My Feedback Form

Privacy Policy

Last updated 1 September 2026

My Feedback Form is a tool for collecting honest feedback from the people you work with. It only works if everybody involved knows exactly what is stored and who can read it, so this page says so plainly rather than at length.

Who we are

My Feedback Form (myfeedbackform.app) is operated by Myfeedbackform, a company registered in Germany. For the purposes of the General Data Protection Regulation (GDPR) we are the data controller for the information described below. You can reach us at privacy@myfeedbackform.app.

Two kinds of people use this service

The distinction matters, because we hold very different things about each:

  • Form owners sign in and create a feedback round about themselves.
  • Respondents follow a link and answer. They never sign in and never create an account.

What we hold about form owners

  • Your name, email address and profile picture URL, as supplied by Google or GitHub when you sign in. We request only basic profile and email scopes — never access to your mail, files, contacts or repositories.
  • The access and refresh tokens the identity provider issues, which we store so your sign-in can be re-established, and a session record so you stay signed in between visits.
  • The forms you create: the role template you picked, the title, the questions as they stood when you published, the share link, and the times the round was created, opened and closed.

What we hold about respondents

  • The answers themselves — ratings and any free text written.
  • The name typed into the optional name field, if one is typed. Leaving it blank means no name is ever stored.
  • The time the response was submitted.

That is the whole list. We do not ask respondents to sign in, we do not store their IP address alongside their answers, and we set no cookie that would let us recognise the same person across two different forms. After a response is sent, the browser keeps a small local note that this particular link has been answered, so a repeat visit does not offer the form twice. That note stays on the device and is never sent to us.

What we do not do

There is no analytics package, no tracking pixel, no advertising network and no third-party script on any page of this service. We do not sell personal data, we do not share it with advertisers or data brokers, and we do not use it to train machine-learning models.

Cookies

We set only the cookies needed to run a sign-in: a session cookie identifying your logged-in session, and short-lived cookies used to protect the sign-in flow against cross-site request forgery and to return you to the right page afterwards. These are strictly necessary, so no consent banner is required. Respondents who never sign in receive no cookies from us at all.

Why we are allowed to hold it

Under Article 6 of the GDPR we rely on performance of a contract for everything needed to give you an account and run your feedback rounds, and on our legitimate interest in keeping the service secure, available and free of abuse for the small amount of operational logging our hosting providers perform. Where you supply something entirely optional — such as signing your response with your name — the basis is your consent, given by choosing to type it.

Who can see the answers

  • The form owner sees every answer submitted to their round. They see a name attached to an answer only when the respondent chose to type one.
  • Administrators — a short, named list of addresses held in our deployment configuration — can access accounts, forms and responses. This access exists to investigate abuse reports, to answer support requests and to fix data problems. It is not used to browse feedback out of interest.
  • Nobody else. Answers are not published, aggregated across accounts, or shown to other users.

Anonymity has limits, and you should know them

We do not attach an identity to a response. But a feedback round sent to four people is not statistically anonymous, and writing style, specific incidents and turns of phrase can identify an author to somebody who knows them well. If you are a respondent, write on the assumption that a determined reader might guess who you are. If you are an owner, treat that guess as none of your business.

Where it is stored, and who processes it

Data is held in a PostgreSQL database run by our hosting provider. Beyond that provider we rely on Google and GitHub as identity providers, and only for the sign-in itself. Where any processing takes place outside the European Economic Area, it is covered by the European Commission’s standard contractual clauses or an equivalent safeguard.

Google user data

My Feedback Form’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only your name, email address and profile picture, we use them only to create and identify your account, and we never transfer them to others except as described on this page.

How long we keep it

Your account and your forms are kept for as long as your account exists. Responses are kept for as long as the form they belong to exists, because a feedback round read a year later is the point of keeping rounds at all. When you ask us to delete your account, everything belonging to it — forms, responses and answers — is deleted with it, within 30 days.

Your rights

You have the right to ask for a copy of the data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Write to privacy@myfeedbackform.app and we will answer within 30 days. You also have the right to complain to a data protection supervisory authority in the country where you live or work.

Respondents: if you answered a form and want that answer removed, write to the same address with the link you were sent and roughly when you submitted. We will find it and delete it. You do not have to explain why.

Children

This service is built for workplaces and is not directed at children. Do not use it if you are under 16.

Changes

If this policy changes in a way that affects what we collect or who can see it, we will change the date at the top and, for material changes, tell account holders by email before it takes effect.

Contact

Questions, requests and complaints all go to privacy@myfeedbackform.app. The terms of service cover the rest of the arrangement.