Privacy Policy
Last Updated: 12/27/2025
Effective Date: 12/27/2025
Developer Contact: democraticdeveloper@gmail.com
Introduction
This Privacy Policy describes how GPT Forms Creator ("we," "our," or "the application") collects, uses, stores, and protects Google user data when you use our application to create Google Forms. This policy is designed to comply with the Google API Services User Data Policy and Google APIs Terms of Service.
By using this application, you consent to the data practices described in this policy.
1. Data Accessed
IMPORTANT: Our application does NOT read or access any existing Google User Data. We only create new Google Forms using data provided by you through ChatGPT conversations.
Google Forms API Scopes
https://www.googleapis.com/auth/forms.body: This scope allows our application to create new Google Forms in your Google account. This is the only scope we use. While this scope technically includes read permissions (as described: "See, edit, create, and delete"), we never exercise the read permissions - our application only performs write operations (creating forms).
What We Actually Do
- Create New Forms: We use the Google Forms API to create new, blank forms in your Google account
- Add Form Content: We add titles, descriptions, questions, and settings to newly created forms
- OAuth Authentication: We use OAuth access tokens solely to authenticate API requests. These tokens are managed by the ChatGPT platform and are not stored by our application.
What We Do NOT Do
Our application does NOT:
- Read existing forms from your Google account
- Access form responses or submissions
- Read form metadata or structure from existing forms
- Access user email addresses or personal information
- Read any other Google User Data
Data Source
All form content (titles, questions, options) comes from:
- Your conversational input to ChatGPT (e.g., "create a feedback form")
- ChatGPT's AI-generated form specifications based on your input
- NOT from any Google API or existing Google User Data
2. Data Usage
How We Use Data
Important: We do NOT use Google User Data because we do NOT read any Google User Data. Instead:
- Form Creation: We use user-provided form specifications (generated by ChatGPT based on your prompts) to create new Google Forms in your Google account via the Google Forms API. The form content comes from your conversation with ChatGPT, not from reading existing Google data.
- Idempotency Management: To prevent duplicate form creation when requests are retried, we store minimal metadata (form ID, edit URL, view URL, and a hash of the form specification) in local JSON files. This allows us to return existing forms instead of creating duplicates. These records contain only metadata about forms we created, not any Google User Data.
- OAuth Authentication: OAuth access tokens are used solely to authenticate API requests to Google's servers. These tokens are not stored by our application and are managed by the ChatGPT platform.
Processing and Handling
- All data processing occurs in real-time during form creation requests
- Form specifications (generated by ChatGPT from your prompts) are transmitted directly to Google's Forms API to create new forms
- We do NOT read, analyze, or process any existing Google User Data
- We do not use any data for advertising, marketing, or any commercial purpose beyond providing the form creation service
Data Flow: User Prompt → ChatGPT → Form Specification → Our Server → Google Forms API (CREATE only)
3. Data Sharing
We do not share Google user data with any third parties because we do not read or access Google user data.
Specifically:
- No Google User Data Sharing: Since we do not read Google User Data, there is no Google User Data to share
- No Third-Party Sharing: We do not sell, rent, or share any data with third-party services, advertisers, or data brokers
- No Analytics: We do not send any data to analytics services
- Direct API Access: Forms are created directly in your Google account through Google's official Forms API. The forms and their data remain in your Google account and are subject to Google's privacy policies
- ChatGPT Platform:
- OAuth tokens are managed by the ChatGPT platform as part of their MCP (Model Context Protocol) integration
- ChatGPT receives only your conversational prompts and generates form specifications based on those prompts
- ChatGPT does NOT receive any Google User Data from our application
- The form content sent to ChatGPT is generated by ChatGPT itself, not from Google APIs
Exception: We may be required to disclose data if legally obligated to do so (e.g., in response to a valid court order or subpoena), but we will notify you to the extent legally permitted.
4. Data Storage & Protection
Storage Practices
What We Store:
- Idempotency Records: Minimal metadata stored in local JSON files on our servers, including:
- SHA-256 hash of the form specification (a one-way cryptographic hash)
- Google Form ID
- Edit URL and View URL for the created form
- No Personal Information: We do not store names, email addresses, or any other personally identifiable information
- No OAuth Tokens: We do not store OAuth access tokens or refresh tokens
What We Do NOT Store:
- OAuth access tokens or refresh tokens
- User email addresses or personal information
- Form content or responses
- Any data that could identify individual users
Security Measures
We implement the following security practices to protect stored data:
- File System Security: Idempotency records are stored in secure server directories with restricted file permissions
- Cryptographic Hashing: Form specifications are hashed using SHA-256 before storage, making it computationally infeasible to reconstruct the original form content from stored hashes
- No Network Transmission: Stored idempotency records are not transmitted over networks except as necessary for application functionality
- Server Security: Our servers follow industry-standard security practices, though specific infrastructure details are proprietary
Limitations:
- Idempotency records are stored in plain JSON format (containing only non-sensitive metadata)
- While we implement reasonable security measures, no method of transmission or storage is 100% secure
5. Data Retention & Deletion
Retention Policy
Idempotency Records: We retain idempotency records (form IDs, URLs, and hashes) indefinitely to maintain the idempotency feature, which prevents duplicate form creation. These records contain minimal, non-personally identifiable information.
OAuth Tokens: We do not store OAuth tokens, so there is no retention period for tokens. Token management is handled by the ChatGPT platform.
User Rights and Deletion Requests
You have the right to request deletion of data associated with your use of the application. To request deletion:
- Contact Us: Send an email to democraticdeveloper@gmail.com with the subject line "Data Deletion Request"
- Provide Information: Include the following information in your request:
- Your Google account email address (if you wish to identify records associated with your account)
- Form IDs or edit URLs of forms created through our application (if you have them)
- Any other information that may help us identify your records
- Verification: We may request additional information to verify your identity before processing deletion requests
- Processing Time: We will process deletion requests within 30 days of receipt and verification
What Gets Deleted:
- Idempotency records associated with your forms (form IDs, URLs, and hashes)
- Any other data we may have stored related to your account
What Does NOT Get Deleted:
- Forms created in your Google account (these remain in your Google account and must be deleted through Google Forms)
- Data stored by the ChatGPT platform (you must contact ChatGPT for deletion of their stored data)
- Data we are legally required to retain
Note: Because we store only cryptographic hashes and form IDs (not personally identifiable information), we may not be able to definitively identify all records associated with a specific user. We will make reasonable efforts to identify and delete records based on the information you provide.
6. User Control and Consent
- OAuth Consent: You grant permission to create Google Forms in your account through Google's OAuth consent screen when you first use the application
- Revocation: You can revoke access at any time through your Google Account settings (https://myaccount.google.com/permissions)
- Form Ownership: All forms created through our application are created in and owned by your Google account. You have full control over these forms through Google Forms
7. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the updated policy on our website
- Updating the "Last Updated" date at the top of this policy
Your continued use of the application after changes become effective constitutes acceptance of the updated policy.
8. Compliance and Contact
This Privacy Policy is designed to comply with:
- Google API Services User Data Policy
- Google APIs Terms of Service
- General data protection best practices
Questions or Concerns?
If you have questions about this Privacy Policy or our data practices, please contact us at:
Email: democraticdeveloper@gmail.com
We will respond to inquiries within a reasonable timeframe.
Note: This application is designed to work with the ChatGPT platform. Some data handling (particularly OAuth token management) is performed by ChatGPT, and their privacy practices may also apply to your use of this application.
