Last updated November 9, 2026
Privacy
This page says what Submits.dev stores, who else sees it and how long we keep it. It covers two groups of people: form owners, who sign up and get the submissions, and visitors, who fill in an owner's form.
What we store about form owners
- Your email address. It's your login and where we send notifications.
- Each form's settings: its name, second email, Google Sheet link, spam rule and redirect URL.
- When you last logged in.
- Hourly counts of your submissions and emails, which enforce your daily quotas.
- A record of each verification and approval email we send, which limits how often we send them.
What we store about visitors
For each submission:
- The form's fields, plus a subject and Reply-To address if the form sends them.
- The visitor's IP address, their browser's user agent and the page the form was on.
- The spam score and the score for each spam question.
We also count, hour by hour, how many submissions each IP address sends to each account, so one visitor can't use up an owner's whole daily quota.
If the form's owner turned on an auto-reply, we email the address you entered once, with a message the owner wrote. We keep a scrambled fingerprint of that address for 2 days, not the address itself, so the same address doesn't get the reply twice in a day.
The site owner decides what their form asks for, and we hold submissions on their behalf. To have a submission deleted, ask the site's owner. They can delete it from their dashboard at any time.
Who else sees it
- TypeSafe runs Jev, the model that scores spam. For each submission we send it the fields, subject, Reply-To address, the page the form was on and the form's name. We never send the IP address or user agent. Submissions to an account that hasn't verified its address aren't sent at all, and when the local check scores a submission instead, nothing leaves our server.
- Resend delivers our email. A notification email contains every field of the submission.
- Google gets a submission only if the owner connects a Google Sheet. We write each submission's time, fields, spam score and status to that sheet, which belongs to the owner.
- Cloudflare stores our database backups.
We don't sell data, show ads or use analytics or tracking scripts.
Cookies
Our pages set one cookie, _submits_session. It keeps you logged in and protects our forms
against requests from other sites. It expires 14 days after your last visit. We set no other cookies.
How long we keep it
| What | How long |
|---|---|
| Submissions | 90 days, or less once an account stores more than 10,000, when the oldest go first. Owners can delete them sooner. |
| A form and its submissions | Until the owner deletes the form. Deleting it removes every submission it holds at once. |
| An account | Until the owner deletes it. That removes the account, its forms and their submissions at once. |
| Accounts that never verify their address | 7 days from signup, with their forms and submissions. |
| Hourly submission and email counts, per account and per visitor IP address | 2 days. |
| Records of verification and approval emails | 2 days. |
| Addresses that asked us to stop emailing them | Until the address's owner turns email back on, so we can keep our promise not to email them. |
Our server logs record each request's path, IP address and browser, never what was in a form. Each log is capped at 10 MB and overwritten as it fills, so old lines disappear on their own. Rows already in an owner's Google Sheet and emails already delivered stay there when we delete a submission.
We back up the database to Cloudflare R2 as it changes, so a broken server doesn't lose your data. Anything you delete is gone from the backups within two days.
Deleting your data
Form owners can delete any submission or any form from the dashboard, and their whole account from the Account page linked in the footer. Deleting an account takes effect at once.
If you filled in someone's form, ask the site's owner first, since they control the submission. If you can't reach them, write to us.
Contact
Questions or requests about your data go to privacy@submits.dev.