Privacy Policy

Cube Forms · Effective October 18, 2026

Who we are

Cube Forms (“Cube”) is run by EarthOnline, Inc., a Delaware corporation founded and run by Bonan Kou (“we”, “us”). You can reach us at hello@usecube.io. This policy says what we collect, why, who we share it with, and how long we keep it.

The short version

We don’t sell personal data.
We don’t show ads.
We don’t use analytics, ad pixels or third-party tracking scripts.
Answers to a form belong to the person who made the form (the “owner”). We store them for the owner and send them where the owner tells us to.
We don’t store your IP address with your answers. We store a scrambled (hashed) version of it.
Answers stay until the owner deletes them.

What we collect from form owners

Your email address. You sign in with a 6-digit code we email to you, or with Google.
If you use Google: we ask Google for your email address and keep only that. Google may also send your name and profile picture. We don’t store them.
Your forms: their titles, descriptions, questions and settings.
Where you send answers: an email address, a webhook address and its signing secret, or a Slack incoming-webhook address. We also keep whether each one is working, its last error, and when it last sent.
Sign-in records: each sign-in lasts 30 days. Your browser holds the sign-in key. We store only a hash of it, with your account ID and the start and end dates.
Abuse counters: how many sign-in codes were sent to an address today, and how many wrong codes were typed. We file these under a hash of the address.
AI apps you connect: the app’s name and the addresses it registered with us, and a record that you allowed it (your account, the app, the date). We store only hashes of its tokens.

What we collect from people and agents who fill in forms

Your answers, including any files you upload. A form can take PDF, Word, PNG, JPEG, WebP and GIF files, up to 10 MB each.
When you submitted.
How you submitted: on the page, on the page from a prefilled link, over HTTP, over MCP, or through the browser’s agent interface (WebMCP).
Your browser’s or agent’s user-agent string.
A hash of your IP address. It is a salted SHA-256 hash, shortened. It lets us tell repeat senders apart. It is not your address, but it is not fully anonymous either.
Agent signatures. If your agent signs its requests (Web Bot Auth), we keep the signature headers as they arrived. They can name the company that runs the agent.

We use the last four items only to catch abuse. The form owner never sees them. We keep them as long as the answer they came with.

Your plain IP address is held in the server’s memory to limit how often one address can submit (10 a minute), sign in or create forms. It is not written to disk. It is gone when the server restarts.

Receipts. After you submit, you get a receipt link. Anyone with that link can see what you sent. Keep it private. We store only a hash of it.

Prefilled links. An AI assistant can give you a link with your answers after the # sign. Your browser does not send that part to us. We receive your answers only when you press Submit. Links that open a drafted form (#spec=) work the same way.

Files by link. If you (or your agent) give a file as a web link, our server downloads the file from that link.

What we collect from site visitors

We don’t use analytics or tracking. The site loads no scripts or fonts from other companies.

Cookies. We set three, all first-party:

Cookie	What it’s for	How long
`cube_session`	Keeps you signed in. Set only when you sign in.	30 days
`cube_google`	Checks that Google’s reply belongs to your sign-in. Set only during “Continue with Google”.	10 minutes
`tz`	Your time zone, so the app shows times in your zone. Set only in the signed-in app.	1 year

Browser storage. These stay in your browser. We never receive them.

cube.me: your email address, so the account menu shows at once.
theme: light or dark.
cube.form-draft: a form you are building and haven’t published.
cube-package-manager: a preference on our docs pages.

Our early-access list. If you join it, we keep your name, email address, what you would use Cube for, and your website if you give one.

Our hosting provider handles every request and may keep short technical logs, such as IP address and the page requested.

What form owners see

Owners see each answer, when it arrived, and any uploaded files.
Owners can export answers as a CSV file.
Owners don’t see how an answer came in, your user agent, or your IP hash.
Owners can have each answer sent on to an email address, a webhook or a Slack channel. A copy then lives there, under the owner’s control.
A webhook gets links to uploaded files. Those links work while the webhook stays connected.

The owner decides what a form asks and what happens to the answers. For answers to someone else’s form, we act on the owner’s behalf. If you have a question about how an owner uses your answers, ask the person or organization that gave you the form.

AI assistants and apps

You can use Cube through its app in ChatGPT or Claude. The app is Cube’s MCP server at https://ui.usecube.io/mcp.

We receive only what the assistant sends to our tools: the form it opens and the answers it submits. We never receive the rest of your conversation.
An assistant submits answers only after you confirm them.
Forms that ask for passwords, government ID numbers, payment card or bank numbers, or health information can’t be submitted through the app. You get a link to fill those in yourself.
A form’s text is written by its owner, not by us.

What you tell an AI assistant, and what it reads back from Cube, is handled by that AI company under its own terms and privacy policy.

AI agents and MCP

Cube runs two MCP servers.

The public server (/mcp) needs no sign-in. An AI app can read a form, submit answers, check a receipt, make a prefilled link, and draft a new form.

We receive the tool call’s arguments, such as the form ID and the answers.
We receive the HTTP request, with its IP address, user agent and any signature headers. For apps that run in the cloud, these are usually the AI company’s servers, not yours.
We don’t receive your conversation with the assistant. We receive only what the assistant puts into a tool call.
Only a submission is stored, as described above. Reading a form, checking a receipt, making a prefilled link and drafting a form store nothing.

The owner server (/mcp/owner) needs you to sign in and press Allow (OAuth).

The app then acts as you. It can create, change and delete your forms. It can read, export and delete answers and files. It can turn forwarding on and off.
Its access token lasts 1 hour. Its refresh token lasts 30 days.
To disconnect, sign out from the app (its sign_out tool) or remove Cube in the app. A removed app’s tokens run out within 30 days. The record that you allowed the app stays until you sign out from the app.

Embedded forms

An owner can put a form on their own website, in a frame (/embed/<id>), using our embed.js script.

The embedded form sets no cookies. It doesn’t read your Cube sign-in.
embed.js doesn’t track you. It sizes the frame, opens the pop-up, and tells the form whether the host page is light or dark. It reads the host page’s background color in your browser to do that.
embed.js may start loading a form when your pointer moves over a pop-up button, so it opens faster.
Like any web request, your browser may tell us which page the form is embedded on. We don’t store it.
The host website has its own privacy policy for what it does.

We use these service providers to run Cube:

Provider	What it does	What it sees
Railway	Hosts the app and stores all data on a disk volume	Everything we store
Resend	Sends our email	Sign-in codes, confirmation links, and answer emails (which contain the answers)
Cloudflare	DNS for usecube.io; routes mail sent to our address	Domain lookups; mail sent to us
Google	“Continue with Google” sign-in, only if you choose it	Your sign-in

At the owner’s direction, answers also go to the owner’s email inbox, webhook server or Slack workspace.

We may also share data if the law requires it, to protect people or the service, or as part of a merger or sale of the company. If that happens, this policy still applies to data collected under it.

Where data is stored

Data is stored in the United States. If you are outside the United States, your data is transferred there.

How long we keep data

Data	How long
Answers and uploaded files	Until the owner deletes the answer or the form. They don’t expire on their own.
IP hash, user agent, agent signature	As long as the answer they came with.
Forms and their forwarding settings	Until the owner deletes the form
Accounts	Until the account is deleted
Sign-in codes	Until used, or 10 minutes
OAuth codes and tokens	5 minutes (codes), 1 hour (access), 30 days (refresh). Deleted after they run out.
Records of AI apps you allowed	Until you sign out from the app. If you only remove the app on its side, the record stays.
Answers to the demo forms on our site	Kept; only your receipt link can show them.
Early-access list	Until you ask us to remove you
Copies sent to email, webhooks or Slack	Controlled by the owner, not us
Backups	Our hosting provider may keep backups of the disk. Deleted data can remain in them for a short time.

Deleting data

Owners can delete one answer, or a whole form with all its answers, at any time. They can do it on the site or through a connected AI app.
Deleting an answer removes it, its files (unless another answer holds the same file), and its receipt. It is immediate and permanent.
Deleting does not remove copies already sent to email, a webhook or Slack.
If you filled in a form and want your answer removed, ask the form’s owner. If you can’t reach them, email us and we will help.
To delete your account, email hello@usecube.io from the address on the account. We delete the account, its forms, answers and files within 30 days.
Depending on where you live, you may have the right to see, correct, delete or get a copy of your data. Email us. We answer within 30 days.

Security

All traffic uses HTTPS.
We store sign-in codes, sign-in keys, OAuth tokens, receipt links and email-confirmation links only as hashes.
Uploaded files are never public. Only the signed-in owner, the owner’s webhook (with a signed link), or the owner’s AI app (with a link that lasts 15 minutes) can open them.
We check a file’s real type from its contents, not its name.
When our server downloads a file link or sends a webhook, it connects only to public internet addresses.
Each webhook delivery is signed, so the owner can check it came from us.
A form can be opened by anyone who has its link. Form IDs are random and forms are not listed. Don’t put secrets in a form’s questions.
Our team can access stored data. We do so only to run the service, fix problems, stop abuse, or when the law requires it. Our admin page shows totals, the titles of new forms, and the domain of each owner’s email address. It doesn’t show answers to your forms.
No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

Children

Cube is not for children under 13. We don’t knowingly collect their data. Owners must not use Cube to collect data from children under 13. If you think a child gave us data, email us and we will delete it.

Changes

We will post changes on this page and update the date at the top. If a change is significant, we will email account owners before it takes effect.

Contact

EarthOnline, Inc.
hello@usecube.io

See also our Terms of Service and Support page.