Documentation / Account and data
Spam and data
Your modules are public: anyone can fill them in, including robots. This page explains how submissions are filtered without asking your visitors for a CAPTCHA, and what is stored when someone replies.
The filters, without a CAPTCHA
Your visitors have no box to check and no image to decipher. Every submission (form, quiz or reaction) goes through these checks instead:
- A trap field, invisible to a person, which a robot tends to fill in. A submission that fills it in is not stored. On a form, the robot still gets the thank-you: it does not learn what gave it away.
- A signed token, placed in the module when it is displayed. It is only valid between 3 seconds and 2 hours after display, and only for the domain where the module was displayed. A submission faster than a human, or made from a page left open too long, is refused. A form then shows "The submission could not be verified. Reload the page and try again."; a quiz shows again, ready to be retaken.
- Rate limits, per IP address and per site (details below).
- A spam score for form replies: links, text written in capitals, typical spam vocabulary. A reply judged doubtful is not deleted: it is filed in the "Spam" tab of My inbox, where you can rescue it. The person who sent it sees the same thank-you as everyone else.
Rate limits
| Module | Per IP address | For the whole site |
|---|---|---|
| Form | 8 submissions per hour and per form | 300 submissions per hour |
| Quiz | 20 entries per hour and per quiz | 500 entries per hour |
| Reactions | 1 click per sign, per page and per day; 6 clicks per page and per day | 2,000 clicks per hour |
Beyond that, the form shows "A lot of submissions at once. Try again in an hour."
No filter stops everything. A public form can be posted to by a program that knows its address, like every form on the web. These checks limit the effect, and reviewing My inbox does the rest.
What is stored
| Module | What is kept |
|---|---|
| Form | The values of the fields you declared and that were filled in, a preview of a few fields, the site, the form, the state in My inbox and the date. A value sent for a field that does not exist in your form is ignored. |
| Quiz | The score, the total, the profile obtained and the answers chosen. By default, no name, no address. If you turn on the email request before the result, the address left and the consent box checked or not, and nothing else. |
| Reactions | One counter per palette, per page and per sign. No vote is tied to a person. |
A visitor's IP address is stored with no reply. It only serves the rate limits, in temporary counters.
A form reply contains only what your visitors wrote. If you ask for a name, an email address or a phone number, that data is yours to protect: ask only for what you need.
No trackers
The modules set no cookie on your visitors and contain no ad tracker. Their display is not counted in our audience measurement. The styles' fonts are served by Bonjour la toile, and custom CSS can load nothing from elsewhere.
Who can read the replies
You, from your account. Our team can also look at the replies received, for support ("I am not receiving anything") and to handle abuse.
Email notices never contain the content of a reply.
Erasing data
- A form reply is deleted from My inbox, one at a time.
- An address left on a quiz is erased from the quiz's editor, one at a time; the entry's score stays counted.
- Deleting a quiz deletes its entries, addresses included. Deleting a palette deletes its counters.
- Deleting a form does not delete its replies: they stay in My inbox.
- Deleting a site (in its Settings) erases everything it holds: modules, forms and replies, quizzes and entries, palettes and counters.
- Closing your account (in Account settings) switches off your sites at once: your modules stop showing. Nothing is erased right away; for permanent deletion, write to us.
There is no export of form replies from your account. Only the addresses left on a quiz can be exported, as CSV, from that quiz's editor.