Privacy policy
This policy says what happens to personal data when you use Liveform, and when you use the website at www.liveform.ai.
Who we are
The provider is Craftform. Contact: hey@craftform.studio.
What stays on your machine
The Liveform plugin runs inside Claude Code or Cursor on your own computer. Before anything is sent, a privacy screen on your machine removes secrets it can detect, such as API keys and tokens, and personal identifiers such as email addresses, phone numbers, card numbers, IBANs and Irish PPS numbers, replacing each with a label. It never sends the contents of secret files such as .env files and key files. If the screen fails, nothing is sent. It cannot promise to catch every secret or every piece of personal data.
On your machine, Liveform keeps your sign-in in a file only you can read, a copy of your rules for when you are offline, and a local log of counts and timings with no prompt text, file paths or code.
What leaves your machine
What leaves your machine is your prompts to your coding agent, and the changes the agent makes, both after screening. Liveform does not read your past agent chats, does not capture your own hand edits, and never writes to your code. Liveform only runs in agents on your computer, not in cloud agents.
What we store
We store the following in Supabase in Ireland (EU):
- Your account: email, name, and an optional line about what you build.
- Your sign-up answers: where your product is used and what to check.
- Your projects: each named after its folder, and identified by a one-way fingerprint of its git address or folder path, never the address or path itself.
- What Liveform learns: your taste rules, and project rules with the screened prompt or change each came from.
- Liveform’s messages to you, shown under the bell.
- Your consent choice.
We never store your code.
Who processes it for us
- Anthropic (Claude) judges your screened prompts and changes. See Anthropic’s commercial terms and data processing addendum.
- Vercel hosts the app and engine, running in Dublin.
- Supabase stores the data in Ireland and sends sign-in emails.
- Resend sends email from Liveform to your address.
- PostHog records events about how the app is used, on its servers in the EU.
Anthropic, Vercel and Resend may process data outside the EU, under their own data processing terms.
Improving Liveform
Only if you opt in, which is off by default, Liveform may review the rules it learns to improve its checks for everyone. You can change this at any time in Settings.
Deleting
Deleting a project removes everything learned from it, from storage and from future reviews. It does not undo improvements already released. Deleting your account deletes everything you own, including your sign-in.
The website
The homepage has two signup forms. The field at the top asks for your work email only. The form further down asks for your name and work email. When you submit either one, what you entered is added to Craftform’s own sign-up list, a database hosted by Neon in Frankfurt (EU), with a source label of marketing_hero or marketing_index and the address of the page. A short note about the sign-up is emailed to hey@liveform.ai through Resend. Each form also has a hidden field. If that field is filled in, nothing is stored.
If the page cannot reach the list, it offers a link that opens an email to hey@liveform.ai. From the form further down, the message already holds your name and work email. From the field at the top, the message is empty. If JavaScript does not run, each form posts the same details to the same list, and you return to this site.
If you accept, the homepage, the pricing page, this page, and the terms page then load the Google tag, measurement ID G-76TZLMG77V, from www.googletagmanager.com. Before you choose, and if you reject, that script is not fetched. Your choice is stored in this browser as liveform_cookie_consent. Accept tells Google it may use analytics storage, and the page then sends a page view. Cookie settings on the site opens that banner again.
On the homepage, Accept also loads PostHog. The script comes from jsDelivr and sends to https://eu.i.posthog.com. It is set to store its data in local storage, to capture page views and autocapture, and not to record sessions. This page and the terms page do not set a PostHog key, so PostHog does not load there. The pricing page loads the same banner script. If you accept, it loads the Google tag. It does not load PostHog or Vercel Web Analytics.
On the homepage, the Google tag is also set not to send a page view until you accept, and to anonymise IP addresses. The pricing page, this page, and the terms page do not set those two options.
If you accept, the homepage, this page, and the terms page then load Vercel Web Analytics from cdn.vercel-insights.com. If you reject, they do not load it.
The app at app.liveform.ai loads Vercel Web Analytics on every page. It counts page views without cookies or anything stored in your browser, and does not tie them to your account.
The app also loads PostHog from jsDelivr, sending to https://eu.i.posthog.com. It is set to store nothing in your browser, not to record sessions, and never to capture the text on the page or what you type.
If you choose light, dark, or system, the site stores that choice in this browser. It uses the saved choice on a later visit only if you have accepted analytics.
Your rights
You can ask to see, correct, export or delete your data, using hey@craftform.studio. You can complain to the Data Protection Commission.
Why we use it
We use it to provide the service you signed up for, and, only with your consent, to improve Liveform’s checks.