Privacy Policy
Your documents stay on your device. Here is exactly what we do — and don't do — with your data.
Last updated: July 1, 2026
Local by default
Your document drafts live in your browser's localStorage — not on our servers.
Never stored
PDFs are rendered in memory and discarded. We keep no copy of your documents.
You're in control
No accounts, no tracking without consent, and you can clear everything anytime.
Introduction
FormBarn is a free legal-document generator: a Motor Vehicle Bill of Sale builder and a Residential Lease Agreement builder. This Privacy Policy explains what information is involved when you use the service, where it lives, and the very limited ways it ever reaches our servers. The short version: there are no accounts, your documents stay in your browser, and we never store the content of your documents.
Information We Collect
1. Document data you enter
Everything you type into a builder — names, addresses, vehicle details, lease terms, and so on — is saved automatically in your browser's localStorage on your own device. It is not sent to us as you type, and we cannot see it.
Your document data is transmitted to our server in exactly one situation: when you click download, so the server can render the PDF you requested. The data is processed entirely in memory, the finished PDF is returned to your browser, and nothing is written to disk or retained. We never store, log, or share the content of your documents.
2. Anonymous visitor identifier
On your first visit we generate a random, anonymous UUID and store it in your browser's localStorage. It contains no personal information and is not linked to your identity. It is used solely for rate limiting and abuse prevention (for example, enforcing the daily PDF download limit), together with your IP address. Clearing your browser data removes it.
3. Contact form
If you write to us through the contact form, the name, email address, subject, and message you provide are delivered to our inbox through Resend, a third-party transactional email provider. Resend processes the message only to relay it to us and keeps it briefly as part of its normal delivery logs. We keep your message only as long as needed to respond to you.
4. Push notifications (optional, opt-in)
If you choose to enable browser push notifications, your browser issues a push subscription endpoint that we store so we can deliver the notifications you opted in to. The endpoint contains no personal information. You can unsubscribe at any time in your browser's notification settings, and we delete subscriptions that become invalid.
5. Automatically collected information
- Analytics data: we use Google Analytics to understand how visitors use the site — pages visited, time spent, browser type, and general location (country/city level). Analytics runs in consent mode and is non-personalized by default.
- IP address: your IP address is used together with the anonymous visitor UUID to enforce fair-use rate limits on PDF generation and to prevent abuse. IPs may appear temporarily in server logs and in memory for the duration of the rate-limit window.
- Standard request metadata: our hosting infrastructure may log request paths, user agents, and timestamps for security and performance purposes.
How We Use Your Information
- To render and return the PDF documents you explicitly request
- To auto-save your drafts on your own device so you can come back later
- To respond to messages you send via the contact form
- To deliver push notifications you have opted in to receive
- To analyze aggregate usage patterns and improve the service
- To prevent abuse and enforce rate limits using your IP address and anonymous UUID
- To comply with legal obligations
We do not sell, rent, or trade your personal information. Ever.
Consent Management
We use Google Consent Mode v2 together with Google's consent management platform. Until you provide consent, analytics runs without advertising cookies and in non-personalized mode, and no advertising cookies are set.
European Economic Area (EEA/UK)
In compliance with the GDPR, you will see a consent dialog on your first visit where you can accept or decline analytics and advertising cookies. Your choice is remembered and can be changed at any time by clearing your browser cookies and revisiting the site.
United States
In compliance with US state privacy laws (including CCPA/CPRA), you will see a privacy notice describing your rights regarding the sale or sharing of personal information, with the ability to opt out.
Third-Party Services
Google Analytics
Google Analytics collects anonymous usage statistics using cookies. These cookies are governed by consent mode and are non-personalized by default. You can also opt out with the Google Analytics Opt-out Browser Add-on.
Google AdSense
When advertising is enabled on the site, Google AdSense may display ads that keep the service free. Google and its partners use cookies to serve and measure ads; personalized advertising cookies are only set after you provide consent where required by law. Manage your preferences at Google Ads Settings.
Email delivery (Resend)
Contact form messages are relayed to us through Resend, which processes them only for delivery and retains them briefly in standard delivery logs.
Push notification delivery
If you opt in to push notifications, delivery is handled via the Web Push protocol through the push service operated by your browser vendor (for example, Google's FCM for Chrome, Apple's APNs for Safari, Mozilla's autopush for Firefox). These services receive only the encrypted notification payload and a routing identifier — never your personal data or document content.
Hosting & content delivery
The website is served through a hosting provider and content delivery network that may log standard web request metadata (IP address, user agent, request path) for security and performance purposes.
We are not responsible for the privacy practices of these third-party services; we encourage you to review their privacy policies.
Data Storage and Security
Your document drafts and anonymous visitor UUID are stored exclusively in your browser's localStorage. We do not have access to them, and they remain on your device until you clear your browser data.
Document data sent for PDF generation is processed entirely in server memory — never written to disk, never logged, and discarded as soon as your PDF is returned.
All data in transit between your browser, our servers, and our service providers is encrypted using HTTPS/TLS. We apply appropriate technical and organizational measures to protect the limited data we handle.
Your Rights
Because we hold almost no data about you, most rights under the GDPR, CCPA/CPRA, and similar laws are satisfied by design:
Access
Your document data is stored locally on your device and is accessible to you at any time.
Deletion / Erasure
Clear your browser's localStorage (or site data for formbarn.com) to delete your drafts and anonymous UUID. Email us to have contact-form correspondence deleted.
Opt-out
Manage analytics and advertising cookies through the consent dialog, browser settings, or the Google opt-out tools linked above.
Data portability
Download your document as a PDF at any time — your data is never locked in.
If you are in the EEA/UK you also have the right to lodge a complaint with your local supervisory authority. California residents: we do not sell personal information as defined by the CCPA/CPRA.
Children's Privacy
FormBarn is not intended for children under 13 years of age, and we do not knowingly collect personal information from children under 13. Bills of sale and lease agreements are, by nature, contracts between adults.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will post the new version on this page and update the "Last updated" date above. Material changes will be highlighted on the site where reasonable.
See also our Cookie Policy and Terms of Service.
Questions about your privacy?
If you have any questions about this Privacy Policy or how your data is handled, contact us at [email protected].