Privacy policy

Quire (quireforms.ca) is run by Ian Ryu, an individual in Toronto, Ontario, Canada, who is responsible for the service and for the information in this policy.

For the accounts of people who build forms, Quire decides what is collected and why. For the answers to a form, the form’s owner decides what to ask and what to do with the answers, and Quire stores and delivers them for the owner. So if you want an answer you gave changed or deleted, the form’s owner is the first person to ask.

What’s collected.

• Your answers, including any files you upload and any signature you draw.
• Answers are saved as you go. If you stop partway through, what you’ve entered so far is kept, and the form’s owner can see it as an unfinished response. On a form that asks you to sign in, those unfinished answers are also filled back in when you open the form again signed in with the same account, on any device, for 15 days after your last change, unless the form’s owner turned this off. “Start over” clears them.
• Details carried in the link you opened, if the owner set some up, such as which poster or post you came from (for example utm_source). These are saved with your response.
• On a form that requires sign-in: your email address, as confirmed by Google or Microsoft, and which of the two you used. It is saved with your response and fills in any email question on the form.
• On a form that takes payment: an internal code Quire makes up for your payment, when it is due, and whether the form’s owner has marked your e-Transfer as received. Quire never handles the money itself.
• Your IP address (the number that identifies your internet connection), used to limit how many responses one connection can send in a minute, which keeps spam out. On a form that requires sign-in, a scrambled form of your email address is used for the same limit, so you are counted as yourself and not as everyone on your Wi-Fi. See how long things are kept.
• A check that you’re a person. Unless the form’s owner turned it off, when you submit, Cloudflare’s Turnstile checks that a person, not a program, is sending the form. Your browser gives Cloudflare information about itself and your connection, including your IP address, and now and then you may be asked to tick a box. Quire doesn’t store any of it: the check only decides whether this response is accepted.

Who can see your response.

• The form’s owner, signed in to Quire.
• Anyone the owner chooses to send it to: email addresses set up to receive a copy of each response (the email contains your answers), a web address the owner connects to receive responses automatically, and AI assistants or other tools the owner connects to their account. What the owner does with responses they export or forward is up to them, not Quire.
• A results summary, if the owner shares one. The owner can let people they add, or anyone with a link, see a summary of the form’s results. It shows how many people picked each choice, the average for number questions and, unless the owner hides them, the words typed into short-answer, paragraph and email questions. It never says who gave which answer, and never includes uploaded files, signatures, addresses, sign-in email addresses or payment details. When the owner shares it only with people they add, Quire keeps those people’s email addresses, and each of them signs in with Google or Microsoft to open it. Each person the owner adds gets one email from Quire with the link, which contains the form’s title and never any answers.
• A Google Sheet, if the owner connects one. The owner can have Quire keep a spreadsheet in a Google account they choose filled with the form’s completed responses (the same details as the form’s Excel download, laid out for reading), with an Overview tab counting them. Google then holds that copy under the owner’s Google account and Google’s own terms. A response deleted in Quire is removed from the sheet; anything the owner copies or types into the sheet stays with them.
• Quire’s service providers, listed below, which store and deliver it.
• Ian, as the person running Quire, can reach the database and files. He looks only when it is needed to keep Quire working, fix a problem, act on a request you make, check a form reported as a scam, or answer a legal demand. Quire doesn’t keep a record of when he does.

Confirmation email. Quire emails you only if the form’s owner has turned on confirmation emails. You then get one email for your response, sent to the address you gave in the form’s email question, or the one you signed in with. It contains the owner’s message, the form’s title, whether you have a place or are on the waitlist, and the date. It never contains your answers. Replies go to an address the owner chooses. To stop anyone using a form to flood someone’s inbox, one address gets at most 5 of these from Quire a day; for that, Quire keeps a scrambled copy of the address (which can’t be turned back into it) for two days.

Videos and images from other sites. If a form shows a YouTube or Vimeo video, or an image hosted somewhere else, your browser loads it from that site. That site can see your IP address and applies its own privacy policy.

How long it’s kept. A response is kept until the form’s owner deletes it, deletes the form, or deletes their account. Uploaded files are deleted along with the response or form they belong to. A form the owner deletes goes to their trash first, in case it was deleted by mistake: it stops being reachable at once, and it is erased, with its responses and files, 30 days later, or sooner if the owner chooses to. A file you upload but never submit, or remove from your answer, is deleted after 24 hours.

What’s collected.

• Your email address and password. The password is stored only in a scrambled form that can’t be turned back into the password, never as the password itself.
• Your display name and language, if you set them, and a profile picture if you upload one. A profile picture is stored at a link that anyone who has it can open, though the link isn’t published anywhere.
• Your two-factor sign-in settings, if you turn them on.
• For each device you’re signed in on: the browser and device type, and an approximate location (city and country, which Cloudflare works out from your connection). You can see these and sign devices out in Settings. A sign-in stops working after 30 days without use, and after 90 days at most.
• The forms, questions, designs and files you create, and any API tokens (keys that let other tools, such as an AI assistant, use your account), stored only in scrambled form.
• A security log of changes made through API tokens or connected AI tools, and of devices or tokens being signed out or revoked. Each entry says what kind of change it was, which form or token it touched, and when. It contains no answers to forms.

Email Quire sends you. Password-reset links; an alert when your account is signed in from a new browser, with the device, approximate location and time; and, if you set it up, a copy of each response to the addresses you choose.

Deleting your account. Settings → Delete account removes your account, forms, responses, uploaded files, sign-ins, tokens and two-factor settings. The security log above is kept until it is a year old, and the spam-protection records until they are an hour old; see how long things are kept.

Feedback. If you send feedback from the quireforms.ca home page, it is emailed to Ian with the email address you give, if any. It isn’t stored in Quire.

To sign you in, Quire asks Google and Microsoft only for your basic profile: who you are and your email address (the openid, email and profile permissions). Signing in doesn’t let it read your email, files, contacts or anything else in your account. Google or Microsoft tells Quire the address is really yours, which is why a form’s owner can trust it. The one thing that asks for more is a form’s owner choosing to connect a Google Sheet, described below.

• Answering a form: Quire keeps your verified email address and whether it came from Google or Microsoft. The form’s owner sees the address with your response.
• Opening a form’s shared results: the same as answering a form. Quire keeps your verified email address, only to check it against the list of people the form’s owner shared the results with.
• Signing in to build forms: Quire keeps your email address, the account ID Google or Microsoft gives it (so it recognises you next time), and your name once, as your display name when your account is created.
• Connecting a form to Google Sheets (form owners): Quire asks Google only for permission to edit the files it creates in your Drive (the drive.file permission), never the rest of your Drive. It keeps the key Google gives for that, locked with encryption, and uses it only to keep that form’s sheet up to date and to read back, from that sheet, who was marked paid there. It also keeps the connected Google account’s email address: it’s shown to you in Quire so you know which account the sheet is in, and used to find the same sheet again if you reconnect, and to check whether another of your forms still uses that account before a disconnect gives its key back. Disconnecting gives the key back to Google and deletes it; you can also remove Quire’s access from your Google Account at any time.
• Apart from a connected Google Sheet, Quire doesn’t keep the access tokens Google or Microsoft issue. It never keeps your profile photo.
• This information is used only to sign you in, to show the form’s owner who answered, and, for a connected Google Sheet, to keep that sheet up to date and read back who was marked paid in it. It isn’t used for advertising or sold, and it goes to no one beyond the people described on this page.

Quire’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: what Google shares is used only for the sign-in and the Google Sheets link described here.

You can remove Quire’s access at any time in your Google account or Microsoft account. To have the email address itself deleted, write to privacy@quire.my.

• Cloudflare runs Quire and stores its database and files, and runs the check that you’re a person when you submit a form (Turnstile).
• Resend sends Quire’s email.
• Google and Microsoft handle sign-in, when you choose it. Google also holds a form’s responses in a Google Sheet, when the form’s owner connects one.

These companies are based in the United States. Quire’s database runs in Cloudflare’s eastern North America region, and email and files may be handled elsewhere, so your information may be stored or processed outside Canada, including in the United States. While it is there, the courts and authorities of that country may be able to demand access to it.

Beyond these providers and the form owners described above, personal information is disclosed only when a court order or other legal demand requires it.

Quire sets only cookies it needs to work. None are for analytics or advertising, and none track you across other sites.

qr_session

Keeps a form builder signed in. Lasts 30 days, or until the browser closes if “Keep me signed in” is off.

qr_device

Recognises a browser you’ve signed in from, so a new-sign-in alert is sent only for new ones. Lasts 400 days.

qr_oauth_state, qr_oauth_pkce

Protect a Google or Microsoft sign-in while it’s in progress. Lasts 10 minutes.

qr_mfa_challenge

Holds a sign-in open while you enter a two-factor code. Lasts 5 minutes.

qr_respondent

Keeps you signed in to answer a form that requires sign-in. Lasts 7 days.

qr_done_…

Remembers you’ve answered a form that allows one response per person. Lasts 1 year.

Your browser also stores your light or dark theme, accent colour and last workspace, and, for one visit, the question order on forms that shuffle their questions. These stay on your device.

Because Quire doesn’t track you across sites, a browser’s “Do Not Track” setting changes nothing here.

• Responses and files: until the form’s owner deletes them, the form, or their account.
• A deleted form, with its responses and files: up to 30 days in its owner’s trash, where only the owner can restore it or erase it sooner; then it is erased automatically.
• Files uploaded to a form but never submitted, or removed from an answer: 24 hours.
• Accounts: until you delete yours.
• Backups: Cloudflare keeps a restore history of the database for up to 30 days, so something deleted can still be recovered for that long, and is gone for good after it. Quire doesn’t make other copies.
• Sign-ins, password-reset links and two-factor codes: they stop working after the times listed above, and are then deleted automatically. The clean-up runs whenever Quire starts handling requests, so on a quiet day it can take a little longer.
• Confirmation emails: a scrambled copy of the address each was sent to, and when, kept for two days to enforce the daily limit, then deleted.
• Spam protection: to slow down repeated attempts, Quire records your IP address (for newer IPv6 addresses, only the network part) with a count; for sign-ins, and for answering a form that requires sign-in, a scrambled form of your email address; and for password resets, the email address entered. These records are deleted once they are an hour old: every sign-in, submission or upload clears out any older ones.
• The security log: kept for one year, then deleted, including after an account is deleted, so misuse of a token can still be looked into. Ask and entries about you will be deleted sooner.

Everything Quire sends travels over an encrypted connection (HTTPS). Passwords are scrambled as described above, two-factor sign-in is available, repeated sign-in and submission attempts are slowed down, and files uploaded to forms are private: even the form’s owner opens them through links that stop working after five minutes.

If a breach puts your information at risk, account holders will be emailed. People who answered a form will be told through the form’s owner and by a notice on quireforms.ca, since Quire usually has no way to reach them directly. Breaches will also be reported to the Office of the Privacy Commissioner of Canada where the law requires it.

You can ask to see the personal information Quire holds about you, correct it, or have it deleted, and you can withdraw your consent by deleting your account or asking for your information to be deleted. Write to privacy@quire.my. You’ll get an answer within 30 days, and you may be asked to confirm who you are first.

For answers you gave on a form, ask the form’s owner first. If you can’t reach them, write to privacy@quire.my: your request will be emailed to the form’s owner, and you’ll be told when that has happened and what they did.

If you’re unhappy with the answer, you can complain to the Office of the Privacy Commissioner of Canada.

Quire isn’t meant for children under 13, and forms shouldn’t be used to collect information from them. If you believe a child under 13 has given information through Quire, write to privacy@quire.my and it will be deleted.

The date at the top shows when this policy last changed. A change will be emailed to people with a Quire account at least 14 days before it takes effect, and noted on the quireforms.ca home page for the same 14 days, unless a law or a service Quire depends on forces it sooner. Typos and wording that doesn’t change what the policy means can be fixed without notice.

If Quire shuts down, people with an account will be emailed at least 30 days beforehand so they can export their responses, and everything will then be deleted, unless something outside Ian’s control, such as a hosting provider closing the account, ends Quire sooner. If Quire is handed to someone else, account holders will be told before it happens, and the new operator will have to keep to this policy or ask for agreement to a new one.

Ian Ryu, Toronto, Ontario, Canada · privacy@quire.my