Effective date: 8 September 2026
Platform: Android
Published by: Immersant Data Solutions (Pty) Ltd (IMRSNT), imrsnt.com
Contact: info@imrsnt.com
In short
FormVault fills in PDF forms using a profile you build once. Everything it holds — your profile, your documents, your filled forms — is stored on your own device. IMRSNT does not receive it, does not store it on any server, and could not produce it if asked. There are no accounts, no advertising, and no advertising identifier.
FormVault does measure how the app itself is used — which screens are opened, and how long a visit lasts — using Google Firebase Analytics, so we can see which parts of the app people actually rely on. That measurement carries nothing you have typed and nothing out of your documents. See App usage measurement below, which sets out exactly what is included and what is not.
Data FormVault collects
No personal data. FormVault transmits none of the information you enter, and nothing out of the documents you open — not to IMRSNT, and not to anyone else. There is no server that holds your profile or your forms, and there never will be.
What FormVault does send is anonymous app-usage measurement, set out in full under App usage measurement below: which screens are opened, how long a visit lasts, and counts of actions such as “a form was filled”. Google processes this as our analytics provider. It includes a random identifier for this installation of the app, plus your device model, operating-system version and country — and nothing else about you or your device.
The sections below describe what the app stores on your device, which is a different thing again, and which we set out in full so you can see exactly what the app holds.
Data FormVault stores on your device
- Your profile answers — name, address, date of birth, contact details, and any other field you choose to add.
- Sensitive answers — government ID numbers, and medical or financial values, where you choose to store them. These get extra protection; see Security below.
- Profiles for other people — FormVault lets you keep additional profiles (for example a spouse, parent or child) so you can fill forms on their behalf. Those answers are personal information about someone else, entered by you, and are protected exactly as your own are. You are responsible for being entitled to store them.
- Documents you upload — FormVault keeps its own copy of each PDF you open, so you can re-open and re-fill it later.
- Forms you fill — FormVault keeps its own copy of each completed PDF it produces.
- Field mappings it has learned — so a form you have filled once is quicker the next time.
- A change history — when an answer is added, edited, deleted, or written by approving a value found in a form, FormVault records what it was before, what it is now, and when. Previous values are encrypted and displayed masked, exactly as the current answer is.
None of the above is transmitted anywhere at any time.
Files and permissions
FormVault reaches your documents through your device’s own file picker — Android’s Storage Access Framework. You choose one PDF at a time and the app receives only that file. It does not request broad storage access, does not browse your device, and cannot see any file you have not handed it. Saving a filled form works the same way: your operating system’s save dialog decides where the file goes.
What leaves your device
Form-field suggestions are produced by a language model that runs entirely on your phone. That model is a large file (about 470 MB) and cannot be shipped inside the app, so FormVault downloads it once, only when you tap to start it, having shown you the size first.
- It never starts on its own.
- It sends nothing about you — no document, no profile answer, no identifier, no telemetry. It is a plain request for a public file whose contents are identical for everyone who downloads it.
- It is verified by size and checksum before it is used.
That download is the only network request that moves any content — and it moves it to your phone, never away from it. FormVault makes no other content request of any kind: no fonts, no crash reports, no update checks. It never uploads a document, an answer, or a filled form.
The one other thing that leaves your device is the anonymous app-usage measurement described in the next section. Unlike the model download, that is not something you tap — it runs while you use the app — which is why we set it out separately, and in full.
App usage measurement
FormVault uses Google Firebase Analytics to measure how the app is used. We added it to answer one question: which parts of FormVault people actually rely on, and where they spend their time. It is the only thing in the app that sends anything on its own.
What is measured:
- Which screens you open — by screen name, from a fixed list built into the app: for example
FormsLibrary,Profile,Review. - How long a visit lasts, and how long you spend on a screen.
- Counts of actions — that a form was opened, filled or shared; that a suggestion was accepted or rejected; that a profile entry was edited. A count and an outcome, from a fixed list of words the app chooses.
- Your device model, operating-system version, and country, and a random identifier for this installation of the app. Google’s analytics service supplies these; they are not something we select or add to.
What is never measured, and cannot be:
- Anything you have typed — no profile answer, no name, no address, no ID number, no medical or financial value.
- The names or labels of your profile fields or a form’s fields.
- Anything out of your documents — no file name, no file path, no page text, no scanned or recognised text, no filled form.
- Anything a suggestion contained, and anything sent to the on-device model.
- Your email address, including the optional reply-to address on the feedback form.
- Any identifier we chose. FormVault never sets a user ID or a user property. There are no accounts, so there is nothing to attach one to.
- The advertising ID. Google’s analytics library normally asks Android for permission to read it. FormVault removes that request from the app before it is built, and switches off ad-personalisation and the other advertising signals. The app cannot read your advertising ID, and this is not a setting we can quietly change without shipping a new version.
This is not a promise about how carefully we write events. The app is built so that a usage event can only carry a number, a yes/no, or a word from a fixed list — there is no way to put text from your profile or your documents into one. That restriction is enforced in the app’s code and checked automatically before every release.
Where it goes. To Google, as our analytics provider, and it may be processed outside South Africa. We use it only to understand how the app is used. It is not sold, not shared with anyone else, and not used for advertising.
Turning it off. FormVault has no in-app switch for this today. If you would rather not be included, please write to info@imrsnt.com and tell us — we would also like to know if this matters to you, because whether to add a switch is a decision we are still making. Uninstalling the app stops it entirely.
Suggestions made by the app
When FormVault cannot confidently match a field on a form, it may ask the on-device model for a suggestion. What it hands the model is the names of your profile fields — never the values. The model replies with a field name, and FormVault looks the value up itself. A government ID or an insurance number is never placed into a model prompt, even though the whole exchange happens on your own phone.
Suggestions are proposals: nothing is written into your form or your profile until you accept it. Because this is a general-purpose language model running locally, a suggestion can be wrong, and you should check it before accepting — particularly on legal, medical or financial forms.
If a suggestion is ever inappropriate or offensive, tell us at info@imrsnt.com and we will address it.
Security
Answers in the sensitive categories — government ID, medical, financial — are encrypted at rest using AES-256-GCM, under a key held in your device’s own hardware-backed key store (the Android Keystore). That key cannot be exported from the device. If a value cannot be encrypted, FormVault refuses to store it rather than storing it less safely.
Two details we state plainly rather than leave implied:
- The last four characters of a sensitive answer are stored unencrypted, so the masked form (for example
•••• 4821) can be shown without decrypting anything. Those four characters already appear on screen wherever the field is listed. - Revealing a sensitive value requires your phone to have a screen lock. On a device with no passcode or biometric set up, FormVault refuses to reveal it and says why.
Sharing a filled form
A completed PDF contains your answers in plain, readable form — including sensitive ones. That is what makes the file usable by whoever you are sending it to. Once you save it elsewhere on your device or hand it to another app, it is outside FormVault’s protection: the app no longer masks, encrypts or tracks that copy, and deleting the form inside FormVault does not reach it.
Sharing with others
IMRSNT does not sell, rent or trade your personal information, and we do not share it with data brokers, advertisers or ad networks. We do not use your information to build advertising profiles.
Keeping and deleting your data
- Delete one form — removes the stored original, FormVault’s filled copy, and the library entry.
- Delete everything — from Settings, wipes every profile answer, every stored document, every filled copy, the learned mappings and the change history. The encryption key for sensitive answers is destroyed after the data it protects, so anything that somehow survives on disk is unreadable by anyone, IMRSNT included.
- Uninstall the app — removes its storage, and your device discards the key with it.
FormVault does not expire or prune anything on its own; what it holds stays on your device until you remove it. Copies you saved elsewhere or shared with another app are, as described above, not reached by any of these. FormVault has no accounts, so there is no account to delete.
One thing the wipe does not reach, stated plainly. The app-usage measurement described above is already held by Google when it is recorded, so deleting your data on the device does not delete it there. It contains nothing you entered and nothing from your documents — screen names, durations and counts, against a random installation identifier — and Google deletes it on its own retention schedule. Uninstalling the app stops any further measurement. If you want the records for your installation removed, email us at info@imrsnt.com and we will ask Google to delete them; we will need to know roughly when and on what device you used the app, because a random installation identifier is not something we can look you up by.
Children
FormVault is not directed at children and has no account system. An adult may store a child’s details as one of the additional profiles described above; those details are entered by, visible to and deletable by that adult, on that adult’s own device, and are never transmitted.
Your rights
Data-protection laws such as the GDPR, the CCPA and South Africa’s POPIA give you rights over your personal information — to know what is held, to correct it, to obtain a copy, and to have it erased. How you exercise those rights depends on where the data lives, which is set out on each app’s own policy page. Where the app holds your data only on your device, you exercise those rights directly in the app rather than by asking us, because we have nothing to hand over. Where we do hold something, email us and we will deal with it.
For FormVault specifically: everything personal — your profile, your documents, your filled forms — is on your device only, so you exercise every one of those rights in the app itself, and there is nothing for us to produce or erase. The single exception is the app-usage measurement described above, which Google holds on our behalf. We do not consider it personal information about you — it carries nothing you entered and no identifier we chose — but we would rather name it here than let you discover it. Write to us and we will tell you what it contains and ask Google to delete your installation’s records.
Scope of this policy
This policy applies to the app named above, published by IMRSNT. Each app we publish has its own page like this one, stating that app’s own data handling; where an app’s page says something different from the general commitments below, the app’s page is the one that describes what that app actually does. This policy does not cover the IMRSNT website, which has its own privacy policy.
Changes to this policy
If this policy changes, the effective date shown at the top of this page changes with it, and the updated version is published at this same address. Where an app has no way to contact you, we have no way to notify you directly, so the date on this page is the record of when it last changed.
Complaints
If you are unhappy with how we have handled your information, email us first — we would rather fix it. You also have the right to complain to your data-protection regulator; in South Africa that is the Information Regulator.
Contact
Questions about this policy or about FormVault’s handling of data: info@imrsnt.com.