SilentForms

Privacy policy

Last updated 25 October 2026

SilentForms receives form submissions for websites and delivers them to the people who run those websites. This page explains what personal data that involves, what we do with it, how long we keep it and how to have it deleted. Questions go to [email protected].

Two kinds of data, two roles#

  • About you, as someone who uses silentforms.com (requests an access key or signs in to the dashboard): we decide how this data is used, so we are responsible for it.
  • In the submissions your forms receive: we process this on behalf of the website owner who set up the form. They decide what the form asks and are responsible for telling their visitors about it. If you submitted a form on someone else's site, contact that site first; we will help them with your request.

What we collect#

Visiting the site. We use no analytics, no advertising and no tracking cookies. Requests reach us through Cloudflare, which protects and speeds up the site, and then our server. Both handle your IP address and request details to deliver pages and stop abuse. To enforce rate limits we store a keyed hash of your IP address (and, when you request an access key or sign-in link, of your email address) for up to two days, and IP addresses can appear in server logs.

Requesting an access key. Your email address, a random confirmation token and when you asked. The confirmation link expires after 24 hours, and the request is deleted a week after that. The key itself is linked to your email address so submissions reach you.

Using the dashboard. Your email address. Sign-in links are stored only as a hash and expire after 30 minutes. A signed-in session lasts 30 days and records the IP address and browser it was created from. We store the settings you save for your forms (up to 25 per account). CAPTCHA secret keys and integration settings you enter are encrypted before they are stored, and API tokens are stored only as a hash.

Extra recipients. When a form's owner adds someone to receive copies, we store that address, a hashed confirmation token and whether they confirmed. We email them once to ask; they receive copies only after confirming, and every copy lets them stop.

Form submissions. The fields a visitor fills in, their IP address, the site the form was sent from and the time. We email the submission to the form's owner, store it so the owner can read it in the dashboard, and, if the owner set one up, send it to the owner's webhook address. If the owner turned on a CAPTCHA, the visitor's CAPTCHA token and IP address are sent to that provider to check it.

Who receives data#

  • Our infrastructure providers: the company hosting our server and database, Cloudflare, and our email delivery provider. They process data only to provide their service to us.
  • CAPTCHA providers (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA), only for forms whose owner turned one on.
  • Webhook addresses chosen by a form's owner, only for that owner's submissions.
  • Extra recipients the owner added and who confirmed, for that form's submissions.
  • Slack, Discord or Telegram, when a form's owner connects one, for that form's submissions.

We never sell personal data or use it for advertising.

How long we keep it#

  • Submissions: until the form's owner deletes them, deletes the form or deletes their account. Submissions caught as spam are deleted after 7 days.
  • Accounts, keys and settings: until you delete your account.
  • Sessions: until they expire after 30 days or you sign out.

Your rights#

You can ask to see the personal data we hold about you, to correct it or to have it deleted, and you can object to how we use it. Signed-in owners can delete everything at once: Delete your account at the bottom of the dashboard removes your forms, their submissions, every key issued to your email address and your sessions. For anything else, write to [email protected]. You can also complain to the data protection authority where you live.

Security#

Every connection uses HTTPS. Sign-in links are hashed, CAPTCHA secrets are encrypted, and access keys only route submissions: a key cannot be used to read anything back. Only you can see your forms' submissions in the dashboard.

Changes#

If this policy changes, the new version is published here with a new date. If a change affects how we use data you have already given us, we email account holders first.