Handing out the form link is safe — nobody who fills it can see anyone else’s answers. The spreadsheet behind it is a different file with its own sharing, and that is the one quietly filling with names, numbers, and dates of birth.
A response sheet is the separate spreadsheet file a form writes submissions to, with its own owner, its own sharing settings, and its own link — distinct from the form that feeds it.
Table of Contents
Two files, two locks
The mental slip is natural: you built one thing — a form — so it feels like one object with one set of permissions. It is two. The form is the questionnaire people fill; the response sheet is the spreadsheet those answers land in. Each is a file in its own right, each has its own sharing dialog, and changing one does nothing to the other.
This matters because the two files answer different questions. The form’s sharing controls who can submit. The sheet’s sharing controls who can read what has been submitted. You almost always want the first to be broad and the second to be narrow — and because they are set independently, getting that right means setting each one deliberately, not assuming the form’s setting covers the sheet.
One artifact in your head, two files on disk — and only one of them holds the answers.
Sharing the form link exposes nothing
Give the form’s public link to the whole world and no respondent can see another respondent’s answers through it. The form renders questions and accepts a submission; it does not surface the collected data to the people filling it. A shared form link is a submission door, not a window into the results.
So the instinct to be cautious about circulating the form link is misplaced — that link is meant to be broad, and it carries no read access to the responses. The caution belongs one file over.
The response sheet is where the exposure hides
The response sheet has its own link and its own permission setting, and this is the file that accumulates everything sensitive: every name, contact number, email, date of birth, and whatever else the form asks. It grows with each submission, and it does not inherit the form’s “anyone can submit” openness — nor should it.
The common mistake is making the sheet broadly readable for convenience — “anyone with the link can view” — so a tool or a colleague can pull the data without a login. The moment you do, the responses are readable by anyone who comes across that URL: a link forwarded in a chat, left in a browser history, pasted into a ticket. Unlike the form, the sheet is a window, and an open sheet is an open window onto a pile of personal data that only gets larger. Treat the sheet’s URL the way you would treat the data inside it, because that is exactly what it grants.
The form link is safe to hand out precisely because it is not the file that holds the answers.
The safe posture: private sheet, authenticated pull
Keep the response sheet private — shared only with the specific accounts that genuinely need it — and get the data out through a path that proves who is asking, rather than a public link that asks nothing.
- Circulate the form link freely. It is a submission door; breadth is the point.
- Keep the response sheet private. Share it with named accounts, not “anyone with the link.”
- Pull data through an authenticated route. A manual export downloaded by a logged-in owner, or a tool acting with authorized credentials, reads the sheet without ever making it public.
- If you must open it briefly, close it again. When a one-off needs a public read, widen access, take the copy, and revert — never leave it open as the standing state.
The convenience you give up — a tool reading a public URL with no login — is small next to the exposure you remove, and there is almost always an authenticated path that costs one extra step.
What this does and does not protect
Keeping the sheet private controls who can read the collected responses; it does not encrypt them, does not protect against an account that legitimately has access being compromised, and does not govern copies once they leave the sheet — an exported file dropped in a shared folder is exposed regardless of the sheet’s setting. Nor does it change what the form collects: the least-exposure move is also to ask only for the fields you actually need, so a leak, if it happens, spills less. Locking the sheet is the single highest-leverage step because it closes the most common accidental door, but it is one layer — pair it with minimal collection, named-account sharing, and care with exports.
The short version
A form and its response sheet are two separate files with independent permissions. Sharing the form link is safe — respondents cannot see each other’s answers through it, and breadth is the point. The response sheet is a different file with its own link, and it is where names, numbers, and dates of birth pile up; if you set it to “anyone with the link can view” for convenience, anyone who obtains the URL reads everything, independent of the form. Keep the sheet private, share it only with named accounts, and pull data through an authenticated export or tool rather than a public link — opening it briefly and reverting if a one-off demands it. Locking the sheet closes the most common accidental door, but pair it with collecting only the fields you need.
Frequently Asked Questions
Does sharing a form link let people see the responses?
No. The form link only lets people submit; a respondent cannot see anyone else’s answers through it. The collected responses live in a separate file — the response sheet — with its own permissions. You can circulate the form link as widely as you like without exposing any submitted data, because that link carries no read access to the results.
Where do form responses actually get exposed?
In the response sheet, which is a separate file with its own sharing setting. If that sheet is set to “anyone with the link can view,” everyone who obtains its URL can read every response, regardless of how the form is shared. The exposure is almost never the form link people worry about — it is the sheet’s link, set for convenience and then forgotten.
How should I let a tool or colleague read the responses without making the sheet public?
Use an authenticated path. Share the sheet with the specific accounts that need it, have a logged-in owner download a manual export, or let a tool read it with authorized credentials. All of these prove who is asking, so the sheet never has to be public. Reserve “anyone with the link” for a brief, deliberate one-off, and revert it immediately afterward.
Is it safe to leave the response sheet public just while I work?
Only if you treat it as temporary and close it again. A sheet left open “just for now” tends to stay open, and its URL spreads through chats, histories, and tickets while the data inside keeps growing. If a task truly needs a public read, widen access, take your copy, and revert in the same sitting — never let the open state become the standing configuration.
Does keeping the sheet private fully protect the data?
It controls who can read the responses, which closes the most common accidental exposure, but it is one layer, not a guarantee. It does not encrypt the data, does not help if an authorized account is compromised, and does not govern exported copies once they leave the sheet. Pair a private sheet with collecting only the fields you need and handling exports carefully, so a slip spills as little as possible.
Why does asking for fewer fields matter for privacy?
Because you cannot leak what you never collected. Every field the form requests is data that then sits in the response sheet and in every export of it, so the smallest, most sensitive set of questions produces the smallest exposure if something goes wrong. Minimal collection and a locked sheet work together: one shrinks the amount of sensitive data, the other limits who can reach it — and validating at entry keeps what you do collect clean enough to trust.
