Frequently asked questions
If something is not covered here, the documentation goes deeper — or just ask us.
Getting started
Do I need an account?
Yes. Creating a form takes a few seconds and gives you the dashboard along with it — submission history, per-form settings, integrations and billing all live there, and none of them can work without an account to attach to.
Is my form endpoint a secret?
No, and it is not meant to be. Your endpoint only ever delivers mail to the address the form was set up for, so publishing it in your HTML gives nobody anything useful. If you want to stop other sites posting to it, turn on domain locking.
How many forms can I create?
As many as you want, on every plan including free. One key per site, per page, or per client — whatever keeps your inbox organised. Plans limit total submissions per month, not the number of forms.
Does it work on a purely static host?
That is exactly what it is for. GitHub Pages, Netlify, Vercel, S3, Cloudflare Pages, a folder on shared hosting — if it can serve an HTML file, your form works.
Spam and abuse
How well does the spam filtering actually work?
The honeypot alone stops the overwhelming majority of automated submissions, because most bots fill in every field they can find. Add a captcha and domain locking and what gets through is close to nothing. Keyword rules and heuristics catch the human-sent bulk outreach that captchas cannot.
Does blocked spam use up my quota?
No. Submissions rejected by the honeypot, a failed captcha, or a domain mismatch are never counted. You pay for messages you actually receive.
What happens to submissions marked as spam?
They are stored and shown in a separate view rather than deleted, so you can check what was caught and undo a rule that turned out to be too aggressive. No notification email is sent for them.
Email and delivery
Who does the notification email come from?
Our sending domain by default, with the submitter's name in the from line and their address in reply-to — so pressing reply writes to them, not to us. On the Business plan you can send from your own domain instead.
Can I send submissions to more than one address?
Yes. Add CC addresses in the form settings, or pass a cc field with the submission for a one-off. Up to five extra recipients per message.
The first email went to spam. Is that normal?
It happens with any new sender. Mark it as safe once and later messages land properly. If notifications matter, add our sending address to your contacts.
Data and privacy
Who owns the submissions?
You do. Export them as CSV or read them through the API whenever you like, and delete any of them — or the whole form — at any time. Deleting a form deletes its submissions permanently.
How long are submissions kept?
Thirty days on the free plan, a year on Pro, and indefinitely on Business. The notification email is yours to keep regardless — retention only affects what stays visible in the dashboard.
Do you read or use the content of submissions?
No. Content is processed to deliver it, to run the spam checks you enabled, and for nothing else. We do not build profiles of the people who fill in your forms and we do not sell anything derived from them.
Limits and billing
What counts as one submission?
A single successful POST that results in a stored submission. Retries that fail validation, blocked spam, and rate-limited requests do not count.
What happens if I go over the monthly limit?
The endpoint returns a clear error to the visitor and we email you. Existing submissions are untouched, and the counter resets at the start of the month. Upgrading restores service straight away.
Can I cancel any time?
Yes, from the billing portal in your dashboard. You keep the paid features until the end of the period you already paid for, then drop back to free.