← Bionic Forms
Privacy policy
Last updated 12 August 2026 · Bionic Forms is made by Bionics LLC ·
Questions: matt@bidwellhq.com
The short version. Your business data is yours. On the desktop app it
lives on your own machine, encrypted. We collect what we need to run accounts, sync and
billing — and nothing for advertising. No third-party trackers, no ad pixels, and we never
sell data. Anonymous public forms mean what they say: no name, no email, no network address.
What we collect
- Account details. Your name, email address and a hashed password — or,
if you sign in with Google or Facebook, the name and email their sign-in shares with us.
We never see those passwords.
- The data you put in your apps. Records, files and app designs you or
your team create. It is yours; we store and sync it to run the service and for no other
purpose. Apps keep a full revision history by design — deleting a record removes it from
views, while deleting an app removes the app's data outright.
- Billing. Payments run through Stripe. Card numbers go to Stripe
directly and never touch our servers; we keep the subscription status.
- Devices. The desktop app registers each device you approve, so sync
knows who is allowed to ask.
- Plain visit counts. Our own first-party record of how visitors reach
this site (the page you landed on, where the link came from). No cross-site tracking, no
advertising identifiers, no third-party analytics scripts.
Where your data lives
The desktop app is local-first: its databases are encrypted files on your own computer,
with the keys protected by your operating system's secure storage. Data reaches our servers only when you
sign in and sync, share an app with someone, or use the web app — which necessarily runs on
our servers.
Anonymous public forms
A form set to “anyone, anonymously” records no name, no email address and no network
address — the page says so, and the server keeps that promise. Rate limiting for those forms
uses a one-way hash, so raw addresses are not held even in memory.
Email
We send transactional email through Resend: receipts, sign-in verification, invitations,
and notifications you configure in your own apps' workflows. Workflow email can only go to an
app's own owner and members — the platform refuses arbitrary recipients, so it cannot be used
to send bulk or cold email. We do not send marketing email.
Google Sheets import
When you paste a link to a Google Sheet, we fetch that sheet once, over HTTPS, only to
build the import you review and approve. If you later connect Google Sheets with your Google
account, we will access only the spreadsheets you pick, only to import or sync them into your
app. Bionic Forms' use and transfer of information received from Google APIs adheres to the
Google API
Services User Data Policy, including the Limited Use requirements. Google data is never
used for advertising and never sold.
Who else touches data (subprocessors)
- Stripe — payments.
- Resend — transactional email delivery.
- Google / Meta — only if you choose their sign-in, or import a Google Sheet.
- Our hosting provider — runs the servers the hosted service lives on.
That is the whole list. No data brokers, no ad networks.
Your choices
- Export your apps at any time — Settings offers a full portable copy (design and every record).
- Delete an app and its hosted data goes with it.
- Email matt@bidwellhq.com to delete your account
or ask anything this page doesn't answer. A real person reads it.
Changes
If this policy changes, the date at the top changes with it. Material changes get an email
to account holders.