Privacy Policy

Welcome to OpusForms ("we," "us," or "our"). OpusForms is operated by Hakan Silek. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (iOS), our website at opusforms.com, and any related services (collectively, the "Service").

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: When you create an account, we collect your email address, display name, and password. If you sign in with Apple, we receive your Apple ID credentials and, if you choose to share it, your name and email address.
• Profile Information: Any additional profile details you voluntarily provide, such as your display name.
• Form Content: The forms you create, including field definitions, settings (such as quiz mode, deadlines, password protection), and styling configurations.
• Form Submissions: When you fill out a form created by another user, we collect the answers you submit, including text responses, selections, ratings, signatures, and any other data entered into form fields.
• Support Communications: If you contact us for support, we may collect the content of your messages, your email address, and any attachments you provide.

1.2 Information Collected Automatically

• Device Information: Device type, operating system version, device identifiers, and hardware model.
• Usage Data: App interaction data, feature usage patterns, session duration, screens viewed, and actions taken within the Service.
• Crash & Performance Data: Crash logs, stack traces, performance metrics, and diagnostic information collected via Firebase Crashlytics to help us identify and fix issues.
• Analytics Data: Aggregated and anonymized usage analytics collected via Firebase Analytics, including screen views, events, and user engagement metrics.
• Log Data: IP address, browser type, referring/exit pages, and timestamps when you access our website.

1.3 Information from Third-Party Services

• Apple Sign-In: If you authenticate using Sign in with Apple, we receive your Apple-provided user identifier, and optionally your name and email address (depending on your Apple ID settings).
• RevenueCat: We use RevenueCat to manage subscriptions and in-app purchases. RevenueCat provides us with subscription status, purchase history, and transaction identifiers. RevenueCat may collect device identifiers and purchase data as described in their Privacy Policy.

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service: Create and manage your account, process form submissions, store your form data, and deliver core functionality.
• Process subscriptions: Manage your subscription tier (Free, Plus, or Pro), verify entitlements, and enforce tier-based feature access.
• Deliver analytics: Provide form owners with performance metrics such as view counts, submission counts, conversion rates, and field-level statistical breakdowns.
• Improve the Service: Analyze usage patterns, diagnose technical issues, fix bugs, and develop new features.
• Ensure security: Detect, prevent, and address fraud, abuse, and security threats, and enforce our Terms of Service.
• Communicate with you: Send service-related notifications, respond to support requests, and provide important updates about the Service.
• Comply with legal obligations: Fulfill our legal and regulatory requirements.

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

3.1 Service Providers

We share data with trusted third-party service providers who assist us in operating the Service:

3.2 Form Owners & Respondents

• When you submit a form, the form owner can view your responses. If you provide your name, it will be visible to the form owner. Anonymous submissions are labeled as such.
• Form owners may export submissions (e.g., as CSV files) for their own use, which will include submitted data.

3.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of OpusForms, our users, or the public.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you via email or a prominent notice in the Service before your information becomes subject to a different privacy policy.

4. Data Storage & Security

• Your data is stored on Supabase infrastructure with Row Level Security (RLS) enabled. Form data and submissions are protected so that only authorized users (form owners) can access them.
• Sensitive credentials are stored securely using the iOS Keychain.
• All data in transit is encrypted using TLS/SSL.
• We implement server-side enforcement of subscription tiers and access controls to prevent unauthorized access to premium features and data.

While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your information as follows:

• Account data: Retained for as long as your account is active. Upon account deletion, your personal data is permanently removed.
• Form content & submissions: Retained for as long as the form owner maintains the form. When a form is deleted by its owner, all associated submissions are deleted via cascading deletion.
• Analytics & crash data: Retained by Firebase in accordance with Google's data retention policies (typically up to 14 months for analytics data).
• Subscription data: Purchase records may be retained by RevenueCat and Apple as required for financial and legal obligations.

6. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal information:

6.1 All Users

• Access: Request a copy of the personal information we hold about you.
• Correction: Update or correct inaccurate information through your profile settings.
• Deletion: Delete your account and associated data from within the app or by contacting us. Account deletion is permanent and irreversible.
• Data Portability: Request an export of your data in a machine-readable format.
• Opt-out of Analytics: You may limit analytics data collection by adjusting your device's privacy settings or opting out of Firebase Analytics data sharing.

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at silekhakan@gmail.com.

6.3 European Users (GDPR)

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on (a) your consent, (b) performance of a contract (providing the Service), (c) our legitimate interests (improving the Service, security), or (d) compliance with legal obligations.
• Right to Restrict Processing: You may request that we limit how we use your data.
• Right to Object: You may object to processing of your personal data in certain circumstances.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority.
• Data Transfers: Your data may be transferred to and processed in the United States and other countries. We ensure appropriate safeguards are in place for such transfers.

7. Children's Privacy

The Service is not specifically directed at children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at silekhakan@gmail.com.

8. Third-Party Links & Services

The Service may contain links to third-party websites or services, including links within form fields (hyperlink field type). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you interact with.

9. Push Notifications

We may send you push notifications related to the Service, such as new form submissions, form assignments, or important service updates. You can disable push notifications at any time through your device settings.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, through an in-app notification or email. Your continued use of the Service after such changes constitutes acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: