Privacy Policy

Last updated: April 1, 2026

Winter Forms is built by Winterlude Interactive. We take your privacy seriously. This policy explains what data we collect, how we use it, and your rights.

1. What Data We Collect

From form creators:

• Email address
• Form name and configuration (redirect URLs, notification preferences, auto-reply settings)
• For paid accounts: password (securely hashed using bcrypt) and billing information (processed by Stripe)

From form submitters:

• Whatever information the form creator requests (text fields, emails, messages, etc.)
• IP address (used for spam prevention and rate limiting; stored with the submission only when submission retention is enabled)
• Submission timestamp

2. How We Use Your Data

Privacy-first approach: By default, form submissions are not stored in our database. They are only sent via email to the form creator. This means form submitters' data is not retained unless the form creator explicitly enables submission retention.

We use your data to:

• Send form submissions to form creators via email
• Send transactional emails (account verification, form verification, management links)
• Send optional auto-reply emails to form submitters (if enabled by form creator)
• Process payments through Stripe
• Enforce rate limits and prevent spam (5 submissions per minute per IP per form)
• Manage your account and forms

3. Data Storage & Retention

Submissions: Not stored by default. If retention is enabled by the form creator, submissions are stored indefinitely until manually deleted or the form is deleted. Stored submission records include the submitter IP address for abuse-prevention review.

Forms: Active forms are stored indefinitely. Forms with no submissions for 6 months are marked inactive and you'll receive a reactivation email. Under the current implementation, inactive forms remain in that state for roughly 9 additional months before automatic deletion.

Accounts: User accounts are stored until you delete them.

Authentication tokens: JWT tokens expire after 7 days, email verification tokens after 24 hours, and magic links after 60 minutes.

4. Third-Party Services

Stripe: We use Stripe to process subscription payments. When you subscribe to a paid plan, Stripe receives your email address, plan selection, and payment information. Stripe's privacy policy: stripe.com/privacy

AWS: We use Amazon Web Services to host our application (AWS Lambda) and send emails (Amazon SES). AWS's privacy policy: aws.amazon.com/privacy

Google Fonts: We load fonts from Google Fonts CDN for email and web page styling. Google's privacy policy: policies.google.com/privacy

5. Cookies & Tracking

We do not use tracking cookies or third-party analytics. We do not use Google Analytics, advertising pixels, or any other user tracking services.

For authenticated users, we store your authentication token in your browser's localStorage (not cookies) to keep you logged in.

6. Security

We take reasonable measures to protect your data:

• Passwords are hashed using bcrypt (10 salt rounds) and never stored in plain text
• All API communication should use HTTPS
• JWT authentication with 7-day token expiry
• Stripe webhook signature verification for payment security
• Rate limiting and honeypot protection against spam

7. Your Rights

You have the right to:

• Access your data: View all your forms and submissions through the dashboard
• Export your data: Download submissions as CSV files
• Delete your data: Delete individual submissions, clear all submissions, delete forms, or delete your entire account
• Control retention: Toggle whether submissions are stored or only emailed
• Cancel your subscription: Cancel at any time; access continues until the end of your billing period

When you delete your account, we cancel all Stripe subscriptions and transfer your forms to email-based management (free tier). Your forms are not deleted unless you explicitly delete them first.

8. Data Sharing

We do not sell, rent, or trade your personal information. We only share data with:

• Stripe (for payment processing)
• AWS (for hosting and email delivery)
• Form creators (when you submit a form, your submission is sent to them)

9. Children's Privacy

Winter Forms is not intended for use by children under 13. We do not knowingly collect personal information from children under 13.

10. International Users

Our services are hosted in AWS US East (Virginia). By using Winter Forms, you consent to the transfer and processing of your data in the United States.

11. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use of Winter Forms after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this privacy policy or your data, contact us at:

Email: [email protected]

← Back to Winter Forms