Submissions

When someone fills out your form, Formoar processes the submission through several stages: validation, spam checking, storage, and email delivery. This page explains the full submission lifecycle.

Submission flow

Every submission goes through these steps:

1. Form lookup — The endpoint checks that the form exists and is active
2. Origin check — If allowed origins are configured, the request origin is validated
3. Body parsing — JSON or FormData is parsed into key-value pairs
4. Rate limiting — IP-based rate limiting prevents abuse (5 requests per minute per IP)
5. Spam checks — Honeypot field and optional Cloudflare Turnstile verification
6. Monthly limit — Atomic check against your plan's monthly submission quota
7. Storage — The submission is saved to your form's submission history
8. Email notification — If enabled, an email is sent with the submission data

Submission data

All form field names and values are stored as key-value pairs. Fields that start with _ (underscore) are treated as metadata and excluded from email notifications.

Monthly limits

Each plan has a monthly submission limit. Submissions are counted from the 1st of each month (UTC). When the limit is reached, new submissions are rejected with a 429 status code.

Plan	Monthly Limit
Free	50
Starter	500
Pro	5,000
Business	50,000

Data retention

Submissions are automatically deleted after the retention period for your plan:

Plan	Retention
Free	30 days
Starter	90 days
Pro	365 days
Business	Unlimited

Viewing submissions

All submissions are visible in your Formoar dashboard. You can view individual submissions, see their metadata (IP address, user agent, referrer), and filter by date range.