Privacy Policy

1. Who this applies to

This policy describes how Branch Forms (“we,” “us,” or “the service”) processes information when you use this website and related services. The party operating a particular deployment is responsible for configuring the service and may be reached using the contact information provided on that deployment, if any.

There are two main groups of users: account holders (form owners who sign up to build and manage forms) and respondents (people who fill out a published form, typically without creating an account).

2. Information we collect

• Account holders: email address and credentials used with Supabase authentication; session data stored in cookies or similar technologies to keep you signed in.
• Form content: form titles, descriptions, section and question definitions, branching rules, and related configuration you save as the form owner.
• Responses: answers and related metadata submitted through published forms (for example, which path through branching was taken), stored so form owners can view and export responses.
• Optional Google connection: if you connect a Google account for Google Sheets integration, we use Google’s OAuth flow. Tokens needed to access spreadsheets on your behalf may be stored server-side; we do not post your Google password in the application.
• Technical data: standard server and infrastructure logs (for example, IP address, user agent, timestamps) as processed by your hosting provider and database/auth providers for security and reliability.

3. How we use information

We use the information above to:

• Provide, operate, and secure the service
• Authenticate account holders and enforce access controls
• Store and display form responses to the owning account
• Optionally sync responses to a Google Sheet you connect, when that feature is enabled
• Debug issues and protect against abuse

4. Legal bases and respondents

Form owners decide what questions to ask and how to use responses. If you are a respondent, the form owner’s privacy practices also apply to how they use the data they collect from you. We process respondent submissions to deliver them to the form owner (and optional integrations they enable).

5. Third-party services

The service relies on infrastructure and vendors that process data on our behalf, including:

• Supabase for authentication and database storage
• Google (optional) for Google Sheets when you connect an account
• Your hosting provider (for example, a cloud platform serving this application)

Those providers have their own privacy policies. We do not sell your personal information.

6. Retention and deletion

We retain data for as long as needed to provide the service and as permitted by the operator of this deployment. Form owners can delete forms or their account according to product features available on this deployment. Respondents generally cannot delete submissions through the public form; contact the form owner if you need to exercise rights regarding a specific response.

7. Security

We use industry-common measures such as encrypted connections (HTTPS), access controls for account data, and database policies intended to restrict form data to the owning account. No method of transmission or storage is completely secure.

8. International transfers

Data may be processed in countries where Supabase, your hosting provider, or Google operate facilities. By using the service, you acknowledge that data may cross borders as needed to operate the product.

9. Children’s privacy

The service is not directed at children under 13 (or the age required by your jurisdiction). Do not use the service to collect information from children in violation of applicable law.

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the service after changes constitutes acceptance of the updated policy, to the extent permitted by law.

11. Contact

Questions about this policy: zxyandreay@gmail.com.