Privacy Policy

Formleak is run by [PLACEHOLDER: company name], [PLACEHOLDER: address], [PLACEHOLDER: company registration number].

For questions about privacy, email [PLACEHOLDER: contact email].

This policy covers two groups of people: website owners who use Formleak, and the visitors of those owners' websites. For visitor data, the website owner decides why it is collected and we process it on their behalf.

When you create an account and use Formleak, we keep:

• your email address and a password (stored only as a secure hash by our sign-in provider),
• the websites you add: their name, web address, time zone and a public site key,
• whether you turned off trial reminder emails, and which reminder emails we already sent you,
• billing details once paid plans exist (handled by [PLACEHOLDER: payment provider]).

When you're logged in to the Formleak dashboard, a login cookie keeps you signed in. It is necessary for the dashboard to work and isn't used for anything else.

The Formleak tracker on your website records how visitors move through your forms, field by field. Each event contains:

• what happened: the form was seen, started, a field was clicked into or left, an error message appeared, an answer was changed, the form was sent or left unfinished,
• which form and field, by their name in your page's code (or label text), plus the field's type and position,
• whether a field had something in it when the visitor left it (yes or no), and how long they spent on it,
• how a successful send was noticed,
• the page path the form is on, without anything after a “?” or “#”,
• the type of device: mobile, tablet or desktop,
• a traffic-source category: direct, search, social, paid ads, email, referral or other,
• a random ID that only lives for one page view, and the time of each event.

• No cookies, no local storage. The tracker doesn't place cookies or store anything in the visitor's browser. Its ID is forgotten when the page closes.
• Never what people type. The tracker only checks whether a field is empty. It never records or sends what is in it, including passwords.
• No IP addresses. Formleak doesn't store or log visitors' IP addresses. Our hosting provider (Vercel) handles every request and may keep IP addresses in its own short-lived request logs.
• No browser details or referrer addresses. The device type is worked out from the browser's description of itself, which is then discarded. The traffic source is worked out in the browser; only the category is sent, never the referring address, campaign tags or ad click IDs.

Because nothing is stored in the browser, Formleak can't recognise a returning visitor or follow someone across pages or websites.

• Raw form events are deleted automatically after 90 days.
• Daily totals (counts per form, field, day, device type and traffic source, with no per-visitor detail) are kept as long as the website is in your account.
• Spam-protection counters per website and page view are removed within two days.
• Your account details are kept until you delete your account.
• Copies in database backups may remain for up to [PLACEHOLDER: backup retention period] before they are overwritten.

You can delete a website from its page in the dashboard (“Danger zone”). This permanently removes the website, its tracking code, all its form events, daily totals and email records at once. The tracking code stops working.

You can delete your whole account on the Account page. This permanently removes all your websites and their data, your email settings and your login. There is no undo.

• to show you how your forms perform and suggest fixes,
• to run your account and keep the service secure (for example, limiting how many events one page can send),
• to send you a few emails during your trial, which you can unsubscribe from at any time,
• to bill you, once paid plans exist.

• Supabase: database and sign-in. Data is stored in the London region (United Kingdom).
• Vercel: hosting of the dashboard, the tracker and the event endpoint.
• Resend: sending account and reminder emails.
• [PLACEHOLDER: payment provider]: payments, once paid plans exist.

You can see, correct, export or delete your data, object to how it's used, or ask us to limit its use. Most of this you can do yourself in the dashboard; for anything else, email [PLACEHOLDER: contact email]. You can also complain to your data protection authority ([PLACEHOLDER: supervisory authority]).

Visitors of a website that uses Formleak should contact that website's owner, who decides how their data is used. We help owners answer such requests.

If we change this policy, we'll update the date at the top and, for important changes, email account holders before they take effect.