Privacy Policy
Last updated October 16, 2026
FormCerts (“we”, “us”) provides a Google Forms add-on and a web dashboard that create and email certificates to people who submit a form. This policy explains what data we handle, why, and the choices you have.
Who this covers
- Form owners who install the add-on or sign in to the dashboard.
- Recipients who submit a form that uses FormCerts and receive a certificate.
Google user data we access
The add-on requests these Google OAuth scopes, and uses each only as described:
| Scope | What we use it for |
|---|---|
https://www.googleapis.com/auth/forms.currentonly | Read the questions, quiz settings and new responses of the one form you install FormCerts on, so we can fill in certificates and apply your pass mark. It gives no access to your other forms. |
https://www.googleapis.com/auth/script.container.ui | Show the FormCerts sidebar inside the Google Forms editor. |
https://www.googleapis.com/auth/script.scriptapp | Create the form-submit trigger that runs FormCerts when someone submits your form. |
https://www.googleapis.com/auth/script.external_request | Send the mapped answers for each submission to formcerts.com over HTTPS so the certificate can be created and emailed. |
openid, https://www.googleapis.com/auth/userinfo.email | Identify your Google account so the add-on and your FormCerts dashboard are linked to the same account. |
The dashboard uses Google Sign-In with the openid, email and profile scopes only. FormCerts does not access your Google Drive, Gmail, Calendar or any form you have not installed it on, and we do not store Google access or refresh tokens on our servers.
Limited Use
FormCerts' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train artificial intelligence or machine learning models. Humans at FormCerts do not read it except with your permission, for security purposes, or to comply with law.
What we store
- Form owners: name, email address, Google account identifier, plan and billing status, and your certificate settings (design, email text, field mapping).
- Certificate recipients: only the answers mapped onto the certificate (typically name, email address and course), the quiz score and whether the pass mark was met, the generated certificate PDF, and email delivery status (delivered, bounced and similar). Delivery records don't include email addresses. We do not store the rest of a form response.
- Respondents who don't receive a certificate (for example, below the pass mark, no email address, or the owner's plan limit reached): the same mapped answers, score and pass/fail result, kept so the form owner can still issue the certificate. We delete the answers after 90 days if no certificate is issued.
- Website visitors: to prevent abuse, we rate-limit requests using a one-way hash of the visitor's IP address, kept for a few minutes. We don't use advertising or tracking cookies.
- Payments are handled by Stripe. We never see or store full card numbers.
Certificate verification pages
Each certificate has a public verification page reachable through its QR code or link. It shows the recipient's name, the course, the issue date, the issuer and whether the certificate is valid or revoked. It never shows the recipient's email address, and we ask search engines not to index it.
Retention and deletion
- Form owners can set recipient email addresses to be deleted automatically after a chosen period, and can revoke or delete individual certificates at any time. Once a certificate is issued we keep a single copy of the recipient's details with it, so this setting covers all of them.
- Answers for respondents who didn't receive a certificate are deleted after 90 days.
- When you delete your account, or ask us to, we delete your data and your recipients' data, including stored certificate files, within 30 days. Backups expire on their normal schedule.
- To remove the add-on's access to your Google account, uninstall it and revoke access at myaccount.google.com/permissions.
- Recipients can ask us to delete their data by writing to privacy@formcerts.com. We'll coordinate with the issuer where needed.
Service providers
We use these sub-processors to run FormCerts:
- Vercel (web hosting)
- Neon (database)
- Cloudflare (certificate file storage, DNS)
- Resend (email delivery)
- Stripe (payments)
- Inngest (background job processing)
- Sentry (error monitoring, with personal data scrubbed)
Security
Data is encrypted in transit (TLS) and at rest by our providers. Add-on requests are signed, secrets are encrypted in our database, and certificate files are stored privately and served only through short-lived or tokenized links. We store only a one-way hash of each download link's secret, and issue a new link whenever a certificate is re-issued or revoked.
Contact
Questions or requests: privacy@formcerts.com.