Privacy Policy

Overview

Last updated: October 13, 2026

Umete is a Safari extension, with an app for Mac, iPhone, and iPad, that remembers answers you type into web forms and fills them in when you ask. Umete has no account or sign-in, shows no ads, and contains no analytics or tracking. Your saved answers are never sent to us or to an AI provider. We do not sell or share your data.

Data the app handles

• The answers you save: the label of each form field and the value you typed, plus any addresses and contacts, such as your doctor or an emergency contact, that you add in the app.
• When you choose Remember my answers or Fill this form: the form fields on the page in that tab, including their labels, names, autocomplete hints, placeholders, and menu options. Umete reads the page only when you ask, and only the page itself, not forms embedded from other sites in frames.
• Your AI matching choice, and your API key if you add one.

Umete never reads or saves passwords, card numbers, security codes, secrets, tokens, or Social Security numbers, or fields that are hidden or disabled.

Storage and encryption

Saved answers are kept in one file in Umete’s private app storage, encrypted with AES-GCM. The encryption key is kept in the Apple Keychain. With iCloud sync on, the key is in your iCloud Keychain, which Apple encrypts end to end, so your own devices can share it. On iPhone and iPad, the file also has iOS data protection.

Anyone who can use your unlocked device and open the Umete app can see your saved answers. Avoid using Umete on a shared device.

iCloud sync

Saved answers sync between your Mac, iPhone, and iPad through your own iCloud account, in your private CloudKit database. Each answer is encrypted on your device before it is uploaded, so Apple cannot read it; only the time it was last changed is stored unencrypted. AI settings and API keys do not sync.

Sync is on by default. You can turn it off in the Umete app’s General settings; answers then stay on each device. Turning sync off doesn’t delete what is already in iCloud. Clear All Answers with sync on deletes your answers on all your devices and in iCloud.

AI matching

Umete first matches fields on your device. Only fields it couldn’t match are described to an AI, which picks which of your saved answers, if any, belongs in each one. Umete then fills them on your device.

What is sent: each unmatched field’s label, name, autocomplete hint, placeholder, type, menu options, and nearby headings, and the labels of your saved answers to choose from, such as “Passport number,” or a contact’s role, like “Doctor, Cardiologist.” Contacts’ names are not sent.

What is never sent: your saved values, the values already in the form, your addresses, and the page’s address or title.

• Umete (free), the default: requests go to Umete’s server at api.umete.jp, which forwards them to OpenAI’s Decisions API with Umete’s own key. The server doesn’t log or store request content. To enforce the daily limit, it keeps a count of requests per day, keyed by a salted hash of a random ID made when you install Umete and a salted hash of your IP address, and deletes the counts after three days. OpenAI handles the request under its API data policies.
• With your own OpenAI or Anthropic key: requests go directly from your device to that provider, under your agreement with them. Requests to OpenAI ask it not to store the response.

Toolbar badge

The toolbar badge is off by default. If you turn it on, Safari asks you to allow Umete on all websites, and Umete checks each page you open for forms it can fill, entirely on your device. It reads field labels, never values, and sends nothing anywhere.

Diagnostics and bug reports

Debug logs are kept on your device only if you turn on logging. They can include page addresses and form labels. They are sent only if you choose Email Logs in the extension or Report a Bug in the Mac app’s About window, which opens an email draft you can review before deciding whether to send it.

Updates

On Mac, Umete uses Sparkle to check https://umete.jp/appcast.xml for updates once a day. No system profile is sent. Updates are downloaded from GitHub.

Permissions

• Safari: Umete gets access to a page when you open it from the toolbar on that page. Access to all websites is needed only for the optional toolbar badge.
• iCloud, for sync. Umete doesn’t ask for your contacts, location, camera, microphone, or files.

You can change website access in Safari’s settings for Umete, and turn the extension off in Safari → Settings → Extensions on Mac, or Settings → Apps → Safari → Extensions on iPhone and iPad.

This website

umete.jp counts clicks on its download button. The page sends only the product and button name (“ume” and “download-macos”), and the server keeps a running total per button with the times of the first and latest click. No cookies are used, and your IP address is used briefly by Cloudflare to prevent abuse but is not stored. The code is open source: page script · server code.

Retention and deletion

Your answers stay until you delete them. You can edit or delete any answer in the Umete app, or delete them all with Clear All Answers. Deleting the app removes the answers on that device; with sync on, copies remain in iCloud until you clear them or delete Umete’s data from your iCloud storage settings. The free AI server’s usage counts are deleted after three days.

Children and general use

Umete is a general-purpose utility and is not directed to children. Because the app does not send personal data to us, we do not knowingly collect children’s personal data through the app.

Changes to this policy

October 13, 2026: First version.

We may update this policy as Umete changes. We will revise the date above and describe material changes clearly on this page or in the release notes.

Contact

Questions may be sent to justin@onemorething.tokyo.