Privacy policy

Who we are

FieldNotes is a forms service by ZADMIN. Contact legal@zadmin.dev about privacy, access, corrections, or deletion. Form organizers choose their questions and how they use responses; ask the organizer about their study or event.

What we collect

When organizers sign in with Google, Supabase Auth receives their account identifier, email, name, and available profile information, such as a profile image. We use this to authenticate accounts and assign forms to their owners. We do not receive Google passwords or request access to Gmail, Drive, or contacts.

We store form titles, descriptions, questions, settings, and creation/update times. For participants, we store submitted answers, a response identifier, submission time, and a copy of the questions at submission. Names and email addresses are collected only if the form asks for them or they appear in an answer.

When answers save

New forms at /f/… save answers when you select Submit response and the server accepts them. Unsubmitted answers stay in the page and may be lost on refresh. Participants do not need to sign in. A form is not necessarily anonymous: answers may identify you even without a name field.

Access and service providers

The organizer can view, download, and delete responses to their forms. Authorized FieldNotes operators may access information for support, security, and privacy requests. We do not publish or sell responses or use them for targeted advertising.

Vercel hosts the app. Supabase provides account authentication and the database for new forms. Google provides Google sign-in. These providers may process IP addresses, device information, request times, and security or diagnostic logs to operate their services. Data may be processed outside your country, including in the United States.

See the privacy notices for Vercel, Supabase, and Google. We use encrypted connections and access controls; absolute security cannot be guaranteed.

Cookies and local storage

Organizer sign-in uses essential, secure, HttpOnly cookies to maintain sessions, configured for up to 30 days and refreshed during use. Sign out on shared devices. The app does not use advertising cookies, analytics trackers, or third-party fonts.

Participant forms keep a temporary response identifier in session storage to prevent duplicate submissions after a retry. New form answers are not stored there. Loaded responses stay in page memory. Downloaded exports remain on the organizer’s device.

Retention and deletion

There is no automatic deletion schedule. Organizers can delete individual responses or a form and its responses in their workspace. Exported files are separate copies, and providers may retain backups or operational logs under their own schedules.

For account deletion, access, correction, or response deletion, contact legal@zadmin.dev. Include the form link and response receipt if available. We may request limited information to locate the record and verify your request. Do not send passwords or identity documents. Additional rights may apply where you live.

The original school study

The separate school study collects names, grades, optional program information, and school-experience answers. After participants enter the study code and agree, answers save while they work, including incomplete responses and earlier versions. Its research team accesses named responses with the separate private admin password.

Those records remain in a private Vercel Blob store in the United States. The study uses session storage for a draft and session token. Clearing that draft or closing the tab does not delete server records. Deletion is manual and must cover earlier saved versions and controlled exports. Contact us to request it.

Students and permission

Organizers are responsible for arranging any required school or parent/guardian permission. The app does not verify age or provide a verifiable parental-consent process. Do not use it to collect personal information from children under 13 without first contacting us to address the applicable requirements. Parents or guardians can contact us about a child’s response.

Participation is voluntary. Skip optional questions or stop if you do not want to answer. Leave out sensitive personal information and other people’s private details.

Changes

We will update this page and its date when our practices change.