Your data
Privacy tools that are built in
Export what you have, delete what you want gone, and keep respondent data to what you actually need.
Your account
From Account and security you can download everything tied to your account as JSON and delete the account. Deleting removes the forms and responses you own, and Formwork tells you first if something would be left without an owner.
Responses
Owners and editors can delete individual responses. A form moved to the trash is kept for 30 days and then removed with its responses and files, unless you restore it.
What is stored about respondents
A response stores the answers, the timestamps, a coarse device, browser and operating system, the referring host and any hidden field values you configured. IP addresses are never stored as they are: they go through a salted hash that changes every day and is used for abuse control.
Retention
Unresumed partial responses are deleted after 30 days. Audit log entries are kept for a year, webhook delivery logs and mail logs for 30 days.
Where the data lives
In the database and file storage of the server your copy of Formwork runs on. Uploaded files sit outside the public web root and are only served through the application.