Who we are
FormYaar ("we", "us", "our") is a product developed and operated by Hemant Chauhan (trading as ExcuseME Brother), an individual entrepreneur based in Bareilly, Uttar Pradesh, India.
FormYaar is a Chrome browser extension and associated website that helps Indian citizens auto-fill government forms (such as PAN card, Driving Licence, and Passport applications) on official government portals. We are not affiliated with, endorsed by, or connected to the Government of India, NSDL, UTIITSL, Parivahan, Passport Seva, or any other government entity.
Contact:
Email: formyaar@gmail.com
Website: formyaar.in
Location: Bareilly, Uttar Pradesh, India
Scope of this policy
This Privacy Policy applies to:
- The FormYaar Chrome Extension (available on the Chrome Web Store)
- The FormYaar website at formyaar.in
- The payment page at formyaar.in/pay
-
Our backend API hosted on Railway
(
formyaar-backend-production-d3a3.up.railway.app)
This policy does not apply to the government portals you visit while using FormYaar (such as the NSDL PAN portal, Sarathi Parivahan, or Passport Seva). Those portals have their own privacy policies and are operated independently. FormYaar's role is only to assist in populating form fields — all data you submit to those portals is governed by the relevant government authority.
FormYaar helps you fill government forms. The data you submit to those forms goes directly to the government, not to us. We only see anonymous confirmation that a form was filled successfully.
Data we collect
We are transparent about every piece of data that touches FormYaar. The tables below separate what stays on your device from what we receive on our servers.
3A. Personal data you enter (stored locally on your device only)
When you set up FormYaar, you enter details needed to fill
government forms.
This data is stored exclusively in your browser's local storage
(chrome.storage.local) and is never transmitted to
our servers.
| Data type | Examples | Where stored | Purpose |
|---|---|---|---|
| Full name | First, middle, last name | Your device | Auto-fill name fields on government forms |
| Date of birth | DD/MM/YYYY format | Your device | Auto-fill DOB fields on government forms |
| Gender | Male / Female / Other | Your device | Auto-fill gender selection on government forms |
| Aadhaar last 4 digits | e.g. "4892" | Your device | Auto-fill the Aadhaar verification field (the PAN form requires only the last 4 digits, not the full number) |
| PIN code | 6-digit area PIN code | Your device | Auto-fill address / AO Code section on the PAN form; also sent anonymously to our pincode lookup API to retrieve the state and city name |
| Father's / Mother's name | Parent name fields | Your device | Auto-fill family detail fields required by PAN, DL, and Passport forms |
| Email address | example@gmail.com | Your device | Auto-fill contact fields on government forms; also collected at payment time (see Section 7) |
| Mobile number | 10-digit Indian number | Your device | Auto-fill contact fields on government forms; also sent to our backend at payment time to create a fill session (alongside order ID and form type — no other personal data is included) |
| Place of verification | City name | Your device | Auto-fill the "Place" field in the declaration section of government forms |
| Proof of DOB selection | e.g. "Aadhaar Card" | Your device | Auto-select the proof of date of birth document type on forms that require it |
| Source of income | Salary, Business, No income, etc. | Your device | Auto-select the income source checkboxes on the PAN form |
FormYaar only asks for the last 4 digits of your Aadhaar number, which is what government forms typically display for verification. We do not ask for, store, or process your 12-digit Aadhaar number at any point. Collecting, processing, or storing Aadhaar data without UIDAI's Aadhaar KUA registration is prohibited under Section 40 of the Aadhaar Act, 2016 — and we are fully compliant by design, not just by policy.
3B. Anonymous usage data (sent to our servers)
FormYaar collects minimal anonymous telemetry to understand how the product is used and to detect when government portals change their form structure. This data does not identify you.
| Data type | Details | Where stored |
|---|---|---|
| Form fill events | Which form type was filled (e.g. "pan_card"), timestamp, success/failure status | Our server |
| Extension version | Version number of the FormYaar extension | Our server |
| Error events | Anonymous error codes when a field fails to fill (no personal data included) | Our server |
| Pincode lookup | Your 6-digit PIN code is sent to our backend to retrieve the corresponding state and city name for the AO code section of the PAN form. The PIN code is not stored after the lookup is complete. | Transient (not stored) |
3C. Payment data (processed by Razorpay)
When you pay for a form fill, your payment is processed entirely by Razorpay Payment Solutions Pvt. Ltd., a PCI-DSS compliant payment gateway. We do not see, store, or process your credit/debit card number, UPI ID, or bank account details. See Section 7 for full details.
3D. Server logs
Our backend server (hosted on Railway) generates standard HTTP access logs that include IP addresses, request timestamps, and API endpoints called. These logs are retained for up to 30 days for security monitoring and debugging and are not used for any other purpose.
Why we collect this data
We follow strict data minimisation: we collect only what is necessary for the extension to function, and nothing more. Here is the specific purpose for each category:
How data is stored
Your personal data — device only
All personal data you enter into FormYaar (name, DOB, Aadhaar last
4, family names, address details) is stored using
chrome.storage.local — a browser API
that stores data locally on your computer, inside your Chrome
profile. This data:
- Never leaves your device over the network
- Is accessible only to the FormYaar extension — no other website or extension can read it
- Is automatically deleted when you uninstall the FormYaar extension
- Can be deleted manually at any time from the FormYaar extension settings panel
Session data — temporary
During an active form-filling session, FormYaar uses
chrome.storage.session to temporarily
store the current autofill state (e.g. "pan_card autofill is active
on page 2 of 5"). This data:
- Is automatically cleared when you close Chrome
- Contains sensitive fields needed during the active fill (Aadhaar last 4 digits, passport number, TIN number if applicable) — cleared automatically when Chrome is closed or restarted. These fields are never written to persistent storage.
Operator-assisted fills — customer data on operator's device
When a customer uses FormYaar through a CSC centre or internet café (the Operator Plan), the customer's details are entered on the operator's device. In this case:
-
The
last 4 digits of the customer's Aadhaar number
are stored locally on the operator's device
(
chrome.storage.local) to enable session resume — for example, if the browser is refreshed mid-fill or the form spans multiple pages. - This data is stored only on the operator's device and is never transmitted to our servers.
- It is automatically deleted when the operator clears data from the FormYaar extension, or when the extension is uninstalled.
- Operators are responsible for ensuring that customer data entered on their device is handled in accordance with applicable privacy laws and is not retained beyond the duration of the fill session.
Server-side data — minimal
Our backend server stores only:
- Payment order records (order ID, Razorpay payment ID, timestamp, amount) — retained for 7 years as required by Indian financial regulations
- Anonymous telemetry events (form type, timestamp, extension version) — retained for 90 days
- Standard HTTP access logs (IP address, endpoint, timestamp) — retained for 30 days
All communication between the FormYaar extension and our backend server uses HTTPS (TLS 1.2 or higher). The payment page at formyaar.in is served over HTTPS. We do not support non-HTTPS connections to any endpoint that handles user data.
Data sharing and disclosure
FormYaar does not sell, rent, lease, or trade any personal information to data brokers, advertisers, marketing companies, or any other third parties. This is a structural commitment — we do not have the data to sell, because we do not collect your personal data on our servers in the first place.
The following are the only circumstances in which we share any data:
Razorpay (payment processing)
When you make a payment, you are redirected to a FormYaar-hosted payment page that loads the Razorpay checkout. Your payment details (card number, UPI ID, bank details) are entered directly into Razorpay's secure payment interface and are never seen by FormYaar. Razorpay shares with us only: payment status (success/failure), order ID, payment ID, and the email address you provide for the receipt. Razorpay's privacy policy is at razorpay.com/privacy.
Postal pincode API
To resolve the state and city from your PIN code for the PAN form's AO Code section, we call a public Indian postal database API (api.postalpincode.in). Your PIN code is included in this request. It is a public API and the PIN code is not stored by us after the lookup.
Railway (backend hosting)
Our backend API is hosted on Railway (San Francisco, USA). Railway processes server-side data (logs, payment verification requests) as our infrastructure provider. Railway is GDPR-compliant and does not have access to your form data (which stays on your device).
Cloudflare (website and payment page hosting)
Our website and payment page are hosted on Cloudflare Pages. Cloudflare may process standard web request data (IP addresses, request headers) as part of their CDN and DDoS protection services.
Legal requirements
We may disclose information if required to do so by law, court order, or government authority under Indian law (including the Information Technology Act, 2000 and any applicable successor legislation including DPDP Act, 2023), provided such disclosure is narrowly limited to what is legally required.
Payments and Razorpay
FormYaar uses Razorpay Payment Solutions Pvt. Ltd. (CIN: U74900KA2013PTC097389) as its payment gateway. Razorpay is authorised by the Reserve Bank of India (RBI) as a Payment Aggregator and is PCI-DSS Level 1 compliant.
How the payment flow works
- When you click "Fill Form", the FormYaar extension creates a payment order via our backend and opens the payment page at formyaar.in/pay in a new tab
- You complete payment on this page using UPI, credit/debit card, or net banking — all entered directly into Razorpay's hosted checkout
- Razorpay notifies our backend via webhook that payment is complete
-
Our backend verifies the webhook signature using
crypto.timingSafeEqualand marks the order as paid - The extension polls our backend, receives confirmation, and begins autofill
What FormYaar receives from Razorpay
We receive and store: the Razorpay order ID, the payment ID, the amount (in paise), the payment timestamp, and (optionally) your email address for sending a receipt and managing your fill credits. We never receive or store your card number, CVV, UPI ID, bank account number, or any raw payment credentials.
Refunds
If you are entitled to a refund (e.g. a form fill that results in a government rejection due to a FormYaar error), refunds are processed back to your original payment method via Razorpay. To request a refund, email formyaar@gmail.com with your payment ID. Full details are in our Terms & Refund Policy.
FormYaar is not involved in processing, transmitting, or storing payment card data. All card-related data is handled solely by Razorpay under their PCI-DSS certification. FormYaar never touches raw card data at any point in the transaction.
Chrome extension permissions
FormYaar requests the following Chrome extension permissions. We request only the minimum permissions necessary for the extension to function (the principle of least privilege).
chrome.storage.local on your device, and to
manage the active autofill session state in
chrome.storage.session. Without this, FormYaar
cannot remember your details between sessions.
setInterval because they survive Chrome's MV3
service worker lifecycle (service workers can be terminated
between events).
<all_urls> access. This means FormYaar cannot
run on any website other than the explicitly listed government
portals.
FormYaar does not request permissions for browsing history, cookies, bookmarks, downloads, geolocation, camera, microphone, or clipboard beyond what is needed to fill form fields. We do not read your browsing history. We do not have access to any website you visit that is not a supported government portal.
Data retention
| Data category | Retention period | Deleted when |
|---|---|---|
| Personal details in extension | Until you delete it or uninstall the extension | Extension uninstalled; or you click "Clear Data" in settings |
| Active session state | Duration of one browser session | Chrome is closed or restarted |
| Payment records | 7 years | Required by Indian financial regulations; not deleted earlier |
| Email (from payment) | Until you request deletion | Email formyaar@gmail.com to request deletion |
| Anonymous telemetry | 90 days | Automatically purged after 90 days |
| Server access logs | 30 days | Automatically purged after 30 days |
| PIN code (lookup) | Not stored | Used only transiently during the lookup API call; not stored on our server |
Your rights
Under Indian law (including the Digital Personal Data Protection Act, 2023) and general principles of good data stewardship, you have the following rights:
Right to access and correction
You can view and edit all your saved details at any time by clicking the PAN Card option on the FormYaar home screen — your saved information is pre-filled in the form where you can review and update any field. Changes are saved immediately to your device.
Right to erasure (deletion)
You can delete all your personal data stored in the extension by clicking the trash icon on the FormYaar home screen. This is permanent and immediate — all saved details and active session data are wiped in one tap. For data stored on our servers (such as your email address from a payment), email formyaar@gmail.com with "Data Deletion Request" in the subject line. We will process deletion requests within 30 days, subject to legal retention requirements (e.g. payment records cannot be deleted before the end of the legally required retention period).
Right to portability
All personal data in the extension is stored in your Chrome profile. You can export it from Chrome's settings. There is no data locked in our servers that you cannot access.
Right to withdraw consent
You can stop using FormYaar and delete all your data at any time by uninstalling the extension. Uninstalling FormYaar clears all locally stored data automatically.
Right to complain
If you believe we have not handled your data appropriately, you may contact us at formyaar@gmail.com. If you are not satisfied with our response, you may contact the relevant data protection authority in India.
Children's privacy
FormYaar is strictly for use by individuals aged 18 and above. We do not provide form-filling services for minors, and we do not accept, store, or process personal data from anyone under the age of 18. By using FormYaar, you confirm that you are at least 18 years old.
Since all data entered into FormYaar is stored exclusively on your own device and never transmitted to our servers, we have no ability to hold or access a child's personal information. If you believe a minor has used FormYaar on a shared device, you can delete all stored data immediately using the trash icon on the FormYaar home screen.
Security measures
We take security seriously and have implemented the following measures:
- HTTPS everywhere: All network communication uses TLS 1.2 or higher. No unencrypted HTTP endpoints exist for data handling.
-
Local-only storage: Personal form data is stored
in
chrome.storage.local, accessible only to the FormYaar extension and only on your device. -
Webhook signature verification: Razorpay payment
webhooks are verified using HMAC-SHA256 and
crypto.timingSafeEqualto prevent payment fraud. - Path traversal protection: Our backend API allowlists supported form names to prevent path traversal attacks on the config endpoint.
- Rate limiting: Our AI chat endpoint and API endpoints are rate-limited to prevent abuse.
- CORS restrictions: Our backend only accepts requests from allowed origins (the FormYaar extension and payment page).
- No raw card data: Payment card data is handled exclusively by Razorpay — FormYaar never touches raw payment credentials.
- Structured logging: Backend logs use structured pino logging and are not logged to public services.
- Helmet middleware: Standard HTTP security headers are applied to all backend responses.
- Open source: Our extension code is open source, allowing public audit of our data handling practices.
Despite these measures, no system is perfectly secure. If you discover a security vulnerability in FormYaar, please report it responsibly to formyaar@gmail.com.
Third-party links and government portals
FormYaar operates on top of government portal websites (such as the NSDL PAN portal at onlineservices.nsdl.com). These websites are operated by the Government of India and its agencies and have their own privacy policies, terms of service, and data handling practices. FormYaar is not responsible for the data practices of any government portal.
Our website may contain links to third-party websites (such as GitHub, the Chrome Web Store, or YouTube tutorials). These links are provided for convenience. We are not responsible for the privacy practices of any third-party website.
Changes to this policy
We may update this Privacy Policy from time to time as the product evolves, new forms are supported, or applicable law changes. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
Your continued use of FormYaar after any changes to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with the changes, you may uninstall the extension and delete your data at any time.
We will not retroactively change how we use data already collected without providing notice and, where required by law, obtaining fresh consent.
Contact us
If you have any questions about this Privacy Policy, your data, or FormYaar's data practices, please contact us:
Name: Hemant Chauhan (ExcuseME Brother)
Privacy & support email:
formyaar@gmail.com
Website:
formyaar.in
Location: Bareilly, Uttar Pradesh, India —
243001
Response time: We aim to respond to all
privacy-related enquiries within 48 hours.
For data deletion requests, please email formyaar@gmail.com with the subject line "Data Deletion Request" and include: your email address (if you made a payment), and a brief description of what data you want deleted. We will confirm deletion within 30 days.
For security vulnerability reports, please email formyaar@gmail.com. We take all reports seriously and will acknowledge them within 24 hours.