matching can’t run on the much narrower activeTab grant. If you never enable Autoload, you’ll never see this prompt.
• Combined prompt: when you enable Autoload, Chrome shows a single composite dialog asking for tabs and any not-yet-authorised host access for that profile’s domains, so you can grant everything in one decision.

What we do not ask for

We’ve actively avoided every permission Konstruct Perform doesn’t strictly need, including:

• Blanket host access (the <all_urls> match pattern) at install
• cookies, webRequest, webNavigation, bookmarks, history
• Any permission that would let the extension see traffic, read files, or act outside a tab you’re already looking at

If a future feature would require any of these, we’ll add it as an optional permission you opt into per-feature, never as a blanket install-time grant.

Children’s privacy

Konstruct Perform is not directed at children under 13 and does not knowingly collect data from them. Because the extension does not collect any data at all, this is true by construction.

Changes to this policy

If this policy changes — for instance, if the extension ever introduces optional cloud sync — we’ll update the “Last updated” date above and flag it in the in-app Changelog. Material changes that affect data handling will be communicated in-app before they take effect.

Contact

Questions, concerns, or curiosities about this policy?

• Email: privacy@mail.stayumble.com
• Issues / feedback: see the in-app Help & About page for the current support channel.