Privacy Policy

Last updated: October 6, 2026

Introduction

This Privacy Policy explains how CalcForms (https://forms.badabingapp.cc), a product by Badabing! (founded by Yehoshua Klein), collects, uses, and shares information. CalcForms turns spreadsheets and plain-language descriptions into interactive web "calculator forms." A form owner builds a form, shares a link, and their customers fill it out, with submissions landing in the owner's dashboard.

Throughout this policy, "we," "us," and "CalcForms" refer to the service. A "form owner" is a person or organization with a CalcForms account who builds forms. An "end-customer" or "submitter" is a person who fills out a form created by a form owner.

Please note: When an end-customer submits a form, the form owner, not CalcForms, decides what questions are asked and is the controller of those submissions. CalcForms acts as a processor that stores and displays those submissions on the owner's behalf. The owner is responsible for what they ask their customers and for handling that data appropriately.

Information we collect

We collect the following categories of information:

• Owner account information. When you create a CalcForms account, we collect your email address (used to sign in with a one-time code, or with a password if you set one) and the workspace name you choose. If you subscribe to Pro, we store your subscription status and renewal date; your card details and billing address are held by Lemon Squeezy, not by us.
• Forms. The form definitions, formulas, and settings that an owner creates. When an owner tests a form in ChatGPT, or runs a what-if on a submission there, we also keep that one most recent run: the answers, the results and the form, so the preview in the chat can show it. Creating, changing or testing another form replaces it, and it is deleted with the form.
• Submissions. The data that an owner's end-customers enter into a form (inputs), the calculated outputs produced by the form, and the submitter's email address. Forms may include optional file uploads, which are stored privately.
• Before a form is submitted. Some information reaches us while a form is still being filled in. On some forms (those with repeating rows, or with a formula the page cannot work out on its own), and on every form a form owner fills in from their internal view, the answers entered so far are sent to our servers when the form opens and each time an answer changes, to work out the form's results. We do not store those answers; we keep a usage record that a calculation was requested, without the answers. A file is uploaded as soon as it is chosen, and it is kept in our private storage even if the form is never submitted. If an end-customer saves a form to finish it later, we store the answers entered so far and the email address they give for the link. The form owner can see that email address and that the form was started. That link works for 30 days. When an end-customer opens an invite link that a form owner sent them, we record that it was opened and show that to the form owner.
• Technical and usage data. Basic technical and usage information needed to operate and secure the service. This includes first-party, cookie-free analytics on our own website: which pages were viewed, the visitor's country, device type and referring site, and which CalcForms tools were used. We do not use third-party analytics services, our analytics do not store raw IP addresses, and we do not track you across other websites. Raw analytics records are deleted after 90 days; only daily aggregate totals are kept after that. To stop abuse, we keep the IP address of anyone who submits a form on its public page, or asks for a link to finish one later, in a counter. A cleanup that runs as forms are submitted deletes each counter once it is more than two days past its time limit. An address is kept for at least two days, and longer when few forms are submitted. When you sign in, our sign-in provider keeps your IP address with that session.

How we use information

We use the information we collect to:

• Operate the service: store forms and submissions, and display them to the form owner in their dashboard.
• Send transactional emails, such as submission receipts, owner notifications and invites; sign-in codes are sent by our sign-in provider.
• Build or change a form from the owner's description when the owner uses the AI builder, and suggest a form's colors and fonts from the owner's website when the owner asks for that.

We do not sell personal data, and we do not use customer data to train AI models.

AI processing

We use OpenRouter, our AI provider, for two things only. When a form owner uses the AI builder, we send OpenRouter the owner's form description, or the current form and the change the owner asked for, to build the form. When a form owner brands a form from their website, we read that website and send OpenRouter what we found: its address, name, page title and description, colors, fonts, and logo image addresses and alt text.

Form submission contents, the data end-customers enter into a form, are not sent to OpenRouter and are not used to train AI models.

Subprocessors / who we share with

We do not sell personal data. We share data only with the subprocessors listed below, and only to the extent needed to run the service, apart from what a form owner chooses to send to services they connect, such as their CRM or a webhook address (both described after the list). Form submission contents are private to the form owner who collected them. We also get an email alert when an end-customer submits a form. It says which form was submitted, and it does not include the end-customer's email address or anything they entered.

• Supabase: database, authentication, and private file storage; data is hosted in the United States.
• Cloudflare: serves the website and serverless edge.
• OpenRouter: AI provider used only to build or change a form from the owner's description in the AI builder, and to suggest a form's colors and fonts from the owner's website. It never receives submission contents.
• Resend: sends transactional emails: submission receipts, owner notifications, invites, links to finish a form later, a welcome email and account notices to form owners, and alerts and a daily report sent to us.
• Lemon Squeezy: merchant of record for Pro subscriptions; processes payments and handles your card details, billing address and tax. We never receive your full card number.

Some of our pages also load fonts or code straight from other providers, which see the visitor's IP address when the page loads. Google Fonts serves fonts on our home page and on forms whose owner picked a font. The dashboard loads code from unpkg. The page where you connect ChatGPT or Claude, and the submission receipt page, load code from jsDelivr. A logo on a form loads from the web address its owner gave.

A CRM the form owner connects. If a form owner connects a CRM they use (HubSpot or Salesforce), new submissions to the forms the owner chooses are sent to the owner's own account at that CRM, and so is a form's most recent submission when the owner sends a test, with the answers and results the owner picks, which can include the end-customer's email address. That account belongs to the owner and is under the owner's control, so a connected CRM is the owner's own service, not a CalcForms subprocessor, and the owner's agreement with that CRM covers the data there. To send, we store the access the owner grants, encrypted. We also keep the connected account's name and ID, and for Salesforce, the account's My Domain address and the username of the Salesforce user CalcForms acts as, until the owner disconnects in the CalcForms dashboard or their account is deleted. We keep a record of each send, without the answers, for as long as its submission exists. The owner can disconnect at any time, in the CalcForms dashboard or in the CRM's own settings; disconnecting in the dashboard deletes the stored access, and records already sent stay in the owner's CRM.

A webhook address the form owner sets. If a form owner sets a webhook address on a form, we send each new submission to that address, with every answer, every calculated result (including results the end-customer does not see) and the end-customer's email address. The owner chooses that address and the service behind it, so it is not a CalcForms subprocessor.

Data retention

We retain account information, forms, and submissions for as long as an owner's account is active or as needed to provide the service. Owners can delete forms and submissions from their dashboard. Answers saved to finish a form later, and the email address given with them, are kept after the link stops working, until the form is deleted or we delete them. Files uploaded to a form are kept until we delete them; deleting a form or a submission does not delete its files. To have saved answers or a file deleted, contact us at hello@badabingapp.cc. If you would like your account and associated data deleted, contact us at hello@badabingapp.cc. We may retain certain information as needed to operate and secure the service or to comply with legal obligations.

Security

We take reasonable measures to protect the information we handle. Sign-in is by one-time email code or by password, connected assistants use OAuth 2.0, file uploads are stored privately, and submission contents are kept private to the form owner. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your rights & choices

You may request to access, correct, or delete your personal information. To make a request, contact us at hello@badabingapp.cc.

If you are an end-customer who submitted a form, the form owner controls that submission. Please direct requests about that data to the form owner who collected it; we can help facilitate your request where appropriate.

International users

CalcForms is operated with data hosted in the United States. If you access the service from outside the United States, you understand that your information will be processed and stored in the United States, where data protection laws may differ from those in your country.

Children

CalcForms is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at hello@badabingapp.cc so we can take appropriate action.

Changes to this policy

We may update this Privacy Policy from time to time. When we make changes, we will revise the "Last updated" date at the top of this page.

Contact

If you have questions about this Privacy Policy or our data practices, contact us at hello@badabingapp.cc.