I'm sending out a profile to contacts with a checksum - they are not logged in when they submit it. Can i create an activity for that contact when the profile form is submitted? So far i've run into permissions problems - i'm probably not using the API correctly.
Yes, you can CiviRules extension to create activity when a profile is submitted. Or you can write a extension to use post hook for 'Profile' Object and then use Activity create api to create Activity(Note: you might need to pass check_permission to FALSE in api params to bypass permission)
Drupal sites could do this via webform_civicrm. The module works with links using checksums.