Privacy and security

Formhaul reads your templates and forms inside the browser tab and sends them nowhere. There are no accounts, no analytics and no cookies. This page is written so it can go straight to a security reviewer.

Last updated 2026-10-14.

What happens to your files

When you drop or choose files, the page reads them with the browser's File API into the memory of this tab. Unzipping, reading the template, drawing each form, building the PDFs, CSV and Excel files and packing the zip all run in JavaScript on your computer. The results are handed to you as a download made in the browser. Nothing is written anywhere else, and everything is gone when you close the tab.

What the page stores

• In the browser's local storage for this site: the licence code, if you have one, and your choice of paper size and orientation.
• Nothing else. No cookies are set.

What the page contacts

• Cloudflare Pages, which serves the site's own files (HTML, CSS, JavaScript, fonts). Cloudflare keeps ordinary request logs for its own operations.
• The store at formhaul-store.jonathonwager10.workers.dev, only when you buy, restore a purchase, or (in old browsers that cannot check signatures) check a licence code. It receives the Stripe checkout reference, or the email and four characters you type into Restore, or the licence code. It asks Stripe whether that purchase is real and answers. It keeps a count of codes issued per purchase and rate-limit counters, both under one-way hashes, and nothing about you. Its request logging is switched off.
• Stripe, only if you press Buy, on Stripe's own checkout page.

The page loads no scripts, fonts or images from anywhere else. Your forms never travel with any of the requests above.

For a security review

• Every page is sent with a Content-Security-Policy that allows scripts only from the site itself and network connections only to the site and the store. The policy is in the response headers, so you can read it in the browser's developer tools.
• Forms are drawn in an iframe that is sandboxed with scripts disabled. Anything a template or form tries to run is never run. Links and pictures that point outside the page are removed before drawing, so a form cannot make the browser fetch anything.
• Template code (the .dll, .js or .vbs files some templates carry) is read past and never executed. Data connections in the template are not contacted.
• You can check all of this yourself. Open the developer tools, select the Network tab, then drop your files: no request carries them. Or load the page, disconnect from the network, and use it offline.
• The code is plain JavaScript, not minified, in /js/ on this site.

Purchases

Payments are handled by Stripe. Stripe collects the card, the email and the billing details and sends the receipt; this site never sees the card. Stripe's privacy policy covers what it keeps.

Questions

Write to jonathonwager@plaugstudios.com. Formhaul is made by Jonathon Wager (Plaug Studios) in Ontario, Canada.