Privacy Policy

FileUploadForm ("we", "us") is a product of Optimistix Lab. It lets people ("form owners") create upload forms whose files are saved to the form owner's own Google Drive. This policy explains what we collect, why, and what you can do about it.

The short version

• Uploaded files go from the sender's browser directly to the form owner's Google Drive. They do not pass through or get stored on our servers.
• We only ask for the Google Drive permission to manage files and folders FileUploadForm creates. We can't see the rest of your Drive.
• We don't sell personal data and we don't use it for advertising.

Information we collect

Form owners

• Google account details: your name, email address, profile picture and Google account ID, received when you sign in with Google.
• Google Drive access token: a refresh token that lets FileUploadForm create folders and upload sessions in your Drive. We store it encrypted.
• Your forms: form names, field settings and the IDs of the Drive folders we created for them.
• Billing (Pro): your Paddle customer and subscription IDs and subscription status. Card details go to Paddle; we never see them.

People who send files ("senders")

• The details they type into a form: name, email address, message and answers to any custom fields.
• The names, types and sizes of the files they send, and when they sent them.
• The file contents themselves are uploaded straight to the form owner's Google Drive. We do not store them.

Abuse reports

If you report a form, we store the reason, any details you give and, if you choose to share it, your email address. We don't share your identity with the form owner.

Technical data

Like most websites, our hosting provider processes IP addresses, browser information and request logs to deliver the service, keep it secure and fix problems. We keep IP addresses for a few minutes to limit abuse. We use a session cookie to keep form owners signed in and short-lived cookies during Google sign-in. We do not use advertising or tracking cookies. We count visits to our website with Matomo, which we host ourselves; it sets no cookies and doesn't run on upload pages.

How we use information

• To run the service: sign you in, create Drive folders, start uploads, and show submissions in your dashboard.
• To write a details.txt file with each submission's details into the form owner's Drive folder.
• To email form owners when a new submission arrives (the email includes the sender's details and file names, with Reply-To set to the sender).
• If the form owner turns it on, to email senders a short confirmation that their files arrived.
• To keep the service secure, prevent abuse and troubleshoot errors. Our administrators can see account details, form settings and submission records (not file contents) for this purpose.
• To send essential service messages to form owners.

Google user data

FileUploadForm's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We request the openid, email, profile and drive.file scopes. drive.file only covers files and folders that FileUploadForm creates or that you open with it.
• We use Google user data only to provide and improve the features you see in FileUploadForm.
• We do not transfer Google user data to others except as needed to provide the service, comply with law, or as part of a merger or acquisition with notice to you.
• We do not use Google user data for advertising, and humans do not read it unless you ask us to, it's needed for security or abuse investigation, or the law requires it.
• We do not use Google user data to train AI or machine learning models.

Service providers

We share data only with providers that help us run FileUploadForm:

• Cloudflare: hosting, database and network delivery.
• Google: sign-in and Google Drive storage (files are stored in the form owner's Drive under Google's terms).
• SMTP2GO: delivery of notification emails.
• Paddle: payments for Pro, as our reseller and Merchant of Record.

Retention and deletion

We keep account and submission records while your account is active. Files you receive live in your Google Drive and are under your control; deleting them in Drive deletes them. You can disconnect FileUploadForm at any time from your Google Account's security settings (Third-party apps with account access). To delete your FileUploadForm account and its records, email us and we'll do it within 30 days.

Your rights

You can ask us for a copy of your data, to correct it, or to delete it. Email us and we'll respond within 30 days.

Senders' rights

If you sent files through a form, the form owner decides what happens to them. Contact the form owner first. If you can't reach them, email us and we'll help where we can.

Security

Traffic is encrypted with HTTPS, Drive tokens are encrypted at rest, and access to production systems is limited. No system is perfectly secure, but we work to protect your data and will notify affected users of a breach as required by law.

Children

FileUploadForm is not directed at children under 13, and form owners must be old enough to agree to our Terms.

Changes

We'll update this page when our practices change and revise the date above. Significant changes will be emailed to form owners.

Contact

Questions or requests: hello@fileuploadform.com.