Privacy Policy

Effective date: April 30, 2026 · Last updated: October 7, 2026

This Privacy Policy explains what information FormGuard collects, how we use it, and the choices you have. FormGuard (the "Service") is operated by Simcha Fuchs ("we," "us," "our"), an individual operating a sole proprietorship doing business as FormGuard.

1. Information we collect

Information you provide

When you use the Service, you voluntarily provide:

• Your email address (required for delivery and account access)
• The USCIS form you upload (image or PDF) — analyzed in memory and not written to our servers or database, with one exception you have to ask for (see “Data retention”) — and the resulting analysis report, which we store so you can retrieve it for up to 24 hours after purchase. Before the report is saved, A-Numbers, Social Security numbers and any other run of seven or more digits (such as receipt or phone numbers) are masked automatically, and the analysis is instructed to point to the place on the form rather than repeat what you entered. Names, dates of birth and addresses are not automatically removed, so a saved report can still contain one if the analysis repeated it.

You choose what to enter. You may use generic or fictional values in any field except your email, which is required to deliver and grant access to your purchase.

Firm accounts

If your organization uses a firm plan, a free firm trial or our firm enquiry form, we store the organization name, the contact email address, the plan, the Stripe customer and subscription references, and what you write in the enquiry or trial form. If you give team members their own access tokens, we store the name or role you enter for each one. Access tokens are stored only in hashed form. For each firm check we record the form type, the time, the check reference and which token ran it, so the account's allowance can be counted.

Payment information

When you purchase, payment details (card number, billing address) are collected and processed directly by Stripe. We never see or store your full card number. We receive only: your name, email, country, and the amount paid.

Server logs

Our hosting provider (Netlify) automatically logs basic request information (IP address, user agent, timestamp, requested URL) for security and abuse prevention. These logs are retained by Netlify per their privacy policy.

Abuse-prevention logs (ours)

To limit repeated automated attempts, we keep two short logs in our own database. The first records the IP address and time of each request to our email sign-up, the firm trial, firm sign-in, firm billing and firm enquiry forms, and the package consistency check. The second records, for each attempt to retrieve a report, the email address entered, whether the attempt succeeded, and the time. They are used only to count attempts within a one-hour window, and an automated job deletes every entry older than 24 hours.

Usage analytics (PostHog)

We use PostHog as our first-party product-analytics tool to understand how people use the Service — for example, which steps of the upload-and-checkout flow people reach — so we can fix problems and improve the product. PostHog captures usage events (such as page views and button clicks) along with technical information like your browser, device type, and approximate location derived from your IP address. It also records uncaught JavaScript errors — the error message and a stack trace naming the file and line that raised it — so that a fault nobody thought to instrument still reaches us; these carry no content from your form. When you enter your email at checkout, we associate your subsequent usage events with that email so we can understand the funnel. We do not use this data for third-party advertising, and we do not use session replay or screen recording on the Service. When you pay, our server also tells PostHog that the purchase happened: the amount, the currency, the form, Stripe's payment identifier and the last 10 characters of your checkout reference, which is how we find your order when you contact support. PostHog never receives the full checkout reference, because that reference unlocks your report. For firm accounts, usage events are associated with the account's contact email. You can ask us to delete your analytics data at any time (see “Your rights”).

2. Tracking we do not use

Aside from the first-party PostHog product analytics described above, the Service does not use any of the following:

• Third-party web analytics such as Google Analytics
• Cross-site tracking pixels
• Social media tracking (Facebook Pixel, LinkedIn Insight, etc.)
• Session replay, screen recording, or heatmap tools (Hotjar, FullStory, Clarity, etc.)
• Advertising networks or retargeting

Stripe may set its own cookies on its hosted checkout pages; that processing is governed by Stripe's Privacy Policy linked above.

3. How we use your information

• To generate your USCIS form check reports. Your inputs are passed to Anthropic's Claude API to produce the output.
• To deliver your USCIS form check reports. We render the output to you in the browser and may email you a confirmation receipt.
• To process payment. We pass payment instructions to Stripe; Stripe handles the transaction.
• To prevent abuse. We may review server logs to detect fraud, spam, or technical issues, and we use the abuse-prevention logs described above to limit repeated attempts.
• To catch paid checks that did not finish. Every 15 minutes an automated job looks for paid checks that still have no report 10 minutes after they started, and emails us the order reference, the form type and the time so we can finish the report or refund you. That email never includes your email address or anything from your form.
• To understand and improve the Service. We use first-party PostHog product analytics to see how the Service is used and where people run into trouble, so we can improve the funnel and fix issues.
• To respond to your support requests. If you email us, we use that information to help you.
• To deliver your report manually if automated analysis fails. If you email us your form so we can run it manually, we use that copy only to produce and deliver your report; we delete our working copies afterward and do not add it to any database.

4. Third-party processors

The Service relies on the processors below. Your data is shared with them only as necessary to provide the Service:

• Anthropic (privacy policy) — receives your inputs via the Claude API to generate the output. Per Anthropic's commercial terms, inputs submitted via the API are not used to train their models.
• Stripe (privacy policy) — processes payments. Stripe is a PCI-DSS Level 1 certified payment processor.
• Netlify (privacy policy) — hosts the website and runs the server functions that handle your requests. It does not store your form or your report.
• Supabase (privacy policy) — hosts our database in the United States. It holds saved reports, email addresses, checkout references, firm account records, the abuse-prevention logs and, only if you ask us to keep it after a failed paid check, your form for up to 4 days.
• Resend (privacy policy) — delivers the emails we send: firm access tokens and monthly usage reports, replies to firm enquiries, FormGuard tips to addresses that signed up for them, and internal alerts to us. It receives the recipient's address and the message.
• PostHog (privacy policy) — provides first-party product analytics; receives usage events associated with your email so we can measure and improve the Service.

Some pages load their fonts from Google Fonts, so your browser requests them from Google, which receives your IP address and browser details as part of that request.

We do not sell your personal information to third parties, and we do not share it with advertisers for their own marketing or for cross-context behavioral advertising. We may use your email address to contact you about the Service and, where you have provided it to us, to send occasional relevant FormGuard tips or offers (which may include affiliate links; see “Affiliate links and partner offers”) — you can opt out of these at any time via the unsubscribe link or by emailing us. If our business is acquired, your information may transfer to the new owner; see “Business transfers” below.

5. Data retention

• Your uploaded form image: never stored on our servers. Before payment it is held only in your own browser (session storage) and is discarded when you close the tab; during analysis it is processed in memory and is not written to disk or any database. For long scanned documents, the pages are transferred to Anthropic (our AI provider, which receives your form content during every analysis — see “Third parties”) solely for the duration of the analysis and are deleted from Anthropic's file storage as soon as the analysis finishes, whether it succeeds or fails. There is one exception, and you have to ask for it: if an analysis you paid for fails, the error screen offers an unticked box asking us to keep your form for 4 days so that we can finish the report by hand. Nothing is kept unless you tick it, and it is never ticked for you. If you do tick it, your form is written to our database, is not publicly readable, and is deleted automatically when the 4 days expire — or as soon as your report has been delivered, whichever comes first. Unticking the box deletes it immediately. This option is not offered on firm-plan checks.
• Supporting documents you check in the free panel: read entirely inside your own browser and never uploaded, with one exception you have to ask for. The photo checks that measure head size and eye height need to find your face in the picture, which your browser cannot do on its own; if you press “Measure head and eye position”, a reduced-size copy of that photograph (and nothing else) is sent to be measured. It is held in memory for the few seconds that takes, is never written to disk or to any database, and what comes back is three positions — nothing about you, and no copy of the picture. Do not press it if you would rather the photograph never leave your device; every other check in that panel runs without it.
• Forms you compare in the free package consistency check: your PDF files are not uploaded. Your browser reads the answers typed into each fillable form’s fields and sends only those answers to FormGuard, where they are compared in memory and discarded. For a form that has no fillable fields (printed or flattened to PDF), your browser sends the form’s text instead, and that text is sent to Anthropic (our AI provider — see “Third parties”) only to find the names, dates and numbers to compare. Nothing is written to disk or to any database or logged, and answers from fillable fields are not sent to any AI provider or other third party; what comes back is which kind of fact differs on which form — never the answers themselves. If you are signed in with a firm account, the differing answers are also sent back to your own browser so you can see what each form says; they are still not stored, and we record only that your account ran one package check.
• Your report and email: you can retrieve your report for up to 24 hours after purchase (using the email you paid with and your card's last 4 digits). We retain your analysis results (stored with the identifiers described in “Information we collect” masked) and email address to operate and improve the Service and for our legitimate business interests; they are not automatically deleted. You can request deletion at any time (see “Your rights”).
• Payment records: retained by Stripe per their retention policy, which we cannot override.
• Server logs: retained by Netlify per their retention policy (typically 30 to 90 days).
• Abuse-prevention logs: deleted automatically once they are more than 24 hours old.
• Firm account records: kept while the account exists and not automatically deleted afterwards; you can request deletion at any time (see “Your rights”).

6. Your rights

All users

You can request at any time, by emailing support@uscisformcheck.com:

• A copy of the data we hold about you (access)
• Correction of any inaccurate data
• Deletion of your data (subject to any records we are legally required to keep)
• Opt-out from any marketing emails

We respond to all requests within 30 days.

California residents (CCPA / CPRA)

If you are a California resident, you have the rights listed above plus the right to know what categories of personal information we collect, sell, or share. We do not sell or share personal information for cross-context behavioral advertising. California residents can contact us at the email above to exercise these rights.

European Union / UK residents (GDPR / UK GDPR)

If you are in the EU or UK, you have the rights listed above plus:

• The right to data portability (receive your data in machine-readable form)
• The right to object to processing based on legitimate interest
• The right to lodge a complaint with your local data protection authority

Our legal basis for processing is (a) performance of a contract (delivering your purchase), and (b) legitimate interest (fraud prevention, which you may opt out of by not using the Service).

7. Security

Data in transit is protected by HTTPS/TLS. Our database is hosted by Supabase, which encrypts it at rest (AES-256), and only our server functions can read it: database access from browsers is blocked. Payment details are held by Stripe, which encrypts them at rest. Netlify does not store your form or your report. Despite reasonable precautions, no internet transmission or storage is 100% secure; we cannot guarantee absolute security.

8. Children

The Service is intended for adults. It is not directed to people under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided data, contact us and we will delete it.

9. International data transfers

Our processors are located in the United States and European Union. If you use the Service from outside these regions, your data will be transferred to and processed in those jurisdictions. By using the Service, you consent to this transfer.

10. Business transfers

FormGuard and the data it holds are business assets. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or a sale of all or part of our assets, the information described in this policy (including your email address and analysis records) may be transferred to the successor or acquiring entity as part of that transaction. We will require the recipient to honor this Privacy Policy or to give you notice of any material change. A transfer of this kind, as part of an acquisition of the business, is not a “sale” of your personal information.

11. Affiliate links and partner offers

FormGuard may earn money through affiliate partnerships. Some links in our emails or on the Service — for example, a service we think is relevant to your filing — may be affiliate links, which means we may earn a commission if you sign up or buy through them. This is always at no extra cost to you and never changes the price you pay the partner. We only include offers we believe are genuinely useful to people preparing USCIS filings; an affiliate relationship does not change our recommendations, and an affiliate link is not an endorsement or legal advice (FormGuard is not a law firm).

When you follow an affiliate link you leave the Service, and any information you provide on the partner’s site is governed by that partner’s privacy policy, not ours. We do not sell or hand your personal information to these partners. An affiliate network may report back to us that a referral resulted in a sign-up or purchase using an anonymous tracking identifier (not your name or email), so we can measure which recommendations are useful.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the Service after an update constitutes acceptance.

13. Contact

For any privacy question, concern, or request:

Email: support@uscisformcheck.com
Typical response: within one business day (Monday–Friday).