Privacy Policy

Last updated: 2 October 2026 · Applies to FSA / HSA Friend version 0.11 and later

Who we are

FSA / HSA Friend is operated by Cricket Ten LLC, which is responsible for this website and the extension. You can reach us at support@fsafriend.com.

What the extension reads

When you open your order or purchase-history page at one of the 67 supported stores, and only on those pages, the extension reads the order information already displayed in your own logged-in session: product names, purchase dates, prices where the page shows them, order numbers, the last four digits of a payment card where an itemised receipt shows it, and any FSA eligibility marking the store itself provides. It uses that to work out which items look FSA/HSA-eligible.

It reads the page you are already looking at. It does not log in for you, it cannot see your passwords, and it does not read any other page or tab.

Where your data is stored

• The items it finds, your claim statuses, your plan year and any amounts you type in are stored in your browser's own local extension storage, on your computer.
• Receipt PDFs and the summary report are saved to your own Downloads folder.

That is the only place any of it exists. We keep no copy: our server (below) stores nothing you send it. Removing the extension or using Clear all my data in Settings deletes the stored list; files already in your Downloads folder are yours and stay put.

Expenses you enter yourself

You can type in an in-store receipt, a medical service such as a co-pay, or an amount a store did not list. Anything you type is stored exactly like anything the extension finds: locally, on your machine, and nowhere else.

Deadline reminders

If reminders are switched on, the extension can show you a browser notification when your plan year is close to its deadline and you still have unclaimed money. The check happens on your own computer against data already stored there. Nothing is sent anywhere to produce it, and you can switch it off in Settings.

What the extension does not do

• It sends nothing on its own. The one place it can send anything is the AI helper, described below, and only when you ask it: a bill or EOB picture after your yes to that picture, or a page's labels when you press Ask the AI helper. Our build process fails if any part of the extension gains a network request toward anywhere else, and the Settings page shows you a live count of outbound requests so you can check rather than take our word for it.
• It uses no database or cloud storage. Our one server exists to pass the AI helper's reading back to you; it stores nothing you send.
• It runs no advertising, analytics, tracking, or fingerprinting, and sells nothing to anyone.
• It does not file claims with your FSA or HSA administrator, and never sees your plan credentials.

The AI helper (optional)

A bill or EOB that is a photo or a phone scan holds a picture, not text, so nothing on your computer can read it. If you ask, the AI helper reads it. Every time, the extension shows you the picture and asks first; nothing goes anywhere until you say yes to that picture.

• What leaves your device: that picture, resized, with the camera's details (where and when it was taken, on what phone) removed. It shows whatever the bill prints, such as the patient's name, the provider, the account number and the amount. Nothing goes with it: not your plan, your other bills, or your order history.
• Where it goes: to our server, which passes it to Anthropic's Claude model and returns the amounts, dates and account details it read. Our server keeps no copy of the picture or the reading, and its log holds no content: one line per request with a time, an outcome and the random token your install made, which identifies no one.
• What the model keeps: Anthropic processes the picture to answer, does not use it to train its models, and may keep it for a limited time under its commercial terms for safety checks. See Anthropic's commercial terms.
• Bills whose text your computer can read are read there first; the AI helper is offered as a second reading, and you can decline it.
• Your phone's camera, if you use it: Scan shows a one-time link, the pages you photograph travel from your phone through our server to your computer, and the server holds them only until your computer picks them up, at most a few minutes, then deletes them. They still wait for your yes before the AI helper reads them.
• Pay and Reimburse: on a biller's or plan's page, the helper's Ask the AI helper button sends that page's labels and button names, so the AI can say which box takes which detail. It never sends what is typed in the boxes, never your bill's details, never a payment page, and never a page whose labels name people.
• You can say no every time and the extension works as before: type the bill in from the paper.

Permissions, and why each is needed

• storage — to keep the items it finds on your device between visits.
• downloads — to save receipt PDFs and the summary report into your Downloads folder.
• scripting — to read the order page you have open, and the store's own itemised receipt pages, so it can find items and amounts.
• tabs — to open a store's order page when you start a scan from the dashboard, and to know when it has finished loading.
• debugger — to save a store's receipt page as a PDF using the browser's own print engine, the same output as pressing Print and choosing Save as PDF. It is used only while a receipt is being saved, only on the store pages listed below, and Chrome shows a notice whenever it is active.
• alarms — to check once a day whether your plan deadline is close. This runs locally.
• notifications — to show the deadline reminder itself.
• sidePanel — to show, beside whatever page is open, what the dashboard already holds on this device: the scan in progress, your plan's deadline and what is ready to claim, and while a helper runs in that tab, the bill it is using.
• Access to the supported store domains — to read your order pages. It is limited to the stores we support, and nothing else you browse.
• Access to our server's address — the one address the AI helper can send a picture to, after your yes. The extension's security policy allows no other.
• Optional access to store product pages — only if you switch on the setting that flags eligible items while you shop. It is off unless you turn it on, Chrome asks you before granting it, and you can revoke it at any time.

Sensitive information

Purchase history and medical bills are health-adjacent and personal. That is precisely why the extension keeps them on your own machine: they are not transmitted (except the one picture you ask the AI helper to read, which is not kept), not aggregated, and not available to us even if we were asked for it.

The email list on this website

This website is a separate thing from the extension, and one piece of information here does leave your device. If you give us your email address, it is stored on our behalf by our email provider so we can tell you when the extension is available and, if you want, before an FSA deadline.

• We store the address and the date you gave it. Nothing else, and nothing at all about your purchases.
• It is never sold and never shared for anyone else's marketing.
• Ask us to delete it and we will, with no reason needed: email support@fsafriend.com.
• Giving it is optional and the extension works identically without it.

This website, cookies and the blog

These pages set no cookies and run no analytics. Our web host keeps standard server logs, which include IP addresses, as almost every web host does.

Any blog we publish at fsafriend.com/blog runs on separate software that may set its own cookies. Where that differs from this page, the notice shown on the blog applies to the blog.

Your rights

Depending on where you live, you may have rights to see, correct, export or delete personal information a company holds about you, and not to be discriminated against for exercising them.

For the extension, those rights are satisfied by design and without asking us: the data is already only on your computer, Export everything in Settings gives you a copy, and Clear all my data deletes it. We cannot access, produce or delete it for you, because we never had it.

For the email list, write to support@fsafriend.com and we will confirm what we hold and delete it on request.

Children

FSA / HSA Friend is meant for adults managing their own health accounts. It is not directed at children under 13, and we do not knowingly collect information from them.

Eligibility is advisory

The extension flags items it believes are eligible, using the store's own marking where one exists and otherwise a catalog match on the product name. A catalog match is a best guess, not a ruling. Your plan administrator decides what is eligible, so review anything before you submit it. See the Terms of Use.

Changes to this policy

If this policy changes we will update the date at the top of this page. If a change ever means the extension starts collecting something, we will say so plainly before it happens, not quietly in a revision.

Contact

Questions about this policy, or a request about your information: support@fsafriend.com.