Privacy Policy

For our customers (people who create a Fillnest account), Fillnest decides how account and billing data is used and is responsible for it.

For respondents (people who fill out a form built with Fillnest), the business that owns the form decides what to ask and what to do with the answers. We store and process those answers on its behalf. If you answered someone's form and have a question about your data, please contact that business first; we'll help them respond.

Account data: your name, email address and password. Passwords are stored only as a salted hash, never in readable form.

Billing data: your plan, PayPal subscription or order IDs, payment amounts, dates and statuses. PayPal handles the payment itself; we never receive your full card or bank details.

Form content: the forms you build, their settings and styling.

Responses: whatever respondents type into a form. Answers are saved automatically as they type, before they press submit, so the form owner can see partial answers and respondents can continue later. With each response we also store the respondent's IP address, browser type (user agent) and the page they came from, to help form owners spot spam and abuse.

Support and account emails: messages you send through our contact page (your name, email, message and IP address, used to reply and to block spam), and records of emails we send you (such as password reset links).

• Login cookie: one essential cookie keeps you signed in to your account for up to 30 days. It isn't used for tracking.
• Form progress: on forms built with Fillnest, a random identifier and the respondent's in-progress answers are kept in the browser's local storage so they can resume later and so unique visits can be counted. Form owners can turn browser saving off.
• We don't use advertising cookies or third-party analytics trackers.
• Full details are in our Cookies Policy.

• to run Fillnest: show your forms, save responses and display them in your dashboard;
• to sign you in, keep your account secure and send password reset emails;
• to manage your trial, plan and payments;
• to prevent spam, fraud and abuse;
• to answer your questions and tell you about important changes to the service.

We don't sell personal data. We share it only with providers that help us run the service:

• Vercel: Hosts the website and app (United States).
• Neon: Stores the database: accounts, forms and responses (United States).
• PayPal: Processes subscription and Lifetime payments.
• Resend: Sends account emails, such as password reset links.
• Simple Icons: Serves the website-builder logos shown on our homepage; the request reveals the visitor's IP address.
• Google Fonts: Serves fonts when a form owner picks a Google font; the font request reveals the visitor's IP address to Google.

We may also disclose data when the law requires it, or to protect our users and the service from fraud or abuse.

Our hosting and database run in the United States. If you use Fillnest from another country, your data is transferred to and stored in the United States.

• Account and billing data: while your account exists, and afterwards as long as tax and accounting laws require.
• Forms and responses: until the form owner deletes them, or deletes their account.
• Login sessions: up to 30 days. Password reset links: they stop working after 1 hour.

All traffic is encrypted with HTTPS, passwords are hashed, each account can only see its own forms and responses, and reset links work only once. No system is perfectly secure, so if you ever notice something suspicious, please tell us through our contact page.

You can update your name and password in your account settings, and form owners can export or delete responses at any time. Depending on where you live, you may also have the right to access, correct, delete or receive a copy of your personal data, or to object to how it's used. To make a request, use our contact page and choose “Privacy or data request”. You may also complain to your local data protection authority.

Fillnest accounts are for people aged 18 and over. We don't knowingly collect personal data from children through our own website.

We'll update this page when our practices change, and let account holders know by email or in the app before significant changes take effect.

Privacy questions or requests: our contact page. See also our Terms of Service.