&gt; this way, not even we can view the form submissions<p>That&#x27;s not true. PF cannot view the submission &#x2F;after it has been submitted, assuming your javascript does what you say it does&#x2F;. Which means it protects people from someone knocking on your door asking for old data, but not from the FBI knocking on your door and asking to tap future submissions.<p>This is probably a reasonable tradeoff, but you have to be honest in this in your communication. &quot;That is because your user&#x27;s submissions are encrypted using your key (which we don&#x27;t have) before being sent to our servers.&quot; is true, but it suggests this would always be the case -- also in the future -- and you simply cannot guarantee that.