Privacy policy

Three things, and nothing else:

• Your account — your name, your email address, and a hashed version of your password (PBKDF2; we never store or see the password itself).
• Your forms — the titles, descriptions, fields, products, prices, and settings you build in the form builder.
• Orders your customers place — the customer's name, their email and phone number if your form asks for them, their answers to your fields, the items and quantities they picked, the total, and the time the order arrived.

We don't run advertising trackers, and we don't use order contents to market to anyone. We do use two analytics tools — described in the Analytics section below — to understand aggregate usage and improve the product. We don't sell data.

We use Google Analytics 4 and Microsoft Clarity to see how the site is used in aggregate — which pages get visited, where people get stuck — so we can improve the product. Both are run by third parties (Google and Microsoft), both load in the visitor's browser, and both set cookies of their own there.

Clarity also records session replays and builds heatmaps of clicks and scrolling. A replay is a reconstruction of what was on the screen, so we keep it away from the screens that show people's details: Clarity is switched off on the public order pages your customers fill in and on your order list in the dashboard, both of which display customer names, phone numbers, email addresses and your own contact number as ordinary text.

Neither tool loads at all on the order-status link a customer gets after ordering — that link is the secret that opens the order, and it is not something to hand to a third party — nor on the unattended wall displays.

These are analytics tools, not advertising trackers: we don't use them to serve ads, and we don't sell the data they collect. If you'd rather not be measured, a browser-level tracker blocker will keep them from loading.

The orders on your forms are your business's records. You decide what your form asks for and what you do with the answers — we just store them for you and show them back to you. If one of your customers asks us for a copy of their order or asks us to delete it, we'll point them to you and help you act on it.

Everything runs on Cloudflare. The application runs on Cloudflare Workers, accounts, forms, and orders are stored in Cloudflare D1 (a SQLite database), and sessions plus a cache of published forms are stored in Cloudflare Workers KV. Cloudflare processes this data on our behalf as our infrastructure provider, and your accounts, forms, and orders are never copied to another vendor. The one thing that does leave is measurement: the analytics tools described above run in the visitor's browser and report page usage to Google and Microsoft. They are kept off the pages that show customer details — see Analytics.

A small set of cookies named qof.session_token and qof.session_data, set when you log in. They hold your session (a random token plus a short-lived signed snapshot), are HttpOnly, and expire after 30 days or when you log out. Signing in with Google adds a brief qof.state cookie that lasts only for the length of that sign-in. There is no login on the public order pages your customers use, so none of those session cookies are set there — but Google Analytics does load on them and sets cookies of its own, as described in Analytics above. (Clarity doesn't, and neither tool loads on the order-status link.) Where the bot check below is switched on, Cloudflare's own script also runs on those pages and may store what it needs to tell a person from a bot.

Public order pages may run Cloudflare Turnstile, a bot check that usually needs no interaction. It's used to stop junk orders and spam submissions. Turnstile doesn't set tracking cookies and isn't used to profile visitors or serve ads.

When an order is checked this way, the customer's IP address is sent to Cloudflare along with the challenge result so it can score the request. We don't store that IP address ourselves and it never lands in your orders — but it is processed by Cloudflare at that moment.

Orders stay until you delete them. Deleting a form deletes every order attached to it, immediately and permanently — so export your CSV first if you need the records. Ask us to close your account and we'll remove your account, your forms, and their orders.

Your accounts, forms, and orders go to Cloudflare and nowhere else, as described above — and where the law genuinely requires it. The other processors are the two analytics tools in the Analytics section, which measure page usage and never receive your order records, and Cloudflare Turnstile where the bot check is on. If we add another one — say email notifications through a mail provider — we'll say so here.

Traffic is served over HTTPS, passwords are hashed, and session tokens are random and stored server-side. No system is perfect: if we ever discover a breach affecting your data, we'll email you about it.

Questions, data requests, or deletion requests: hello@quickorderform.com. We answer real emails from real people.