Privacy policy

Last updated: 2 November 2026

Who we are. Bellform is operated by Yinon Oved, a sole trader in Israel ("Bellform", "we"). Postal address: Holon, Israel. Support email: support@bellform.app. The public site is bellform.app.

This policy describes what the Bellform Google Forms add-on and the Bellform website do with information. It is written for teachers, tutors, and course creators (our customers) and for the students who take a timed quiz.

What Bellform does

A teacher installs the Bellform add-on on a Google Form and sets a time limit per question and, if they want, for the whole quiz. Students open a Bellform link, answer one question at a time, and Bellform submits those answers to the teacher's Google Form. Students do not sign in with Google.

Google user data we access

The add-on requests these OAuth scopes, and only these:

• https://www.googleapis.com/auth/forms.currentonly — the form the add-on is installed in: title, description, question text, help text, choices, question type, whether a question is required, the published response URL, whether the form accepts responses, whether it requires a Google sign-in, whether it collects email, and whether questions are shuffled.
• https://www.googleapis.com/auth/script.container.ui — permission to show the setup sidebar inside Google Forms.
• https://www.googleapis.com/auth/script.external_request — permission for the add-on to send that snapshot to our server.
• https://www.googleapis.com/auth/userinfo.email — the teacher's Google account email address, used as the account id for the free plan and the paid subscription.

We do not request access to Google Drive, Gmail, Google Sheets, or to forms the teacher has not opened in the add-on. We do not read existing form responses through Google APIs. The Google Forms API cannot create responses; we do not use it.

The only Google user data sent to our server is the snapshot above, the timer settings the teacher chooses, and the teacher's email address.

Limited Use

We apply the Google API Services User Data Policy, including the Limited Use requirements, to Google user data we receive:

• We use Google user data only to provide and improve the timer feature the teacher can see: reading the open form, showing it in the sidebar, hosting the timed quiz, and filing answers back into that form.
• We do not sell Google user data. We do not use it for advertising, retargeting, or credit decisions. We do not transfer it to data brokers or ad platforms.
• We do not allow humans to read Google user data unless the teacher asks us to help with a support request, we need to investigate abuse or a security incident, the law requires it, or the data is aggregated and no longer identifies a person.
• We do not use Google user data to train generalized machine-learning models.
• Employees and contractors are bound by this policy.

A school administrator can revoke Bellform's access from the Google account security page, or by uninstalling the add-on. Revoking access stops new reads of the form. It does not delete a quiz already published to Bellform until the teacher unpublishes it or asks us to delete the account.

Student data

Students do not grant OAuth. On the quiz page we ask for:

• A display name (required).
• An email address, if the teacher turned on one attempt per email. Otherwise email is optional.
• The answers they type or select.
• The time the attempt started and the time each question opened, so a reload cannot reset the clock.

If the teacher's form is set to collect email addresses as responder input, we also send the email to Google with the response. We do not send the display name into an answer, because that would change quiz scoring. The name is stored in the Bellform response log. To have the name inside Google Forms, the teacher adds a question for it.

If filing to Google fails (for example a required question was left blank, or the form demands a Google sign-in), we keep a backup so the teacher can recover the answers.

We do not ask students to create a Bellform account.

What we do not do

• We do not sell personal information.
• We do not show ads.
• We do not use cookies for tracking. The quiz sets one first-party cookie, HttpOnly, so a refresh resumes the same attempt. It is not used for advertising.
• We do not store card numbers. Payments are taken by Paddle, the merchant of record.

Where data is stored, and who else handles it

Quiz configuration, attempt timestamps, answers, backups, the teacher's email, and subscription status are stored on Cloudflare (Workers and Workers KV). Cloudflare replicates this storage on its global network. We do not offer a single-country storage region in this version.

Subprocessors:

• Google — hosts the form, receives the submitted response, and is the identity provider for the teacher. Google's handling of form responses is governed by the teacher's own Google terms and, where applicable, their school's agreement with Google.
• Cloudflare, Inc. — hosts the website, the quiz, and the stored data.
• Paddle.com Market Ltd and its affiliates — merchant of record for paid plans. Paddle processes payment details, tax, and invoices. We receive the teacher's email, subscription status, and Paddle customer and subscription ids. We do not receive the full card number.

We do not authorize these providers to use the data for their own marketing.

How long we keep it

• A published quiz, and the teacher's email and subscription status, until the teacher unpublishes the quiz or asks us to delete the account, and then for up to 30 days while backups clear.
• An in-progress attempt until it is submitted or for 48 hours after it starts, whichever comes first. (The server clock does not pause if the student walks away; the attempt simply ends.)
• Submission backups for 90 days, unless the teacher unpublishes sooner, in which case they are deleted with the quiz.
• Paddle keeps payment records under its own legal duties. We keep the subscription id only while we need it to know whether the account is paid.

Unpublishing a quiz in the add-on deletes that quiz, its attempts, and its backups from Bellform. Responses already stored in Google Forms stay there, under the teacher's Google account.

Sharing

We share personal information only with the subprocessors above, with the teacher who published the quiz (they can see names, emails, answers, and whether filing succeeded), if the law or a binding order requires it, or to investigate abuse. A sale of the business would require notice and, where the law requires it, consent.

Security

The site is served over HTTPS. Install tokens are random and stored in the teacher's Apps Script user properties. Session ids are random. The student page receives only the current question, not later ones and not answer keys. No system is perfectly secure. Please write to support@bellform.app if you believe there has been a breach.

Children and schools

Bellform is sold to adults: teachers, tutors, and course creators. It is not directed at children, and it does not ask a child to create a Google account.

A teacher may use it with students, including students under 13 (United States) or under 18. The teacher, and their school where one is involved, is responsible for having the authority to collect a student's name and email and for complying with school rules, the US Children's Online Privacy Protection Act where it applies, the Israeli Privacy Protection Law, and the GDPR where it applies. Collect only the email if you actually need one attempt per student.

If you believe a student used Bellform without a proper basis, email support@bellform.app and we will delete the attempt.

Israel

We are established in Israel. The Privacy Protection Law, 5741-1981, and the regulations under it, apply to our processing. You may contact us at support@bellform.app to access, correct, or delete personal information we hold, or to complain. You may also contact the Privacy Protection Authority (https://www.gov.il/en/departments/the_privacy_protection_authority).

EEA, UK, and Switzerland

Where the GDPR or UK GDPR applies, the seller is the controller of teacher account data and of student data collected on the quiz page. The legal bases we rely on are: contract (providing the timer the teacher asked for), legitimate interests (keeping the clocks honest, preventing reload-to-reset, securing the service), and legal obligation (tax and accounting records held by Paddle). Students and teachers in the EEA or UK can request access, correction, deletion, restriction, or a copy of their data, and can object to processing based on legitimate interests. You can lodge a complaint with your local supervisory authority. We do not make solely automated decisions that produce legal effects.

International transfers outside the EEA or UK may occur because Cloudflare's network is global. Where a transfer tool is required, we use the European Commission's standard contractual clauses or the UK addendum, as applicable. Ask support@bellform.app for a copy of the relevant safeguard.

Changes

If we change this policy, we will update the date at the top and, if the change affects how we use Google user data, we will ask the teacher to consent again before we rely on the new use. The copy at /privacy on bellform.app is the current one.

Contact

Yinon Oved Holon, Israel support@bellform.app