Privacy Policy
Last updated: 2026-09-02
Two kinds of people
This service sits between two groups, and they are treated differently. The distinction runs through the whole policy.
| Our users | Developers who create an endpoint. We hold your email address and your endpoint settings. You are our customer, and section A is about you. |
|---|---|
| Visitors | People who fill in a form on a customer's site. We store what they submitted so it can be delivered. Section B is about that data, and we handle it on the customer's behalf rather than for our own purposes. |
Under the data protection laws that use those words, the customer is normally the controller of what their form collects and we are the processor. Which law applies, and how it labels each side, depends on where everyone involved is — the Data Processing Agreement is the contract that fixes the relationship between us and the customer.
A. Information about our users
- Account data — the email address you signed up with, your plan, and a dated record of each time these documents were accepted.
- Endpoint settings — the name you gave an endpoint, its authorized domains, its recipients and its spam settings.
- Usage information — how many submissions your endpoints received, so we can count them against your plan.
- Technical logs — the ordinary records a web service keeps when it answers a request, including IP address and a truncated user agent, kept for security and debugging.
We hold no payment information, because checkout is not open yet. When it is, payments will be handled by a payment provider and this policy will say so before the first charge.
B. Information processed through customer forms
Our customers use the service to collect information through their own forms. A customer builds a contact form; their visitors type a name, an email address, a phone number, a message — whatever that customer decided to ask for. We provide the infrastructure that receives, filters, stores and delivers those submissions.
- Submission content — every field the form sent us. We cannot know in advance what those fields are: the service is schema-less by design.
- Delivery metadata — timestamps, delivery status, spam score, the origin domain, and a truncated user agent.
The customer decides what is collected and for what purpose. We act on their configuration and do not use their submissions for our own purposes.
If you filled in a form on someone else's site and want your submission removed, contact the site owner first — they decide what happens to it. If you cannot reach them, write to us and we will pass the request on and act where we are required to.
How we use information
- To run the service: accept submissions, filter spam, store them, deliver them.
- To operate accounts: sign you in, apply your plan's limits, and send the transactional messages the service depends on.
- To keep the service safe: detect and stop abuse, spam and attacks on the infrastructure.
- To meet legal obligations, and to establish or defend legal claims.
We do not sell personal data, we do not share it with advertisers, and we do not use submissions to train anything.
Legal bases for processing
Where a law such as the GDPR or the LGPD requires one, the basis depends on what is being processed:
- Performance of a contract — running the service for the person who asked for it.
- Legitimate interests — security, abuse prevention, and keeping the service working.
- Legal obligation — where we are required to keep or produce something.
- Consent — only where consent is actually the right basis. It is not the basis for everything we do, and saying that it was would be inaccurate.
For submissions collected through a customer's form, the basis is the customer's to determine. That is their responsibility under the Terms.
Third-party services
Running the service requires providers we do not own: hosting and network infrastructure, database hosting, email delivery, and — once checkout opens — payment processing. They process data on our behalf, under terms that bind them to protect it, and only for what we ask them to do.
We do not publish the list of those providers at this stage. If you need to know who they are for your own compliance review, write to privacy@honeyforms.dev and we will tell you.
International data transfers
Submissions are processed at the network edge, close to whoever submitted them, and the service runs on global infrastructure. Personal data may therefore be transferred to and processed in a country other than your own, including countries whose data protection rules differ from those where you live. Where such a transfer needs a legal basis, we rely on the safeguards the applicable law provides for it, and we require our providers to offer protection consistent with this policy.
Data retention
We keep data for as long as we need it to provide the service, to meet legal obligations, and for the purposes described here.
Submissions are deleted on a schedule according to the plan: 30 days on the free tier, and for as long as your subscription is active on paid plans. Deletion is real removal from the database, not hiding from a dashboard.
After a cancellation or a downgrade, submissions that fall outside the retention window of the new plan are deleted within 14 days. Export first if you need them.
Security
What actually protects the data today:
- Encryption in transit, end to end, on every request.
- Encryption at rest at our database provider.
- Credentials scoped to a single endpoint and revocable by you at any time.
- Domain locking, so a copied key cannot be used from somewhere else.
- A honeypot field on every generated form, and an optional challenge you can turn on per endpoint.
- Access to production limited to the people who operate the service.
We hold no security certification and have commissioned no third-party audit or penetration test. Claiming otherwise would be the easiest sentence in this policy to write and the one most worth not writing.
Privacy rights
Depending on where you live, you may have the right to access, correct, export or delete your data, to object to or restrict processing, and to complain to a supervisory authority. Write to privacy@honeyforms.dev and we will respond within 30 days.
Cookies and analytics
The one cookie we set. Signing in to your account stores a single cookie
named hf_session in your browser. It is strictly necessary — it is what keeps
you signed in — it holds nothing but a signed reference to your account, it expires after
seven days, and signing out removes it. It is never set for people who submit your forms,
only for you.
We run no analytics, no advertising pixels and no third-party trackers, on this site or on the submissions that pass through it. There is nothing else to consent to, which is why there is no cookie banner and no separate cookie policy.
What we send to your address
There is no marketing consent step when you create an endpoint, and we never sell, rent or share your address with anyone. We use it to deliver your form submissions, to confirm the address, to send account notices such as approaching a limit, and — rarely — to tell you about a change to the service itself, such as a plan opening. Nothing else, and never on behalf of a third party.
Children's privacy
The service is built for developers and is not directed at children. We do not knowingly collect personal data from children. If you build a form that collects data from children, that is your responsibility under the Terms and you need a lawful basis for it. If you believe a child's data reached us, write to us and we will delete it.
Changes to this Privacy Policy
We may update this policy. The date at the top changes when we do, and material changes are announced to account owners by email before they take effect.
Contact
Write to privacy@honeyforms.dev. We read everything that arrives there.