Privacy policy

Last updated: 15 September 2026. This policy explains what personal data Formo (form.dev) processes, why, and what you can do about it. The service is operated by Form.dev ("we"). To contact us, use the Contact link in the footer.

What we store

We keep only what the studio needs to work:

• Account. When you sign in with Google or GitHub we receive your email address, display name and avatar from that provider and store them to identify your account. We never see your password.
• Your work. Projects, drawings, animations and assets you save are stored so you can open them again and share them. Files live in object storage on Cloudflare R2; document data and edit history live in our database.
• Collaboration. In a shared project, your edits and presence (cursor, selection) are relayed to the other participants of that project in real time and kept in the project history.
• Technical logs. Our servers log the requesting IP address, user agent, requested URL and time for security and fault-finding.
• Usage analytics. We use Google Analytics 4 with IP anonymisation to understand which pages are read and which features are used. Analytics data is aggregated and not linked to your account.

Cookies

Formo sets a session cookie when you sign in so that you stay signed in across pages; it contains no personal data beyond a signed session reference and expires when you sign out or after a period of inactivity. Google Analytics sets its own cookies to distinguish visits. Local preferences of the editor (panel layout, recent files) are kept in your browser's local storage and never leave your device.

Why we process data and on what basis

• To provide the service you asked for — hosting your projects, signing you in, syncing collaboration (performance of a contract, GDPR Art. 6(1)(b)).
• To keep the service secure and available — logs, abuse prevention (legitimate interest, Art. 6(1)(f)).
• To understand how the product is used — analytics (legitimate interest, Art. 6(1)(f); you can opt out below).

Where your data is kept

Our servers run in data centres in the European Union. Project files are stored with Cloudflare (object storage). Sign-in is handled by Google or GitHub under their own privacy policies; we receive only the profile fields listed above. Google Analytics processes data on Google's infrastructure, which may involve transfers outside the EU under the EU–US Data Privacy Framework and standard contractual clauses.

Who processes data on our behalf

• Our hosting provider in the EU — runs the servers the service is delivered from.
• Cloudflare — file storage.
• Google, GitHub — sign-in.
• Google Analytics — aggregated usage statistics.
• We do not sell personal data and we do not show third-party advertising.

How long we keep it

Your account and projects stay as long as your account exists. When you delete a project it is removed from live storage; copies in our backups disappear as the backups are rotated, which can take up to six months. When your account is deleted, everything tied to it is removed on the same schedule.

Your rights

Under the GDPR you can ask us to show you the data we hold about you, correct it, delete it, hand it over in a portable format, or restrict or object to its processing. Your projects are yours — you can export any of them at any time from the editor as HTML, video, GIF, SVG or PNG. To exercise any right, including deleting your account, contact us via the Contact link in the footer. You may also complain to your local data-protection authority.

Opting out of analytics

You can block the Google Analytics domain with any content blocker; the studio works fully without it.

Children and schools

Formo is used in classrooms to teach animation. A person under 16 may use Formo when a parent, guardian or school has agreed to our terms and this policy on their behalf; in a school setting the school decides which accounts are created and remains responsible for that decision. We collect from a child's account nothing beyond what is listed above, we do not profile children, and we show no advertising. A parent, guardian or school can ask us at any time to show or delete a child's data.

Changes

We may update this policy; the date at the top shows the current version.