Prioritized findings
Three changes to make before adding traffic.
High priority · Contradicted
“We never store your data” conflicts with the privacy policy and dashboard promise.
Homepage evidence: The Privacy-First Architecture card says, “We never store your data. It is routed directly to your email, webhook, or preferred database.” Elsewhere, the homepage promises that submissions land in a dashboard where users can view, search, and export them.
Policy evidence: The public privacy page says FormTake will “ingest and store” submission payloads and request metadata, and retain submissions while the account is active or until deletion.
Change: Replace the no-storage claim with a precise retention statement that matches the implemented product and policy. If direct routing without storage is a separate mode, label it as such and explain the default.
Acceptance check: The homepage, dashboard copy, and privacy policy give the same answer to “Does FormTake store form submissions, what metadata is stored, and for how long?”
Medium priority · Unknown
“Free” is visible, but the operating limits are not.
Observed: The navigation says “Get Started Free,” while the homepage does not state submission limits, endpoint limits, retention limits, paid-plan timing, or whether a card is required.
Decision at risk: A developer cannot compare the service with a small self-hosted endpoint or another form backend before creating an account.
Bounded check: Publish a compact “Free includes…” line beside the primary CTA. If pricing is still being validated, state the current limits and that future paid plans will not retroactively remove exported data.
Medium priority · Observed
The hero explains setup, but not the strongest reason to trust the handoff.
Observed: Security and spam controls appear later on the page. The first screen makes speed claims (“in seconds,” “instantly”) but gives no nearby trust line about allowed domains, spam protection, export, or deletion.
Change: Add one compact, verifiable line under the CTAs: “Domain restrictions · honeypot protection · CSV/JSON export · delete anytime.” Avoid adding broad security claims that cannot be independently checked.
Acceptance check: A developer can answer both “How fast is setup?” and “What protects and releases my data?” without scrolling.