Privacy Policy

Last updated: 2 August 2026

1. Who we are

Borderforms ("we", "us") operates this website and is the data controller for the personal data described here. You can reach us at support@borderforms.com. One important distinction: what a form asks of the people filling it in is decided by the form's creator, not by us. We host responses on the creator's behalf; questions about a specific form's content belong with its creator first.

2. What we collect

• From free form creators: nothing about you. There is no account, no email, no name. Your secret links are the only credentials, and we do not know who holds them.
• From Premium buyers: the billing email you enter at Stripe checkout, used to send receipts and to recover your plan's links.
• Form content and responses: the forms you build and the answers they collect, stored so the service works.
• Timezone: read from your browser so dates and times appear in your local time.
• Respondent country: when you submit a form, your IP address is looked up against a country database held on our own server and the two-letter country code is saved with your response. The form's creator can see it, export it, and receives it in their new-response email. Country only: no region, no city, and the IP address itself is not stored.

We do not operate user accounts and we use no advertising trackers. Forms do keep simple counters, totalled per form per day: how many times a form was opened, how many people started filling it in, and how far through a multi-page form they got. No cookie, visitor identifier or IP address is stored with them, so there is no way to reconstruct one person's visit from these numbers, and the creator sees totals only.

We never store IP addresses. Yours is used at the moment of the request and then discarded: to look up the country above, to rate limit abuse, and, on forms whose creator turned the CAPTCHA on, to pass to Cloudflare with the challenge. No table in our database has a column for it and our request logs do not record it.

3. Cookies and similar storage

• Timezone (ch_tz): stores your timezone so dates and times appear in your local time.
• Theme preference: your light or dark choice, stored in your browser and never sent to us.
• Form unlock (bf_unlock): set only when you enter the password of a password-protected form, so you don't retype it on every page. Scoped to that one form; holds no identity.
• Already responded (bf_done): set after you submit a form whose creator turned on "one response per person", so returning to that link shows a note instead of a blank form. Scoped to that one form; holds no identity.
• Analytics de-duplication: a flag kept in your browser's session storage so one visit is not counted twice. Never sent to us.

4. How we use your data

To run the service, deliver recovery emails to Premium billing addresses, answer support requests, prevent fraud, and meet tax and accounting obligations on paid plans.

5. Who we share it with

• Stripe: processes Premium payments and collects your billing email at checkout.
• Resend: our email delivery provider, sends recovery and new-response emails to Premium billing addresses.
• Cloudflare: two separate things. Their Turnstile service runs the CAPTCHA on forms whose creator turned it on, and receives your IP address to do so. Their R2 storage holds our encrypted off-site backups, which include form content and responses.
• Hetzner: rents us the server everything above runs on.
• Authorities: where the law requires it.

We never sell your data.

6. Where your data is processed

Your forms and their responses are stored on our server in Germany, rented from Hetzner. That is where the service runs and where the database lives, and everything on it is backed up off-site, encrypted. Nothing about a form or a response goes anywhere else except in the cases below.

• Backups. Encrypted off-site backups, which include form content and responses, go to Cloudflare's R2 storage.
• Payments. Stripe handles Premium checkout and holds the billing email. Stripe is a US company and processes this data accordingly.
• Email and CAPTCHA. Resend sends our emails, so it sees the recipient address and the message. Cloudflare Turnstile sees the IP address of anyone submitting a form whose creator turned the CAPTCHA on. Both operate globally.

Where those transfers leave the UK or the European Economic Area, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses.

7. How long we keep it

Forms and their responses are kept while the form exists. Whoever holds the edit link can delete a form, or empty it of responses, from its settings page; whoever holds the results link can erase a single response. All three are immediate and final. There is no account to restore them to, so we keep no copy, allow no grace period, and cannot undo any of it on your behalf. Premium billing records, including the billing email, are kept as long as tax and accounting law requires, then deleted. A lapsed plan switches premium features off but deletes nothing.

8. Your rights

You can ask us to access, correct or delete the personal data we hold about you; deletion may be limited by legal retention duties. Where your data sits inside someone else's form responses, contact that form's creator first, since the responses are theirs: they can erase your response themselves from the form's results page, and they are the ones who decide to. In the EEA or UK you can also complain to your data protection authority.

9. Children

This service is not directed at children, and we do not knowingly collect personal data from anyone under 16. Contact us and we will delete it where you believe a child has given us their personal data.

10. Changes

When this policy changes, the new version is published on this page with an updated date.