Privacy Policy

Thunder Forms is a service for creating forms, collecting responses and files, importing Google Forms, and syncing responses to Google Sheets. This policy applies to thunderforms.in and explains what we collect, how we use, store, protect, and share it, and how you can revoke access or request deletion. Thunder Forms is operated by Aditya Singh Khichi. For privacy questions, email realraghavaditya@gmail.com.

Data we collect

• Account data: when you sign up, we store your name, email address, and authentication identifiers so you can sign in and own your forms.
• Form content and responses: forms you create and save, including imported forms, are stored in our database along with submitted answers, submission dates, and quiz results where enabled. Answers can contain personal information requested by the form owner. Form owners can access their forms and responses. Anyone with a public form link can view its published questions.
• Uploaded files: when a form has a file upload field, we process the file and send it to the form owner's selected Google Drive folder. We store the file identifier, name, type, size, destination, and related submission so the owner can retrieve it.
• Technical data: standard server logs (IP address, user agent, pages visited) for security, debugging, and abuse prevention.
• Support and AI requests: we receive information you send us for support. If you use AI form generation, the prompt you enter is sent to the configured AI provider, Google Gemini or Groq, to generate the requested form. Avoid including private answers or sensitive personal information in a prompt.

Google user data we access and why

Connecting Google is optional. You can create forms and collect responses using email/password or GitHub login without connecting Google. Signing in with Google requests the account identity and permissions for Forms import, Drive uploads, and Sheets sync together. Approving these permissions connects that account across all three features. You can also connect Google from their settings after signing in another way. You choose which forms to import, spreadsheets to connect, and folders to use.

• Account identity: the openid, email, and profile permissions provide your Google account identifier, verified email address, name, and profile image. We use these to show which account is connected and to ensure your integrations use the correct account. We never receive your Google password.
• Google Forms content: the forms.body.readonly permission lets us read the selected form's title, description, questions, options, and settings to copy supported questions into the Thunder Forms builder. We do not edit the original Google Form or import its submitted responses.
• Google Drive metadata: the drive.metadata.readonly permission allows access to metadata about files in your Drive. We use it to list and search Google Forms by file identifier, name, last modified date, and ownership. We also check selected folder identifiers, names, types, and sharing permissions to validate upload destinations. This metadata permission does not grant access to file contents.
• Selected or created Drive files: the drive.file permission lets us work with files you select for Thunder Forms or create through the app. For Sheets sync, we read spreadsheet and tab identifiers and titles, create a response spreadsheet or tab, update its headers, and append response rows. We read the response identifiers in that tab to avoid duplicate deliveries. For file uploads, we send files to your selected folder and retrieve them when you download them through Thunder Forms. Upload cleanup can delete unfinished files created by the app.

How we use Google user data

We use Google user data to identify the connected account, show available forms, import the form you choose, maintain your selected upload destinations, and deliver responses to the spreadsheet you connect. When Sheets sync is active, new submissions can be delivered while you are away from the site. Connecting Google does not automatically import every form or copy all your Drive files.

Google API Limited Use

Thunder Forms complies with the Google API Services User Data Policy, including the Limited Use requirements. These restrictions apply to Google API data and information derived from it.

We do not sell Google user data or use it for advertising, retargeting, profiling, credit decisions, lending, or distribution to data brokers. Google Workspace API data is not used to develop, improve, or train generalized or non-personalized AI or machine learning models. Connecting Google does not send your Forms, Drive, or Sheets data to the AI form generator.

We do not allow staff or contractors to read Google user data except with your explicit permission for specific data, when necessary to investigate security issues or abuse, or when required by law.

How we share and transfer data

Our hosting and database providers process service records on our behalf to operate Thunder Forms. Google receives the API requests and data needed for the actions you enable, such as response rows sent to Sheets and files sent to Drive. Your selected Google folder or spreadsheet remains subject to its Google sharing settings, so people you give access to may see that data.

Google user data is transferred only as needed to provide the features you authorize, address security or abuse, or comply with the law. We do not sell personal information. Google user data is not transferred to advertisers, data brokers, or general AI training services. Analytics and advertising services do not receive imported Google Forms content, connected Google account details, OAuth credentials, or Drive and Sheets contents from our integrations.

How we store and protect data

Account records, saved forms, responses, and integration settings are stored in our server database. For Google connections, this includes account identity, granted permissions, encrypted refresh credentials, destination identifiers and names, file metadata, and Sheets delivery records needed for retries. Uploaded file contents and synced spreadsheets are stored in the selected Google account.

Our website and Google API connections use HTTPS to protect data in transit. OAuth access and refresh tokens are encrypted before database storage. Shared Google integration refresh credentials use AES-256-GCM with a key configured on the server. Refresh credentials are not stored in browser storage. Server endpoints check authentication and form ownership before providing private responses or allowing integration changes. Access to operate and support the service is limited to what is needed for those tasks.

How long we retain data

• Google connection: we retain the account details and encrypted refresh credential until you disconnect Google or request deletion of the connection or account. If Google access expires or is revoked, reconnection may be required; revocation on Google's side does not itself delete data saved in Thunder Forms.
• Forms and integration records: imported form content becomes part of a form when you save it. Saved forms, responses, upload references, and destination and sync records remain for the form's use until you delete the form or request deletion. Disconnecting Google does not delete these records.
• Security and legal records: we retain technical and support records for the purposes described in this policy. If a legal or security obligation requires retaining information after a deletion request, we limit the retained information to that purpose and explain the exception in our response.

Disconnecting Google and deleting your data

To disconnect, open Import Google Form in the builder and select Disconnect Google account. This clears the stored Google account details and refresh credential, stops Google operations, pauses Sheets sync, and attempts to revoke the grant with Google. You can also remove Thunder Forms from your Google Account connections.

To delete saved content, delete the relevant form from your Thunder Forms dashboard. To request deletion of your account, Google integration records, or other personal data we hold, email realraghavaditya@gmail.com from your account email and identify the data you want removed. We verify that you are entitled to make the request before deleting data. Respondents should contact the owner of the form they answered, or contact us with the form link so we can help route the request.

Disconnecting Google or deleting a Thunder Forms form does not delete the original Google Form, files already uploaded to Drive, or response rows already written to Sheets. Manage those copies directly in Google Drive or Google Sheets, including any copies shared with other people.

Cookies

We use strictly necessary cookies to keep you signed in and remember preferences. We do not use our own advertising or cross-site tracking cookies.

Analytics

We use Google Analytics and Umami to understand visits and how people navigate this site. Google Analytics uses cookies and collects usage information such as page URLs, browser details, and device information. Learn more about how Google uses this information in Google's partner-sites policy.

Google AdSense and third-party advertising

Where Google AdSense ads are displayed on this site, Google and its partners may place or read cookies on your browser, or use web beacons to collect information, including your IP address, for ad personalization and measurement. This includes the Google advertising cookie, which enables Google and its partners to serve ads based on your visits to this and other sites.

You can opt out of personalized advertising by visiting Google Ads Settings, and learn how Google uses data from sites like this one at Google's partner-sites policy. Advertising cookies are separate from the Google account permissions used for Forms import, Sheets sync, and Drive uploads.

Your rights (including India DPDP Act 2023)

You may request access, correction, or deletion of your account data at any time by emailing realraghavaditya@gmail.com. For grievances under India's Digital Personal Data Protection Act 2023, the Grievance Officer is Aditya Singh Khichi, reachable at the same address; grievances are acknowledged within two working days.

Children

Thunder Forms is not directed at children under 13, and we do not knowingly collect their data. Form owners are responsible for ensuring the forms they publish comply with applicable age and consent rules.

Changes

Material changes to this policy will be noted here with a new revision date. If we change how we access or use Google user data, we will notify affected users and obtain consent before using their data for a new purpose.