A note for your IT department

What the extension does

Rowfill automates repetitive data entry into a web form. The user fills the form once, the extension records the sequence, then replays it for every row of a table pasted from Excel.

The extension acts strictly within the signed-in user's own scope. It opens no new access: it reuses the application session already open in the tab, exactly as the user would by typing. It stores no credentials and touches no cookies.

Requested permissions and justification

Permission	Why it is needed
sidePanel	Show the interface in the browser side panel. No data access.
scripting	Inject the typing code into the business application tab, only on domains the user has explicitly allowed, and only during a recording or a run.
storage	Store form templates locally through chrome.storage.local. No cloud sync: chrome.storage.sync is not used.
tabs	Identify the active tab to know where to act, and detect when the page has finished loading between two rows.
host_permissions api.lemonsqueezy.com	Check the subscription with the payment provider. It is the only domain the extension can reach by default. The request carries the licence key and an instance id only, never business data nor a visited URL. No request at all is made on the free plan.
optional_host_permissions	The extension requests no site access at install time. The user grants access one domain at a time, on demand, through Chrome's native dialog. It is revocable at any time from chrome://extensions.

The extension does not declare <all_urls> statically, and requests no access to cookies, history, downloads, the system clipboard or credentials.

Data and traffic

• No outbound business traffic. There is no Rowfill server. The only network call in the entire code base is the licence check described above, isolated in src/background/license.js. No other fetch, XMLHttpRequest or WebSocket exists in the product.
• No telemetry, no analytics, no tracker.
• No remote resources. Fonts are bundled in the package. The extension loads nothing from a CDN.
• Pasted data stays in memory for the session and is never written to disk.
• Saved templates describe the form's fields, not business data. They live in the local browser profile.

How to verify it yourself

1. Open chrome://extensions, enable developer mode, click "service worker" under Rowfill.
2. In the Network tab of the developer tools, run a full batch. No outbound request should appear, whatever the batch size.
3. To audit the licence check, search the source for lemonsqueezy: it lives in a single file, and the request body is readable in clear text there.
4. The extension's source is readable as shipped: not minified, not obfuscated, not transpiled. No third-party dependency is bundled at runtime.

Built-in safeguards

• Configurable minimum delay between rows, so the application server is not hit abnormally.
• Automatic stop after three consecutive failures.
• Runs are always visible on screen, with a progress banner in the page and an immediate stop button. The extension never runs in the background or outside a user-triggered action.
• Run log exportable as CSV, row by row, for audit purposes.

Allowlisting

To allow Rowfill by group policy on Windows, through ExtensionInstallAllowlist:

HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist
  1 = "ofggabdbfpekpbjbnjldldnghdnpdiei"

To further restrict the domains the extension may act on, the ExtensionSettings policy can pin an allowed URL list, independently of the user's own choice.

Licence and support

The extension is published by an independent developer. Support and compliance questions go through the contact address published on the Chrome Web Store listing.