Privacy Policy

Last updated: 2026-07-14

SubmissionBuddy is operated by High Wire Development LLC ("we", "us"). This page explains what data we collect, why, how long we keep it, and who else touches it. If anything here is unclear, email support@submissionbuddy.io and we'll answer directly.

Two kinds of data

Account data. If you sign up for SubmissionBuddy, we collect your account email, password (hashed), billing information (handled by Stripe — see below), and the forms and settings you configure. This is data about you, as our customer.

Submission data. When someone fills out a form that a SubmissionBuddy customer has connected to our service, we receive and store that submission on behalf of the form owner. We are a data processor for that data; the form owner is the controller and decides what their form collects and how long they keep it. If you submitted a form powered by SubmissionBuddy and have questions about that data, the form owner is who to contact first — we don't control what they collect or who they share it with.

What we collect on a submission

• The form fields and values submitted (whatever the form owner's form asks for — we don't enforce a schema).
• The submitter's IP address, user agent, and request origin (the site that sent the submission). We use these for spam and abuse prevention (rate limiting, risk scoring) and to give form owners basic context on where a submission came from.
• If the form owner has our CAPTCHA feature turned on, a proof-of-work verification result (verified/failed/missing) — see "CAPTCHA" below.

How long we keep it

• The raw submission payload is stored in object storage (Amazon S3) and automatically deleted after 30 days.
• The processed copy of a submission shown in the SubmissionBuddy dashboard is retained until the form owner deletes it, or until the form owner's account is closed. It does not expire on its own.

Encryption

All traffic to and from SubmissionBuddy is encrypted in transit (TLS/HTTPS). Submission data stored in S3 is encrypted at rest using AES-256 server-side encryption.

Where data is hosted

Our infrastructure runs on Amazon Web Services in the United States (us-west-2 / Oregon). Our database is hosted in the United States. We don't currently offer regional data residency options.

Who else processes data (subprocessors)

We use a small set of vendors to run the service. We don't sell data to any of them, and none of them see submission data except as needed to do the job listed:

Cookies and local storage

This marketing website (submissionbuddy.io) uses Google Analytics, which sets cookies to measure site traffic. We don't run ads or ad-tracking pixels anywhere. The SubmissionBuddy dashboard and marketing site both store your light/dark theme preference in your browser's local storage — that value never leaves your device.

CAPTCHA

Our optional CAPTCHA (available on paid plans) is self-hosted proof-of-work — it does not call any third-party CAPTCHA service, does not set cookies, and does not track submitters across sites. Verification happens entirely on our own servers.

Your rights

You can access, export, or delete your account data and your forms' submission data at any time from the SubmissionBuddy dashboard. If you need help with a data request — including a request from someone who submitted a form on your behalf, or a request to delete a specific submission — email support@submissionbuddy.io and we'll assist.

Changes to this policy

If we materially change how we handle data, we'll update this page and change the "Last updated" date above.

Contact

High Wire Development LLC support@submissionbuddy.io