← Back to FormFriends

Privacy Policy

Last Updated: September 2026 • Compliant with EU GDPR / Spanish LOPDGDD

Welcome to FormFriends ("we", "our", or "the platform"), accessible at formfriends.com. We take your privacy and personal data protection seriously. This Privacy Policy transparently explains how we collect, process, and safeguard your data when you visit our website, create game rooms, vote in interactive polls, or share results to social media.

1. Data Controller

The entity responsible for processing your data (Data Controller under Regulation (EU) 2016/679 - GDPR and Spanish Organic Law 3/2018 - LOPDGDD) is FormFriends. For any data protection inquiries, questions, or to exercise your rights, contact us at:

2. Data We Process and How It Is Used

Depending on your interaction with FormFriends, we process the following categories of information:

• Room Creation Data: Group names, custom question prompts, and participant names that creators enter into the room builder.
• Instagram Public Profile Data: If you use the Instagram Poll mode, we process the public username (e.g. @username) you provide and retrieve your public profile picture solely to render your customizable visual Story template.
• Anonymous Voting Data: When friends participate in a poll, individual votes (e.g. YES/NO or selections of friends) are recorded anonymously. FormFriends does not link individual voting choices to real user accounts or identities.
• IP Addresses for Anti-Fraud & Vote Integrity: When a user accesses a voting room, their public IP address is retrieved via a third-party utility (ipify.org) and stored temporarily in the room's record (votedIPs) for the exclusive purpose of preventing automated voting fraud, spam, and duplicate submissions. IP addresses are never sold or used for behavioral profiling.
• Technical & Analytical Data: If you explicitly consent to optional cookies, we collect aggregated analytics metrics (page views, browser type, general geographical region) via Google Analytics / Firebase Analytics.

3. Legal Basis for Processing (GDPR Article 6)

We process your data based on lawful grounds:

• Consent (Art. 6(1)(a) GDPR): When you create a room, submit optional poll questions, or accept Google Analytics cookies via our Cookie Consent banner.
• Legitimate Interest (Art. 6(1)(f) GDPR): To ensure system security, maintain voting integrity, and prevent double-voting abuse by temporarily registering anonymized IP identifiers.
• Performance of Service (Art. 6(1)(b) GDPR): To generate and deliver the interactive voting rooms and shareable visual cards requested by users.

4. Data Storage & Hosting Infrastructure

Our application data is hosted on Google Cloud Platform (Firebase Firestore). Firebase provides enterprise-grade encryption in transit (HTTPS/TLS) and at rest. When data is stored or processed on Google servers, transfers comply with Standard Contractual Clauses (SCCs) and GDPR international transfer frameworks.

5. Data Retention

We retain room data, questions, votes, and associated integrity logs only as long as necessary for participants to view the room's live results. Room creators can request immediate room deletion at any time by contacting us.

6. Your Rights Under GDPR & Spanish Law

Under the GDPR and LOPDGDD, you have the following enforceable rights:

• Right of Access: Confirm whether we process data relating to you and receive a copy.
• Right to Rectification: Request correction of inaccurate information.
• Right to Erasure ("Right to be Forgotten"): Request the complete deletion of a room, username, or IP record.
• Right to Restrict Processing & Right to Object: Object to specific data processing activities.
• Right to Withdraw Consent: Revoke cookie consent at any time through our Cookie Policy settings.

To exercise any of these rights, send an email to contactorajoydaily@gmail.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es if you believe your rights have been violated.

7. Minimum Age Requirement

FormFriends is designed for users aged 14 and older (in accordance with Article 7 of Spanish Organic Law 3/2018 LOPDGDD). We do not knowingly collect personal data from children under 14 without parental authorization. If we learn that such data has been collected, we will delete it promptly.

8. Contact

For questions regarding this policy or our privacy practices, please contact us at contactorajoydaily@gmail.com.