Privacy Policy

Effective and last updated: October 21, 2026

Forms Review is a desktop application for PDF markup, document review and collaboration, provided by Midnight Works LLC ("we", "us"). This policy explains the desktop app, our account-linking service, optional online session directory, and this website. It describes the current alpha and optional features when enabled.

Documents and local application data

Ordinary document opening, editing and markup work is performed on your computer. Documents, annotations, reviewer profiles, settings, recovery data and local databases are stored on your device or in locations you select. Linking a Google or Microsoft account does not upload your PDFs to our account service. Local files may also be copied by your own backup, synchronization or storage providers according to your settings.

Google and Microsoft account linking

Account linking is optional and identifies you for collaboration and session discovery. We request OpenID Connect permissions openid, profile and email. The identity response can contain your provider account identifier, issuer, email address and basic profile claims. We retain the provider, issuer, account identifier, verified email address, an internal account identifier and creation time. Basic profile claims may be received while verifying sign-in; our account database does not retain a profile photograph or profile name.

Google sign-in requires its verified-email claim. Microsoft linking additionally requires confirmation of an email address you control. We do not request permission to read your Gmail or Outlook messages, contacts, calendar, Google Drive or OneDrive, or to send mail through your mailbox. We do not receive your Google or Microsoft password. Provider tokens are used to verify the sign-in response and are not retained by our account service.

We use linked identity information to authenticate you, show your linked account, locate session listings addressed to your verified email, and protect the service against misuse. We do not sell Google or Microsoft account data, use it for advertising, or send it to our optional AI integration. Forms Review's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements where applicable.

Google user data: access, use and sharing

Data accessed. When you choose Google account linking, Forms Review requests only openid, profile and email. Google returns an identity token containing an account identifier and issuer, email address and email-verification status, and potentially basic profile claims such as a name or picture. We validate the signed identity token. We store the Google account identifier, issuer and verified email, together with our internal account identifier and creation time; we do not store the profile name or picture. Google authorization codes and tokens are processed during the sign-in exchange and are not retained in our account database. We do not request Google Workspace, Gmail, Drive, Contacts or Calendar data.

How we use it. We use that Google identity to link the account you selected to your local reviewer, authenticate requests to our account service, display the linked email, and find online session listings addressed to that email. The email also identifies an organizer's published listing. Google linking is optional: it does not change your software license or upload local documents. We do not use Google user data for advertising, credit decisions, data brokerage, or developing, improving or training generalized AI or machine-learning models.

Who receives it. Cloudflare processes the hosted identity and authentication records on our behalf as the account service's hosting and database provider. Google receives the authentication requests needed to complete the sign-in you initiate. If you publish a session listing, the organizer email and listing are visible to accounts whose verified email is included by the organizer. Participant email addresses are stored for that matching; the directory does not expose a participant roster to other participants. Separately shared session folders may contain reviewer names and emails as described below. We do not sell Google user data, provide it to advertisers or data brokers, or send it to Anthropic. Authorized service administrators may access hosted records only as needed for support, security, maintenance or legal obligations. Other disclosures are limited to the purposes described in this policy, including lawful requirements and protecting people and systems.

Google user data: protection, retention and deletion

Protection. HTTPS protects account-service requests in transit. The service verifies Google's signed identity response, binds a sign-in to its initiating app with state, nonce and PKCE checks, restricts authenticated access to the verified account, and stores hashes of its refresh and one-use return tokens. The installed Windows app stores its account-linking credentials using Windows-protected storage. Google provider tokens are not kept for ongoing access. These measures reduce risk; they do not guarantee that a device or service cannot be compromised.

Retention. The stored Google identifier and verified email remain in your hosted account record until removed following a verified deletion request, subject to legal and security needs. There is currently no automatic inactivity-deletion schedule. Organizer-published listings remain until the organizer removes them or we act on a verified request. Authentication records have the short lifetimes and scheduled cleanup described under Retention below. Disconnecting Google in the app or revoking access at Google stops that connection; it does not automatically delete the existing hosted account or listings.

Deletion and control. You can disconnect in Linked account, remove your own online session listings, and revoke the connection in Google Account connections. To request deletion of the stored Google identifier, email, associated hosted account and applicable directory records, email tbrigman@phosphorgroupusa.com with the subject “Privacy request” and the linked email address. We verify that you control the affected account before removing its hosted records, including dependent authentication and directory records, except information we must retain for legal or security reasons. Do not send a password or token. There is no automatic account-deletion button; requests are handled manually. Provider backups may retain copies until their retention cycle completes, and we cannot erase copies independently held by session participants or your storage provider.

Authentication and security information

Our service processes temporary sign-in state, security challenges, verification requests, token hashes and expiry times. It retains authentication-session records and may retain a hashed device identifier supplied by the app. Requests necessarily expose network information, including your IP address, to our hosting provider. Application rate limits use hashed keys derived from request identifiers such as an IP address or email address; the rate-limit database does not store those raw identifiers as its keys. We use this information for authentication, abuse prevention and service security.

Sessions and other participants

Review Sessions use folders and storage locations selected by their organizers. Depending on the session, participants with access can receive documents, markups, reviewer names and emails, membership and device/public-key information, comments, chat and activity records. Sharing a folder through a network or third-party synchronization service also makes that service part of your sharing arrangement.

The optional online directory receives a session identifier, name, phase, organizer account and participant/invitation email addresses when an organizer explicitly publishes or updates a listing. The organizer's email and listing information can be shown to accounts whose verified email is on that listing. The directory stores no PDF contents, document paths, invitation tokens or session keys. A listing helps people find a session; it does not grant document access or prove organizer authority. Organizers must update or remove a published listing when membership changes.

Invite only people you are authorized to contact and share documents only when you have permission. Removing someone or deleting a directory listing does not erase copies or exports they already received, or remove information from a separately managed shared folder.

Optional AI features

If you configure an Anthropic API key and use an AI feature, the app sends your prompts, relevant conversation history and document context to Anthropic. Summarize and extraction features can send extracted text from the selected document's pages. These requests go directly from the app to Anthropic using your API key, rather than through our account service. Anthropic's terms and privacy practices apply to that processing. Do not use the feature for information you are not authorized to send.

The current alpha stores the AI API key in the app's local browser storage; it is not protected in the same way as the Windows-protected account-linking credentials. You can remove the key in AI settings. Our account service does not collect that key or receive AI prompts, document text or responses.

Diagnostics, support and website visits

The app keeps bounded local diagnostic records, including error messages, timestamps, app version, operating-system/architecture information, window activity and document counts. Error messages may contain file paths or other context. Diagnostics are not automatically uploaded. Review an export before sending it to support. If you contact us, we receive your message, contact details and any files or diagnostics you choose to provide and use them to answer the request and investigate the issue.

These public pages do not set application cookies, load advertising trackers or use analytics scripts. Google, Microsoft and other sites you visit have their own cookie and privacy practices. Our hosting provider can process network and security information even though application request/observability logging is disabled.

Service providers and other disclosures

Cloudflare provides hosting, network security and database infrastructure for our account service and this website. Google and Microsoft process sign-in under their own policies. When configured, mailbox-confirmation delivery uses Cloudflare email delivery or Resend and discloses the recipient address and verification message to that delivery provider. Anthropic processes optional AI requests as described above. Your selected storage provider processes shared session data according to your arrangement with it.

We may disclose information as necessary to respond to lawful requirements, investigate misuse, protect people and systems, or handle a support request. We do not sell personal information or share it for targeted advertising. We do not use linked account data or document content to train our own AI models. The app's direct AI requests remain subject to your Anthropic account terms and settings. Authorized service administrators may access hosted records when necessary for support, security, maintenance or a legal obligation.

Retention

Local documents and application data remain under your control until you delete them; uninstalling may leave application data, backups or shared folders. Hosted account and directory records currently have no automatic inactivity-deletion schedule and remain until removed through available controls or a verified request to us, subject to legal and security needs. Disconnecting an account or revoking provider access does not by itself delete these records.

Sign-in transactions last up to 10 minutes, one-use return codes up to 90 seconds, access tokens 15 minutes, and refresh sessions up to 30 days. Expired temporary records are removed by scheduled cleanup, rather than necessarily at the instant they expire. Copies in provider backups may remain until the provider's backup retention cycle completes. Information needed for a legal obligation or an active security investigation may be retained for that purpose.

Your choices and privacy requests

You can use local document features without linking a cloud account, disconnect a linked account in the app, revoke its authorization in your Google or Microsoft account settings, remove your own published directory listings, remove the AI key, and manage local files and session folders. Revocation stops future authorized access; it does not automatically erase previously stored records.

Contact tbrigman@phosphorgroupusa.com with the subject “Privacy request” to request access, correction or deletion of hosted account information, or ask about a listing that contains your email. Identify the account email and relevant session without sending passwords, tokens or unnecessary document contents. We may ask for proportionate verification before acting. There is currently no automatic account-deletion button. We handle applicable access, deletion, objection, restriction and portability rights according to the law that applies to you. You may also have the right to complain to your local privacy regulator. We cannot delete copies held independently by other participants or your storage providers.

Security, location and children

We use measures including HTTPS, limited permissions, hashed service tokens and access controls. No system is completely secure. Protect your device, account, API keys, invitations and shared folders. Service providers may process data outside your country, including in the United States; this policy is not a claim of country-specific storage or certification. Forms Review is intended for professional and general document work, not directed to children under 13. Contact us if you believe we have collected a child's information so we can investigate and address it.

Changes and contact

We will post changes here with an updated date. For a material change to the use of linked account data, we will provide appropriate notice and obtain any required consent before using that data for a new purpose. Privacy questions and requests: Midnight Works LLC, tbrigman@phosphorgroupusa.com.