Privacy Policy

1. Who we are

FormSquid ("FormSquid," "we," "us," or "our") is an AI-assisted form builder available at https://formsquid.com. We help users generate, host, publish, and manage forms; collect submissions; export form source code; and optionally deliver notifications and webhooks.

For privacy questions, contact us at privacy@formsquid.com.

2. Scope

This Privacy Policy applies to:

• Account holders who create and manage forms on FormSquid
• Visitors who browse the FormSquid website
• People who submit responses to forms hosted by FormSquid on behalf of an account holder

When someone fills out a form you publish, you are typically the controller of that submission data. We process that data as a service provider to host, store, and deliver it according to your configuration and this policy.

3. Information we collect

3.1 Account and authentication information

When you create or sign in to an account, we collect:

• Name
• Email address
• Password (stored only as a secure hash if you use email/password sign-in)
• Profile image URL, when provided by an identity provider
• Account creation and update timestamps

If you sign in with Google, we receive basic profile information from Google that you authorize during the OAuth consent flow. This typically includes your Google account identifier, name, email address, and profile image. We use this information only to create and maintain your FormSquid account, authenticate you, and (when enabled) link a Google account to an existing FormSquid account with the same email address. We do not use Google user data for advertising, and we do not sell Google user data.

3.2 Form configuration and content you create

When you use FormSquid as an account holder, we store:

• Form titles, field definitions, copy, appearance settings, and draft/published versions
• Form slugs and registry keys used for hosted URLs and source export
• Optional notification email addresses you configure for a form
• Optional webhook destination settings you configure for a form
• Prompts and related inputs you provide to generate or edit forms with AI

3.3 Form submissions and uploads

When a respondent submits a form you host on FormSquid, we collect:

• The answers and files the respondent provides in the form fields you configured
• Submission timestamps and technical metadata needed to store, rate-limit, and deliver the submission
• Hashed request identifiers used for abuse prevention and rate limiting (not used as a public profile)

File uploads attached to form submissions are stored in object storage associated with your form so you can review and download them from your inbox.

3.4 Technical and usage information

We automatically collect limited technical data such as:

• IP address and user agent associated with authenticated sessions
• Approximate usage events (for example, page views and product funnel events)
• Diagnostic logs needed to operate, secure, and debug the service

We use Vercel Analytics for product and traffic measurement. Analytics events are processed in a way that avoids including unnecessary query strings and redacts sensitive path segments where practical.

4. How we use information

We use the information described above to:

• Provide, operate, and improve FormSquid
• Authenticate users and maintain account security
• Generate, edit, publish, and host forms
• Store submissions and file uploads for account holders
• Send optional email notifications related to authentication or form submissions
• Deliver optional signed webhooks you configure
• Prevent abuse, spam, fraud, and rate-limit violations
• Analyze product usage and improve reliability and performance
• Comply with legal obligations and enforce our Terms of Service

AI features may send prompts and relevant form context to third-party model providers so we can generate or edit form content. Do not include secrets or sensitive personal data in prompts unless necessary for your use case.

5. How we share information

We do not sell personal information. We share information only as needed to operate the service or as required by law, including with:

• Infrastructure and database providers that host FormSquid and store account, form, and submission data (including Neon Postgres and our application hosting provider)
• Object storage providers that store uploaded files attached to submissions
• Email delivery providers (such as Resend) when we send password-reset or optional submission notification emails
• Google, when you choose Google sign-in, to authenticate your account through Google's OAuth services
• AI model providers used to power form generation and editing features
• Analytics providers used for product and website analytics
• Destinations you configure, such as webhook endpoints or notification email addresses you set on a form
• Professional advisors or authorities when reasonably necessary to comply with law, protect rights and safety, or respond to lawful requests

If FormSquid is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality and continuity protections.

6. Cookies and session technology

FormSquid uses cookies and similar technologies that are necessary to keep you signed in, protect sessions, and operate the service. Session records may include IP address and user agent information for security and account integrity. We do not use third-party advertising cookies to track you across unrelated sites for ad targeting.

7. Data retention

We retain account information for as long as your account remains active. Form definitions, submissions, and uploads are retained while associated with an active account and form, unless deleted earlier by you or as part of account/form deletion workflows.

We may retain limited logs, backups, or security records for a longer period when needed for abuse prevention, dispute resolution, legal compliance, or reliable service operation. When retention is no longer necessary, we delete or de-identify the data.

8. Security

We use administrative, technical, and organizational measures designed to protect personal information, including encrypted transport (HTTPS), hashed passwords for email/password accounts, access controls, and abuse protections such as rate limiting. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your choices and rights

Depending on your location and applicable law, you may have rights to:

• Access the personal information we hold about you
• Correct inaccurate account information
• Delete your account or request deletion of personal information
• Export or obtain a copy of certain information you provided
• Object to or restrict certain processing, where applicable

Account holders can manage much of their data directly in the product (for example, reviewing submissions, deleting forms, or updating account settings). To make a privacy request, email privacy@formsquid.com. We may need to verify your identity before completing the request.

If you submitted information through a form owned by another FormSquid customer, contact that form owner first. We can assist the account holder with technical deletion or access where appropriate.

10. International processing

FormSquid is operated using cloud infrastructure that may process data in the United States and other countries where our providers operate. If you access the service from outside those locations, your information may be transferred to and processed in those countries.

11. Children's privacy

FormSquid is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact privacy@formsquid.com and we will take appropriate steps to delete it.

12. Third-party services and links

The service integrates with third-party providers for authentication, hosting, storage, email, analytics, and AI features. Those providers process information according to their own privacy policies in addition to our instructions. FormSquid pages may also link to external sites we do not control.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, when changes are material, take additional steps that are reasonable under the circumstances, such as posting a notice on the site or contacting account holders.

14. Contact

Questions about this Privacy Policy or FormSquid's data practices can be sent to privacy@formsquid.com.

Related: Terms of Service