Privacy Policy

• Account information.When you sign in with Google, we receive your name, email address, and profile picture.
• Documents you upload.PDFs and images you upload are processed by our AI to generate your form.
• Forms and responses.We store the forms you create and the responses submitted to them so you can access them from your dashboard.
• Usage and reliability data.We use Google Analytics and PostHog to understand visits, sessions, and product steps such as starting or completing a form workflow. We use a self-hosted SigNoz system for application errors, performance measurements, and service health. We do not send document contents, form answers, uploaded filenames, authentication tokens, or email addresses to PostHog or SigNoz.

• To generate, host, and share the forms you create.
• To collect and deliver form responses to form owners.
• To operate, secure, and improve the service.
• To communicate with you about your account.

Your uploaded files are used to generate your form. We do not share your original documents with third parties, and we do not use them to train AI models.

We use cookies to keep you signed in and to maintain anonymous or signed-in product analytics sessions. Google Analytics measures site usage. Google Ads measures whether an ad visit leads to a successfully published form, using ad-click identifiers and cookies. This conversion event contains no document contents, form answers, filenames, email addresses, or private form URLs. Ad personalization is disabled for this measurement, and we skip it when the browser sends Do Not Track or Global Privacy Control. PostHog receives deliberately named product events and page paths with query strings removed. You can block cookies in your browser settings; the core product will still work, though you may need to sign in more often and anonymous sessions may not be linked across visits.

We may use sampled, privacy-masked session replay to diagnose where a product flow is confusing or failing. Text and form inputs are masked, sensitive product surfaces are blocked, network bodies and console output are not recorded, and replay is not used to capture documents, answers, or signatures. Browser errors may include a technical stack trace and page path, but not the contents of a form or upload.

We rely on a small number of service providers to run Magic Form, including Google (sign-in, site analytics, and ad conversion measurement), PostHog (product analytics), and cloud infrastructure providers that host our servers and storage. SigNoz is operated inside our own cloud environment. These providers process data only on our behalf.

We do not sell your personal information. We share data only with the service providers above, when required by law, or to protect the rights and safety of our users.

Forms and responses are kept while your account is active so you can keep using them. You can delete forms from your dashboard at any time. To delete your account and associated data, contact us at the address below.

We use industry-standard measures — encrypted connections (HTTPS), access controls, and isolated infrastructure — to protect your data. No online service can guarantee absolute security, but we work to keep your information safe.

Magic Form is not directed at children under 13, and we do not knowingly collect personal information from them.

If we make material changes to this policy, we will update the date above and, where appropriate, notify you through the service.