Security

Security and data handling

The short, factual version. The privacy policy has the full detail.

Access to your Google account

• Permissions: your name and email, and drive.file, which covers only spreadsheets Freely Forms creates or that you choose for it.
• Your long-lived Google token is stored encrypted, with keys kept outside our database, and never sent to the browser. Only Google's file picker gets a short-lived token while it's open.
• You can disconnect Google or delete your account at any time; your spreadsheets stay in your Drive.

Responses

• Answers are encrypted as soon as they're accepted and kept only until they're written to your sheet.
• If delivery is blocked (for example, the sheet was deleted), encrypted answers wait at most 7 days, then they're deleted.
• Delivery records keep IDs, times and status, never answers, and are deleted after 30 days.
• Answers are written as plain values: a response can't run a formula in your sheet.

Public forms

• Forms are served from a separate domain, freelyforms.link, and set no cookies.
• Spam protection: Cloudflare Turnstile, rate limits and a hidden honeypot field.
• Every form has a "Report abuse" link.

Reporting a vulnerability

Email hello@freelyforms.com with the subject SECURITY.