Where your site's form submissions go, and who can read them
When a visitor sends a contact, booking or newsletter form on a published Anticode site, the submission is checked, saved to your project and sealed at rest with AES-256-GCM. You can have each one emailed to you, read and export them in the dashboard, choose how long they're kept, and see every time they were viewed, exported or deleted.
What happens when someone presses Send
- The site checks where it came from. A form post is only accepted from the site's own address, so another page can't submit into your inbox.
- Rate limits apply. Repeated sends from one place in a short time get a polite "please wait" page instead of filling your inbox.
- The fields are validated. Contact forms need a name, a valid email address and a message up to 2,000 characters; newsletter forms need an email; booking forms need a service, a day that's still available, a time and a phone number in a sensible format.
- A booked slot is re-checked. If someone took that time a moment earlier, the visitor is told and asked to pick another.
- It's sealed and saved. The fields are encrypted with AES-256-GCM, bound to your project, so a row copied into another project wouldn't open.
- The visitor sees a result page such as "Message sent" or "Booking request sent", rendered without any scripts.
- Delivery follows within a minute. A scheduled job sends your email alert, if it's on, and passes the submission to any connectors you've set up.
Reading and exporting
Submissions appear in the project's Users panel: the people who book, write and subscribe through your site. You can filter by form and download everything, or one form's worth, with Export CSV. The export has the form, the time it was received and one column per field. Each submission can be deleted on its own. If you've connected an AI assistant through MCP, it can list submissions too, and they come back marked as visitor content so the assistant treats them as data.
Email alerts
In the Emails panel, the switch Email me when a form is sent sends a notice to your account's email address for bookings, messages and sign-ups. These go to you, the owner. Anticode doesn't email your visitors; if a customer should get a confirmation, reply from your own email, or use the exported Next.js app, which sends one.
Privacy controls
| Control | What it does |
|---|---|
| Keep submissions | Until I delete them, 30 days, 90 days, 6 months, 1 year or 2 years. Older ones are deleted automatically within the hour |
| Recent access | Each time submissions were viewed, exported as CSV or deleted, how many, and whether it was you in the app, an API or assistant, or the automatic retention clean-up |
The full access log keeps the last 200 entries. A site that collects data also has to meet the security baseline before it can be published: the account owner and the person publishing need two-factor sign-in on. For the wider picture, see how to store form data safely.
The free plan's monthly allowance
A free site shows a set number of website form submissions each calendar month, 100 by default. Anything after that is still received and saved, so nobody's message is lost, but it's held: it isn't emailed to you, isn't sent to connectors and doesn't appear in the inbox. The panel tells you how many people are waiting. On a paid plan held submissions become visible in the inbox (they still aren't emailed or sent to connectors) and new ones flow normally; see pricing for the plans.
Limits
- Fixed fields on the built-in forms. Contact, booking and newsletter forms have the fields above. For other fields (up to 30), or extra logic such as a quote calculation or a call to your own server, use a custom form with a site function.
- No auto-reply to visitors. Anticode emails the owner, not the person who filled in the form.
- No spam filtering beyond the basics. Origin checks, field validation and rate limits stop most junk, but there's no CAPTCHA.
- Exports are yours to protect. Once you download a CSV, the encryption at rest no longer applies to that file.
Questions people ask
Can I delete one submission without deleting the rest?
Yes. Each submission can be deleted on its own from the Users panel, and the deletion is recorded in the access log.
Do held submissions on the free plan ever get deleted?
No. They're kept and become visible when the account moves to a paid plan, unless your own retention setting removes them first.
Can I send submissions to Google Sheets or Slack?
Yes, through a connector. Each submission is sent once to every enabled connector, as well as being kept in your inbox.
Do forms in model-written apps arrive here too?
Yes. Contact, enquiry, booking and newsletter forms in an app reach you through the same form pipeline.