whatayarn (https://whatayarn.com (opens in a new tab)) is a form builder with text, choices, ratings, dates, file uploads and voice answers. This policy explains what we collect, how we use it, who processes it for us, and your choices. It also covers existing voice-message pages.
It covers three groups of people:
- Form owners: you have a whatayarn account and build forms or manage an existing voice-message page.
- Respondents: you answer a form or leave a voice message. You do not need an account to answer a public form.
- Visitors: you browse our site, a public form or an existing voice-message page.
1. The Data We Collect
If you answer a form or send a voice message
| Data | Details | Why we collect it |
|---|---|---|
| Your answers | The text, choices, ratings, dates, contact details and other answers requested by the form owner. Required questions are marked on the form | Delivering your response to the form owner |
| Recordings and uploaded files | Audio you record or upload, and files you submit to file-upload questions | Letting the owner review and download your response |
| Source details | The referring site’s address without its page path, browser, device, operating system and approximate city, region and country estimated from your network | Showing the owner where responses come from, when their settings and plan allow it |
| Rate-limit key | A short-lived hash derived from your IP address. The raw address is not stored with your response | Stopping spam and abuse |
| Saved progress | Unsubmitted answers held in your browser for up to 24 hours when enabled. Creator forms can also save partial submissions on our servers | Letting you finish later and, when enabled, letting the owner see partial submissions |
| Legacy remembered details | Name and email saved in your own browser after sending a voice message on an existing page | Avoiding retyping details on a later visit |
We do not transcribe recordings or extract the contents of uploaded files for AI columns. Written answers may be processed for an owner’s AI columns as described in section 3.
If you have an account
| Data | Details | Why we collect it |
|---|---|---|
| Account data | Name, email and profile photo from Google, or the email address you sign in with | Creating your account, signing you in and support |
| Form content | Questions, introductory text, design, images, links, settings and saved versions. Visitors see the published version after meeting any access requirements. Later edits stay private until published | Building, editing and publishing your forms |
| AI column settings | The AI question, possible answers, rules and source selections you configure | Providing the AI columns you choose to use |
| Billing data | Payment details processed and stored by Stripe. We keep your Stripe customer ID and current plan, and never see your full card number | Subscriptions and invoicing |
| Product feedback | The rating and comment you submit from the feedback widget | Improving whatayarn |
If you visit our site or a public form
| Data | Details | Why we collect it |
|---|---|---|
| Form and page visits | A random first-party visitor ID in your browser, the referring site’s address, browser user agent, page path and UTM campaign tags | Showing form owners visits, sources and devices in Insights |
| Form progress | Which pages of a form you reached, which questions you answered or changed, when, and whether you submitted. The referring site, UTM campaign tags, browser, operating system, device and approximate location. It stores no answers and no visitor ID, but shares an ID with your response or partial submission so the form owner sees them together | Showing form owners where people stop answering and how each person got through the form |
| Product analytics (PostHog (opens in a new tab)) | Usage events, browser and device type, approximate location and masked session replays | Understanding use and fixing problems |
| Web analytics (Rybbit (opens in a new tab)) | Cookieless page views, referring site, language, screen size, page performance and clicks on selected public buttons | Site-level traffic statistics |
| Server logs (Vercel (opens in a new tab)) | IP address, user agent, request path and time, kept briefly by our hosting provider | Security and debugging |
Our analytics events do not include submitted answers, recordings or uploaded files. PostHog creates a pseudonymous visitor profile; signing in associates that activity with your account. Account analytics may include your name, email and plan. We collect template search phrases and result counts through PostHog and Rybbit to understand which templates people need. These phrases are limited to 120 characters and email-shaped text is masked. Template search boxes are also readable in session replays; other typed content and private response details are masked. Replays exclude audio and video, remove query strings and private identifiers from page addresses, and exclude console logs and network request bodies.
We do not intentionally collect sensitive categories of data, such as health or political opinions, or data from children under 13 (see section 10). Form owners decide what to ask and are responsible for explaining their use of the information they collect.
2. Responses and Partial Submissions
When you answer a form:
- Your answers, recordings and uploaded files are stored by whatayarn and shown to the form owner. The owner can review, download, export and delete responses.
- Required questions are shown before submission. Contact information is collected only if the form asks for it.
- When enabled and allowed by the owner’s plan, the owner can see source and device details and approximate location. Location comes from network information, not GPS.
- A Creator owner can turn on partial submissions. Your written answers are then saved on our servers as you fill in the form, before you press Submit, and the owner can see them even if you never submit. Voice recordings are only sent on submission. Partial submissions are deleted 30 days after your last change unless completed, or sooner if the form or account is deleted.
- Save and finish later keeps progress in your browser for up to 24 hours on either plan. This is separate from the owner’s server-side partial submissions. The owner can turn browser saving off, for example for forms used on shared devices.
- If email notifications are enabled, we notify the form owner about new responses. Existing voice-message pages may include message details and an MP3 attachment in these emails.
Existing voice-message pages also let a creator share a message through a public listening link. That link can show the sender’s name, email, answers, recording and send time; source and device details remain private. A creator may use contributions in their own content as described in our Terms of Service.
For deletion or questions about the owner’s use of your response, contact the owner directly or email us for help.
When a form owner connects a webhook
A form owner can send completed responses to a service they choose. Each time someone submits, whatayarn sends that service the form name, question labels and answers, response ID and submission time. The delivery also includes calculated values, AI column results and any available source and journey details, such as the referring site, device, approximate location and time spent answering. Partial submissions are never sent to a webhook.
Recordings and uploaded files are sent as links that only the signed-in owner can open. An owner can pause or remove the webhook to stop future deliveries. Deleting a response from whatayarn does not delete a copy the receiving service already has.
When a form owner connects Google Sheets
Connecting Google Sheets is optional. If you connect a form, whatayarn asks Google for permission to create a spreadsheet in your Drive and update it as responses arrive. We use Google’s per-file permission (drive.file) to work with the spreadsheets whatayarn creates. We store your Google account identifier and email address so you can recognise the connection, the spreadsheet identifier and link so we can deliver rows, and encrypted access and refresh tokens so delivery can continue when you are signed out.
Each row includes the submitted answers, submission time and response ID, along with calculated values, AI column results and available source and journey details. The form title names the spreadsheet and the question labels name its columns. Recording and file links require the form owner to sign in to whatayarn. Owners can also choose to export earlier completed responses. Anyone the owner shares the spreadsheet with can see its rows.
To stop delivery for one form, open Manage integrations, select Google Sheets and choose Disconnect. To remove the stored Google connection and its tokens across all your forms, open Google Sheets setup on a form without a connected spreadsheet, select the Google account and choose Disconnect account, then Confirm disconnect. You can also revoke access in your Google Account. Rows already delivered stay in Drive until you delete them there, even if the original response is deleted from whatayarn.
Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy (opens in a new tab), including its Limited Use requirements.
3. AI Columns
Form owners can add AI columns to organise completed written responses, for example by topic, sentiment, urgency or whether a reply is needed. Standard columns are included on Free. Creator also supports custom AI questions, answers and rules. AI columns leave the original answers unchanged.
When an owner uses an AI column, we send its selected question labels and written answers, together with the AI question, possible answers and rules, to OpenRouter (opens in a new tab) and TypeSafe’s Jev model (opens in a new tab) through OpenRouter. Written answers may contain personal information, including contact details if the owner selected those questions.
An owner can also choose to include respondent details: the referring site’s name without its page path, browser, device, operating system and approximate city, region and country. Only the selected details are sent, alongside selected written answers. We do not send response IDs, unselected answers, recording URLs, audio files or uploaded files to this AI processing. Partial submissions are processed only after they become completed responses. A sample typed by an owner to preview a column is also sent to these providers.
AI results appear beside the answers. If the owner shares a link to a response, anyone with that link can see its AI results. Results are also included in CSV exports and sent to connected webhooks and spreadsheets. Owners can correct results, rerun a column or remove it and its results from whatayarn. AI can make mistakes.
We use this processing to provide the owner’s selected feature. We do not use form answers to train our own models or for our own marketing. OpenRouter and its model provider have their own retention and data-use practices; see OpenRouter’s privacy policy (opens in a new tab) and provider data policies (opens in a new tab). We do not promise that every provider has zero retention. Owners should explain AI processing to respondents where required and avoid selecting sensitive information they do not need.
4. How We Use Your Data
- Provide the Service: build and publish forms, store and deliver responses, provide selected AI columns, and keep you signed in.
- Process payments: through Stripe. We never see your full card details.
- Communicate with you: account notices, response notifications and support replies.
- Improve and secure the Service: analytics, debugging, and spam and abuse prevention.
- Show and measure related products: display links to other products we operate and understand whether those links are useful.
- Meet legal obligations: including under the Australian Privacy Act 1988 (Cth).
If we add processing of audio or uploaded-file contents in the future, we will update this policy before it launches.
5. Service Providers
We do not sell or rent your personal data. We use these providers to run the Service. Providers may also process operational information under their own terms and privacy policies. Data may be processed outside your country, including in the United States.
| Provider | What it does | Data it receives |
|---|---|---|
| Supabase (opens in a new tab) | Database and sign-in | Account details, form drafts and publications, responses, file metadata, source details, AI column settings and results, and visit records |
| Vercel (opens in a new tab) | Hosting, file storage and request logs | Response recordings and uploaded files in private storage, public form images, and request logs including IP address and user agent |
| UploadThing (opens in a new tab) | Legacy file storage | Recordings and page images uploaded before our move to Vercel storage, until deleted |
| OpenRouter (opens in a new tab) and TypeSafe (Jev) (opens in a new tab) | AI columns and previews | Selected written answers and question labels, AI questions, possible answers and rules, optional selected source and device details, and preview samples. No audio or uploaded files |
| Resend (opens in a new tab) | Account and notification recipient addresses and email contents; legacy voice-message notifications may include answers and an MP3 | |
| Stripe (opens in a new tab) | Payments | Account email address and billing details |
| PostHog (opens in a new tab) | Product analytics and masked session replay | Usage events, browser and device information, approximate location and masked replays; signed-in account name, email and plan. No submitted answers or recordings in analytics events |
| Rybbit (opens in a new tab) | Web analytics | Page views, referring site, language, screen size and performance; IP and user agent to estimate geography and filter bots |
| Upstash (opens in a new tab) | Rate limiting | Short-lived hashed IP addresses and account identifiers used to limit requests |
If whatayarn is sold or restructured, your data may be transferred to the successor, who must continue to handle it under this policy.
6. Related-Product Links
Public pages may contain a promotional link to another product we operate, such as reroute.bio (opens in a new tab). When you view or click one of these links:
- We may record the promotion view or click as a whatayarn usage event through PostHog.
- If you follow the link, the destination receives the information ordinarily sent by your browser when opening a website, together with the campaign parameters included in the link.
- Your recordings, uploaded files and form responses are not transferred to the destination as part of that link.
7. Legal Bases (GDPR Visitors)
For EU/UK users, we rely on:
- Contractual necessity: to deliver the Service you signed up for.
- Legitimate interests: to keep the Service secure, understand how it is used, and improve it.
- Consent: where the law requires it, for example for marketing emails. You may withdraw it at any time.
- Legal obligation: to satisfy accounting or regulatory requirements.
8. Data Retention
| Data | Kept until |
|---|---|
| Account data | You delete your account. Deletion removes your forms, responses, pages, messages, stored files and sign-in record, cancels any subscription, and marks your analytics profile as deleted |
| Responses, recordings, uploaded files and AI results | The form owner deletes the response, form or account, or the form’s automatic deletion period passes; legacy voice messages are kept until the creator deletes the message or account |
| Partial submissions | 30 days after your last change, unless you submit the form. Sooner if the form’s automatic deletion period is shorter, or the creator deletes the form or their account |
| Notification emails | Delivered emails, including any attached MP3, sit in the creator’s mailbox under their control. Resend keeps delivery records for a limited period |
| Form progress records | The creator deletes the response it belongs to, the form or their account. They hold no answers and no visitor ID |
| Page-view records | The creator’s page is deleted. They feed the creator’s Insights for as long as the page exists |
| Rate-limit keys | At most ten minutes |
| Server logs | Kept briefly by our hosting provider |
| Analytics events | Retained by PostHog and Rybbit under their retention settings. Profiles are pseudonymous unless you sign in |
| Financial records | 7 years, as required by law |
9. Your Rights & Choices
| Region | Your rights include |
|---|---|
| Australia | Access, correction, and complaint lodging under the Privacy Act 1988 |
| EU/UK (GDPR) | Access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority |
You can delete your account, and everything in it, at any time from your account settings. If you submitted a form or sent a voice message without an account, you can still ask us to delete it or send you a copy. Tell us the form link and roughly when you responded. For anything else, email hello@whatayarn.com and we will respond promptly.
10. Children’s Privacy
The Service is not directed to children under 13. If you believe a child has provided personal data, please contact us so we can delete it.
11. Cookies & Local Storage
We do not use advertising cookies or ad networks. We use:
- Sign-in cookies from Supabase, so you stay signed in.
- Preference cookies that remember which form or page you were editing, whether the sidebar is open and which sign-in method you used last.
- Analytics identifiers set by PostHog in cookies and local storage.
- A first-party visitor ID in local storage on public forms and creator pages, so repeat visits count once in the creator’s Insights.
- Form access. If a form allows one response per browser, your browser stores a random ID specific to that form. When you submit, we also record that ID with the form ID on our server to prevent a second response. We keep this record separate from your answers and account. If you enter a form password, your tab can remember that you unlocked it for up to 24 hours.
- A referral marker in local storage if you arrived through a link on a creator’s page, so we can credit that creator if you later sign up.
- Saved form progress in your browser for up to 24 hours, when the form owner allows it, so you can return and finish later on the same device. This is separate from partial submissions saved on our servers.
- Remembered sender details in local storage after you send a message, so you do not have to retype your name and email.
- Dismissed prompts in local or session storage, so we do not show you the same banner twice.
Most browsers let you refuse or delete cookies and site data, although disabling them may limit functionality, such as staying signed in.
12. Security
We use encryption in transit, role-based access controls and regular security reviews. Response recordings and uploaded files are held in private storage and served only through whatayarn, either to the creator’s signed-in inbox or through unguessable listening links the creator chooses to create. Session replays mask typed content except the template search phrases described above, and mask every message and sender detail. A respondent’s raw IP address is never stored with a response or message. No system is 100% secure, so we encourage using a strong, unique password with your sign-in provider.
13. Changes to This Policy
We may update this Privacy Policy periodically. If we make material changes, we will notify you, for example by email or a notice in the app, and post the update here with a new “Last updated” date. Continued use of the Service after changes means you accept the revised policy.
14. Contact
Questions or concerns? Email hello@whatayarn.com.