— Document

Privacy policy

Last updated: 2026-10-27

Controller under the GDPR: Balane GmbH · Balanstraße 84 · 81541 Munich · Germany Commercial register: HRB 301320, Amtsgericht München · VAT ID: DE455102718 Represented by the managing director Jonas David Höttler support@balane.tech

Balane Forms is the forms app of Balane Office for macOS, iOS, iPadOS, Android and Windows. Your content is created and stored on your device. There is no account, no sign-in and no provider server the app talks to. Connections to the outside only happen when you switch them on yourself: for the optional AI features.

1. What the app stores — and where

Forms are stored as .bform files on your device, together with the responses collected, their attachments (photos, files, signatures) and drafts. Exports (CSV, XLSX, PDF, Balane dataset) and form files you pass on are written to the place you choose. Settings, your own templates and the device name you enter are kept in the app's own folder.

This content is not transmitted to the provider.

If you put a file in a folder that iCloud Drive, OneDrive, Google Drive or another service syncs, that service carries it under its own terms. The same applies to operating system backups if you have turned them on.

You are responsible for the responses you collect from other people with a form, not the provider of this app.

2. Camera and photos

For photo attachments, the app asks for access to the camera or the photo library on iPhone, iPad and Android. It only uses that access when you take or pick a photo, and stores the image in the form file. On the desktop you pick images through the system's file dialog. Images are not transmitted.

3. Filling in forms in a browser and survey links

People without the app can fill in a form in a browser. There is no server that receives or stores responses.

  • HTML file: The form is entirely contained in one file that also works offline. The browser downloads the response as a file; the person filling it in returns it to you by a route of their choice, and you import it into the app.
  • Survey link: The link leads to a fixed page at forms.balane.online. The form itself is in the part of the address after the “#”, which the browser does not send to the server. When the link is opened, the respondent's browser loads the page from the hosting provider (currently Vercel Inc., USA); this involves the technically necessary connection data (IP address, time, browser identifier). The response is encrypted in the browser and downloaded as a file. Only the device that created the link can open it; its private key is kept in the operating system's secure storage. If you export the key for a second device, the file is encrypted with a password you set.
  • By default a survey is anonymous: no name is asked for, and times are rounded to the full hour. If you enter a reply address, the page offers to send the response by email; that goes through the respondent's own email app.

4. AI features (optional)

The AI features are switched off until you add your own API key in the settings. Before the first request, the app asks for your consent; “Use AI” can be switched off again at any time.

  • Requests go directly from your device to Anthropic (Anthropic PBC, USA), not through any provider server. Only your instruction and the excerpts the app puts together for the request (such as the selection or visible areas) are sent, plus a style guide if you have set one up. The app shows exactly what was sent under “Sent Context”. Nothing is sent without a request.
  • If you enter your own endpoint instead of Anthropic, such as a gateway in your company or a local model server, requests go there. Its operator is responsible for the processing there.
  • The key is kept in the operating system's secure storage (the keychain on macOS and iOS, Android Keystore, protected by DPAPI on Windows), never in your files or in the app's settings files. When you add it, the app checks it with a free request to the service.
  • Processing at Anthropic is governed by Anthropic's terms and privacy notices; billing runs through your account there. The provider of this app receives neither the key nor the content.
  • The app only applies AI suggestions once you accept them.

For “Analyze responses”, this can include the collected responses, which means information from the people who filled in the form.

5. App lock and biometrics

If you like, an app lock protects the app with a code. Only a hash of it (PBKDF2 with a random salt) is stored, in the operating system's secure storage. Face ID, Touch ID, Windows Hello or a fingerprint are checked by the system; the app never sees biometric data, the system only reports whether unlocking succeeded. With “Hide previews” the app shows no content in notifications and preview images.

6. Distribution, updates and store data

The app is distributed through the App Store (Apple), Google Play (Google) and the Microsoft Store (Microsoft). Downloads, installation and updates run through the respective store; the app does not check for updates itself. The store operators process data as independent controllers under their own terms, including crash reports if you have allowed sharing them in your system settings. In the store consoles the provider sees aggregated statistics (such as download counts) and the crash reports you share with developers; these don't tell the provider who you are.

7. No analytics, no telemetry

The app contains no analytics, tracking or crash-reporting libraries. It sends no usage data to the provider, aggregated or otherwise, and there is no account.

8. Your rights

Because the provider receives no personal data through the app, requests for access, rectification or erasure directed at the provider will generally have no subject matter. For email or form support requests, the general privacy policy of this website applies: https://www.balane.app/en/privacy

You remove your local data by deleting your files and uninstalling the app. Entries in the operating system's secure storage (such as an AI key or the app lock code) are best removed in the app's settings first; depending on the system, they may otherwise remain in the keychain after uninstalling.

Back to Balane Forms