Legal
Privacy Policy
What we collect, why we collect it, who helps us process it, how long we keep it, and the choices you have.
Effective 20 October 2026
1. Who we are and what this covers
Heartdove (“we”, “us”) is a form backend.
This policy covers two groups of people: customers, who create an account and connect forms to Heartdove, and visitors, who send a message through a form on a customer’s website.
2. Our role for each kind of data
For customer account and billing details, we decide how the information is used and are responsible for it.
For form submissions, the customer decides which fields to collect and what happens to them. We process submissions on the customer’s behalf and according to their settings. If you sent a message through a website form, the website owner’s privacy notice applies, and they are the best first contact for requests about your message.
3. Information we collect
Account details. Your email address, which you use to sign in, and an optional display name. Workspace and form names, the website addresses allowed to use each form, and the destinations you configure, such as alert email addresses and webhook URLs.
Billing details. Stripe processes payments. We store the Stripe customer and subscription identifiers, your plan and its status. We never receive or store full card numbers.
Submissions. The fields a visitor sends, limited to 50 fields and 64 KiB, together with the time received, a spam score and its reasons, delivery status reported by our email provider (accepted, delivered, delayed, bounced or marked as spam), and any status, notes or tags a customer adds.
Technical information. To limit abuse, we combine a visitor’s IP address with the date and a secret key and keep only the resulting one-way code, briefly, for rate limiting. We do not store IP addresses with submissions. We check the website address a form is sent from against the form’s allowed addresses. Cloudflare Turnstile checks that a visitor is human on the sign-in page and on forms that use it, and Cloudflare handles that check under its own privacy policy.
Cookies. The dashboard uses essential cookies to keep you signed in. We do not use advertising or analytics cookies, and our form snippet adds no tracking.
4. How we use information
- To provide the service: storing submissions, showing them in your inbox and delivering alerts and webhooks you have set up.
- To send service emails, such as sign-in links, alerts, billing notices and important changes to the service.
- To stop spam and abuse, and to keep the service secure and working.
- To process payments and keep billing records.
- To meet legal obligations.
We do not sell personal information. We do not use submission content for advertising, and we do not use it to train artificial intelligence models.
5. Service providers
We use these providers to run Heartdove. Each receives only what it needs for its task.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and dashboard sign-in | United States (AWS us-east-1) |
| Cloudflare | Receives submissions, queues deliveries, hosting, DNS and Turnstile checks: on the sign-in page, and on forms that use it | Global network |
| Resend | Sends email alerts and reports delivery and bounce status | United States |
| Stripe | Payments, invoices and billing management | United States and other countries |
When a customer connects a destination such as Slack, Discord, Telegram, Notion, Google Sheets or their own webhook, submissions are sent there on the customer’s instruction, and that service’s own terms apply.
We may also disclose information when the law requires it, or to protect the rights, safety and security of our customers, visitors or the service.
6. Where information is processed
Heartdove stores data in the United States, and our providers may process it in other countries where they operate. That means information may be handled outside the country where you live.
7. How long we keep information
| Submission content | 90 days on Free and one year on paid plans by default, or a shorter period set for the form. Then deleted automatically. |
|---|---|
| Held submissions | At least 7 days and until one day after your next monthly allowance reset, unless released into your inbox before then. |
| Quarantined submissions | Up to 7 days, unless released into your inbox before then. |
| Privacy mode forms | Content is never stored in the inbox. The encrypted delivery copy is erased within 24 hours. |
| Expired submission records | A record without any content is kept for 30 days so a retried submission is not stored twice. |
| Delivery history | 30 days. |
| Monthly usage counts | 13 months. |
| Account and workspace details | While your account is open. You can delete your account at any time from Settings → Security; it is removed immediately, together with workspaces only you own, except records we must keep by law, such as invoices. |
| Backups | Up to 7 days after deletion. Supabase keeps daily backups for 7 days; a deleted record can remain in a backup until it ages out. |
8. Security
Submissions travel over HTTPS and are stored in an encrypted database. Each workspace is isolated at the database level, form keys are stored only as one-way codes, and webhooks are signed. Our security page describes these measures in more detail. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.
9. Your choices and rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or limit some uses of it.
Customers can review and update most details in the dashboard, delete their account under Settings → Security, or email privacy@heartdove.com for anything else.
Visitors should contact the website owner first, because they control their form data. If you contact us, we will pass your request to the right customer and help them respond.
You can also complain to the privacy or data protection regulator where you live.
10. Children
Heartdove is not intended for children under 16, and we do not knowingly accept them as customers.
11. Changes to this policy
We will post any change on this page and update the effective date. If a change materially affects how we handle your information, we will also tell customers by email before it takes effect.
12. Contact
Questions or requests about privacy: privacy@heartdove.com.