Privacy policy

This policy explains what personal data this Formwork service collects and what happens to it. In it, “we” means the organisation that operates this copy of Formwork.

What we collect

Account data. Your name, email address and a hashed password, or the identifier KingsChat gives us when you sign in with it. Workspace membership and the settings you choose.

Content you create. Forms, themes, files you upload to them, and the responses your forms collect. You decide what to ask and you are responsible for having a reason to ask it.

Respondent data. When someone fills in a form, we store their answers, timestamps, a coarse device type, browser and operating system, the referring host, and any hidden field values the form owner configured. We do not store IP addresses as they are; we keep a salted hash that changes every day and is used to limit abuse.

Messages and signups. If you use the contact form, we keep your name, email address, company and message. If you subscribe to release notes, we keep your email address.

Technical logs. Error logs and audit entries for security-relevant actions such as changing settings or creating API keys.

Why we use it

To run the service, to keep it secure, to answer you, and to send email you asked for, such as password resets, form notifications and release notes.

Who sees it

Form owners and the people they invite to a workspace see the responses to their forms. Our operators can see account and workspace records when they need to support you or investigate abuse, and impersonating a user is recorded in the audit log. We do not sell personal data.

How long we keep it

• A form moved to the trash is deleted after 30 days.
• Unfinished responses nobody resumes are deleted after 30 days.
• Audit log entries are kept for one year.
• Webhook delivery logs and outgoing mail logs are kept for 30 days.
• Everything else stays until you delete it or close your account.

Your choices

You can download your account data and delete your account from Account and security. Form owners can delete individual responses at any time. To ask for something else, use the contact page.

Cookies

See the cookie notice.

Changes

When this policy changes materially, the date at the top of the page changes and we say so in the changelog.