Your information should be treated with care.

Information we collect

When you create an account, we collect your email address and the name you choose for your workspace. We store the forms you create, their settings, and basic usage events such as form opens, starts, and completions.

When someone answers a form, we store the answers and files they submit along with the submission time and form version. Form creators decide what information their forms request.

How we use information

• Provide, secure, and improve Formfolk.
• Authenticate creators and preserve their work.
• Deliver responses, analytics, exports, and configured integrations.
• Diagnose failures and prevent misuse.

We do not sell personal information or use form responses for advertising.

Google user data

If a creator connects Google Forms for migration, Formfolk requests read-only permission to view Google Form definitions available to that Google account. Formfolk only retrieves forms whose edit links or IDs the creator provides, using that access solely to move their structure into unpublished Formfolk drafts. It does not list forms, read responses, transfer respondent uploads, change source forms, or request Google Drive access.

The encrypted Google Forms access token expires within one hour, and Formfolk does not request or store a refresh token. Disconnecting removes the temporary token from Formfolk immediately and Formfolk also requests revocation from Google. Drafts already created in Formfolk remain available after disconnecting.

If a creator connects Google Sheets, Formfolk asks for permission to see, edit, create, and delete only the Google Drive files that Formfolk creates or that the creator explicitly selects for use with Formfolk. The current Google Sheets integration creates a new spreadsheet for the selected form and writes new Formfolk responses to that spreadsheet. Formfolk does not request access to other files in the creator's Google Drive.

Formfolk stores an encrypted Google authorization credential and the identifiers, name, and link for the connected spreadsheet so it can deliver future responses while the creator is away. Formfolk does not use Google user data for advertising, sell it, or use it to train generalized or personalized AI models. We do not transfer Google user data to third parties except as necessary to provide or secure the integration, comply with law, or with the creator's affirmative direction.

Creators can disconnect an individual spreadsheet destination or disconnect Google from Formfolk. Disconnecting stops future delivery and revokes Formfolk's Google authorization; it does not delete the spreadsheet or responses already stored in the creator's Google account. Formfolk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who processes information

Formfolk uses service providers to operate the product, including Supabase for authentication and private file/data storage and Vercel for application hosting. A creator may also configure an integration, such as Google Sheets or a webhook, that sends new response data to a service they control.

Retention and control

Creators can delete individual responses and forms from their workspace. Their associated uploaded files are removed with them. Files uploaded but never submitted are removed automatically after approximately 24 hours. We retain account and form data while the account is active and as reasonably necessary for security, legal obligations, and reliable backups.

Respondent privacy

The creator of a form controls why responses are collected and how they are used. Questions about a particular form should first be directed to that form's creator.

Contact

Questions or privacy requests can be sent to hello@formfolk.app.