Privacy notice

What this install stores about account holders and respondents, why it is kept, for how long, and how to exercise your rights over it.

Tinyform is open-source software, and every copy of it runs on somebody's own server. Everything described here lives on the server of the person or organisation running this one, called the operator below — so who holds your data is whoever operates the install you are reading this on, and nobody else. This notice covers the two kinds of people that server holds data about, the account holders who build forms and the respondents who fill them in.

Who is responsible

For account data, the operator of this install is the controller.

Operator: [name, legal form and address]. Contact: [email address].

For what a respondent types into a form, the account holder who built that form is the controller. The operator stores and delivers those answers on the account holder's behalf, under the terms at Data Processing Agreement. If you filled in a form and want to know what happened to your answers, the form's owner is the first person to ask.

What is stored about an account holder

• Your name, email address and, if you set one, a profile photo.
• Either a hash of your password or, where the operator has enabled Google sign-in, the identity Google hands over. The password itself is never stored.
• The secret behind two-factor authentication, if you turned it on.
• Which workspaces you belong to, the invitations you sent and accepted, and the forms, folders, API keys, webhooks and connected domains you created.
• Each signed-in session, with the IP address and browser it was started from.
• If the operator sells a paid plan, a customer reference and a subscription reference at the payment processor, and a monthly count of the usage the fair-use allowances measure.

What is stored about a respondent

• The answers you typed, keyed by the form's questions, plus any files you attached and any signature you drew. Files and signatures go to a storage bucket that has no public address; only a member of the owning workspace, or a link the server signed for a limited time, can read them.
• If the form's owner turned on Partial submissions, the answers you gave before submitting are stored as you go and marked as unfinished.
• If the owner turned on Prevent duplicate submissions and chose to compare on the request's address, a salted hash of that address, never the address itself. If they chose to compare on your browser instead, a random identifier the page keeps in your own browser's storage, which carries nothing about you.
• If the form contains a Respondent's country block, the country worked out from your address against a database on the server's own disk. No outside service is asked.
• If the form contains a Verify email question, the address you entered and the code that was mailed to it, until the code is used or expires.

What analytics records

The server counts views, starts, answers and submissions for each form so its owner can read the Insights tab. A visitor is identified by a hash of their address, their browser and the current date, taken under a secret only this install holds; because the date is part of what is hashed the value changes daily, so the same person cannot be followed from one day to the next or from one form to another. Alongside it the event keeps a country and city from the local lookup, the device type, browser and operating system read off the request, the host name of the page that linked to the form, and which question was reached, so the owner can see where people give up. No answer is ever recorded there. No address is stored, no cookie is set, and none of it leaves the operator's own server: views and submissions are recorded by the server from the request itself, and starts and answers are batched by the page and sent back to that same server.

Why it is processed

• To create and secure your account and sign you in.
• To store a form's answers and show them to the workspace that owns the form.
• To send the emails you or a form owner asked for: a magic link, a password reset, a workspace invitation, a submission notification, a verification code.
• To draw the Insights tab for a form's owner.
• To protect the server against abuse, through rate limits, the duplicate check and, where configured, reCAPTCHA.
• To bill for a paid plan, where the operator sells one.

The legal basis for each of these is for the operator to state here: [contract, legitimate interest, consent, legal obligation, as applicable].

Who else receives it

Every component the product needs runs inside the operator's own stack by default: the database, the file store and the analytics store. Anything beyond that is configured by the operator and is off until they configure it.

The operator lists their actual providers here: [name, purpose, country].

How long it is kept

• An account, until you delete it from your account settings. Deleting it passes ownership of a workspace you shared to its longest-standing other member, and removes a workspace you were the only member of.
• A form, until its owner deletes it, then thirty days in the trash before it is removed for good.
• A submission, until the form's owner deletes it or until the form's own Submissions data retention window expires. Deleting one from the Submissions tab removes the row, the files you attached and the signature you drew, together.
• Raw analytics events, ninety days. Daily totals computed from them are kept.
• A signed-in session, until you sign out or it expires, which is seven days after it was started.
• The counters that stop somebody hammering a form, a password box or the sign-in page. These hold the raw address they are counting, and are deleted an hour after the window they belong to.
• An email verification record, until its code is used or expires, after which it is pruned.
• Database backups, taken daily and kept for thirty days on the default install. The operator states their own backup arrangement here: [retention and location].

Your rights

Depending on where you live you may have the right to see what is held about you, to correct it, to have it deleted, to receive a copy in a portable form, to object to some processing, to withdraw a consent you gave, and to complain to a supervisory authority.

For your account, write to the operator at the address above. For your answers to a form, write to the form's owner; the owner can export a form's submissions as a CSV file and delete any submission from the Submissions tab, and the operator will assist them where they cannot act alone. Account holders can change their own details and delete their own account from Account settings.

Security

Connections are served over TLS. Passwords are stored as hashes and form passwords as salted hashes. Attachments live in a bucket with no public door. Two-factor authentication is available to every account. Access to a form's data is limited to the members of the workspace that owns it. The operator describes any further measures, such as disk encryption and off-site backups, here: [measures].

Changes and contact

The operator may update this notice and should record the date of the last change here: [date]. Questions go to [email address]. If this deployment has no address set, the Support page says so and explains what to do instead.