Built with Chinaski

Form Submissions

Every accepted submission is stored in the database per form, with management screens for search, review, export, and deletion. This page covers what’s stored, the rate limits, retention, and how successful submissions are acknowledged.

What’s stored

  • The answers as a JSON document keyed by field name.
  • A receipt token — a random reference generated per submission, shown on success and appended to the thank-you redirect (?ok=1&ref=…). It is deliberately random, not derived from the submission ID, so nobody can enumerate or reverse another submission’s reference.
  • The IP address of the submitter — unless suppressed (see privacy below).
  • Marketing attribution when the visitor arrived via a tagged campaign link: query parameters like utm_source/utm_medium/utm_campaign/utm_term/utm_content plus click IDs are captured from the landing-page URL the browser sent along. Attribution capture honors the same privacy signals as IP storage (browser Do-Not-Track / Global-Privacy-Control requests null it out).

Rate limits (per visitor, per hour)

  • No more than 5 submissions to the same form per IP.
  • No more than 30 submissions total across all forms per IP.

Exceeding either yields a “Too many submissions — please try again later” and a deliberate slow-down (tarpit). The limit checks run before any storage, so floods don’t create records. Both limits operate on a hashed value of the real client IP, so they keep working even when a form is configured not to store IPs.

Success acknowledgment

On a clean submit: an inline success message (the form’s own text), or a redirect to the configured thank-you URL with the ok and ref parameters; the receipt reference is shown so the submitter has a handle for later correspondence. Invalid or missing fields re-render the same form with error labels and preserved answers.

Retention and deletion

  • Retention days defaults to unlimited (0); set it to e.g. 90 to automatically delete submissions older than N days. Purging runs hourly and at server restart.
  • Manual deletion is available in the submission views, including bulk delete — and deleting a submission removes any files that came with it (uploads don’t orphan on disk).
  • Deleting an entire form removes its submissions with it.

Privacy switches per form

  • Store submitter IP address — off means the IP is never written (rate limiting still works; it uses a hash of the address but doesn’t retain it).
  • Privacy-requesting browsers (Do Not Track or Global Privacy Control signals) have their IP and attribution nulled out regardless of the setting.
  • The admin notification email can also omit the IP line.