Privacy Policy

1. What We Collect

We collect only what is necessary to operate the Service:

• Account information — your email address and hashed password
• Form submission data — whatever your end users submit through forms you create
• Uploaded files — files attached to form submissions
• Usage data — submission counts, storage usage, and action counts for billing purposes
• Submission metadata — when an end user submits a form, we record their IP address, user agent, and referring page URL. This data is used for spam detection, rate limiting, and security purposes.

2. What We Do NOT Do

We do not sell, rent, or share your data with any third party for marketing, advertising, or analytics purposes. Period.

3. Third-Party Services

The Service relies on a small number of third-party providers to function. Your data may pass through these services strictly as needed to deliver features you use:

• Cloudflare R2 — file storage for uploaded files
• Resend — transactional email delivery (account emails and the Email action)
• Lemon Squeezy — payment processing and subscription billing
• Google APIs — Google Sheets integration, only when you enable the Google Sheets action
• PostHog — privacy-focused product analytics. PostHog helps us understand how the Service is used so we can improve it. PostHog is configured to respect Do Not Track headers and does not sell or share data with third parties. You can opt out via your browser’s Do Not Track setting. See PostHog’s privacy policy.
• Cloudflare Turnstile — CAPTCHA verification on forms where enabled, to protect against automated spam submissions

We do not share your data with any services beyond what is listed above. If this list changes, we will update this policy.

4. Data Ownership

Your data is yours. If you delete your account, we will remove your data from our systems. To request deletion of your account and associated data, contact us through our contact page . We will process deletion requests within 30 days.

5. File Uploads

Uploaded files are stored on Cloudflare R2 and served via token-signed URLs. These URLs are not publicly listed but are accessible to anyone who has them. Do not use file uploads for sensitive or confidential documents.

6. Cookies & Tracking

Cookies

We use a single cookie that is strictly necessary for the Service to function:

We do not use advertising cookies or third-party tracking cookies.

Analytics

We use PostHog, a privacy-focused analytics platform, to understand how the Service is used. PostHog may store a cookie or use local storage to distinguish unique visitors. This data is used solely to improve the Service. PostHog does not sell or share this data with third parties. You can opt out of analytics by enabling your browser’s Do Not Track setting.

7. Data Retention

We retain your account data and form submissions for as long as your account is active. If you delete your account, we will delete your data from our production systems within 30 days. Backups containing your data may persist for up to 90 days before being automatically purged.

Submission metadata (IP address, user agent) is retained alongside the submission it belongs to and is deleted when the submission is deleted.

8. Security

We take reasonable measures to protect your data, including encrypted connections (TLS), hashed passwords, and access controls. However, no system is perfectly secure. We encourage you not to store highly sensitive information through the Service.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.

10. Contact

Questions about this policy? Reach out through our contact & suggestions page .