Privacy policy

Last updated 16 October 2026

Freely Forms is a free, non-commercial, open-source form builder. Forms are built with Freely Forms; the responses go to the form owner's own Google Sheet. This policy explains what we handle, why, and for how long. Questions: hello@freelyforms.com.

The short version

• We do not keep a database of form responses. A response may be held temporarily, encrypted, while it is being delivered to the owner's Google Sheet. Undelivered responses are deleted automatically no later than 7 days after submission.
• We ask Google only for your name, email address and access to the files Freely Forms creates or that you choose for it. We cannot see the rest of your Drive.
• No advertising, no selling of data, no tracking cookies, and no use of responses to train AI models.

If you build forms (form owners)

When you sign in with Google we store:

• your Google account ID, email address and name;
• the Google permissions you granted, and a Google refresh token, encrypted, so we can write responses to your sheet while you are away;
• your form definitions (titles, questions, options, settings) and their published versions;
• the ID of each response spreadsheet we created for you, its tab, which column belongs to which question, and its connection state;
• delivery records for each response: an ID, the form and its version, the spreadsheet, timestamps, the delivery state, attempt counts and error codes. They contain no answers and are deleted after 30 days;
• a session record that holds only a hash of your session token, for at most 30 days.

Google user data

Freely Forms requests these Google permissions:

• openid, email, profile — to sign you in and show who is signed in.
• drive.file — to create a response spreadsheet in your Drive, add a row for each response, add columns for new questions, attach hidden labels that tell Freely Forms which column belongs to which question, and read the response-ID column so a response is never written twice. If you choose one of your existing spreadsheets in Google's file picker, Freely Forms adds its own responses tab to it and does not change your other tabs. The permission works only on spreadsheets Freely Forms created or that you chose, and gives no access to any other file. While the picker is open, your browser receives a short-lived Google access token so the picker can list your spreadsheets.

We use Google user data only to provide these features to you. We do not use it for advertising, do not sell it, do not let people read it except when you ask us to help or when the law requires it, and do not use it to train AI models. Freely Forms' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you fill in a form (respondents)

Your answers belong to the person or organisation that published the form. They decide what the form asks and what happens to your answers in their spreadsheet; ask them about your data. Freely Forms only carries your answers to their Google Sheet:

• Answers are encrypted as soon as they arrive and wait in a delivery queue until they are written to the sheet, usually within seconds.
• If the owner's sheet is unavailable, the encrypted answers wait at most 7 days and are then deleted, delivered or not.
• After delivery we delete our copy right away; in rare cases a leftover encrypted copy expires on its own within the same 7 days. We keep only a delivery record without your answers (see above).

To stop spam we use your IP address for rate limiting and, when enabled, Cloudflare Turnstile, a privacy-focused challenge instead of a CAPTCHA. We do not store your IP address in our database.

Cookies

Only form owners get cookies from us, and only essential ones: a session cookie (up to 30 days) and a short-lived cookie that protects the Google sign-in (10 minutes). We set no cookies on forms, and we use no analytics or advertising cookies.

Service providers

• Cloudflare runs our servers, database, delivery queue, temporary encrypted storage and Turnstile. Its systems record request metadata (such as time, path and status) in short-lived logs.
• Google provides sign-in and stores responses in the owner's Google Sheets under the owner's Google account.

Security

Refresh tokens and queued responses are encrypted with keys kept outside our database. Our source code is public, so anyone can check how data is handled.

Your choices

• On the Account page you can disconnect Google or delete your account. Deleting it removes your forms, their history and all records above, asks Google to revoke our access (we tell you if Google does not confirm it), and discards responses still waiting for delivery; any encrypted copy left in temporary storage expires within 7 days. Your spreadsheets stay in your Drive.
• You can also remove Freely Forms' access at myaccount.google.com/permissions.
• For any other request about your data, write to hello@freelyforms.com.

Changes

We will update this page when the service changes and note the date above.