Privacy policy

PostCatch ("we", "us") is a form backend service operated by millisecond.studio in Montreal, Canada. This policy explains what data we handle and why, for the two kinds of people who interact with PostCatch: form owners, who create forms and receive submissions, and form submitters, the visitors who fill out a form on a site that uses PostCatch.

Data we collect from form owners

• Account details. Your email address, an optional name, and a password (stored hashed). If you create a form straight from the homepage without signing up, we create an account from just your email address and send a confirmation link; the form only starts delivering once you confirm it.
• Form configuration. The receiving email address, the domain the form is locked to, and your spam filtering settings.
• Plan information. Your subscription plan. Payments are handled by our payment processor; we never see or store card details.

What happens to a form submission

When a visitor submits a form that points at PostCatch:

• We store the submitted fields in our database, attached to the form, along with a delivery status (delivered, blocked as spam, or over quota). The form owner can review them in their dashboard.
• We email the submission to the form owner at the address configured on the form. If the submission includes an email field, it is set as the reply-to address so the owner can respond directly.
• File attachments are emailed, not stored. Files uploaded through a form (on plans with file uploads) are forwarded to the form owner as email attachments only. We keep a record of the file names, never the file contents.
• Hidden control fields (names starting with _, such as the _next redirect) only steer behavior; they are neither stored nor emailed.

Stored submissions exist so form owners can review what was delivered and what was blocked. We do not read, mine, or use submission contents for anything else.

Spam filtering

Submissions pass through layered spam checks:

• Request analysis. We inspect the request's user agent to reject known bots outright.
• Honeypot field (optional, per form). A hidden field only automated form fillers complete; its value is never stored.
• AI content classification (optional, per form). The submitted field contents are sent to an AI provider (currently Cloudflare Workers AI) which returns a single spam category and nothing else. The content is processed under the provider's commercial API terms, solely to produce that classification.

Submissions blocked as spam are stored with the reason so form owners can spot false positives. The checks fail open: if a check errors out, the submission is delivered rather than lost.

Data collected automatically

Standard server logs (IP address, user agent, timestamps) are kept for security, debugging, and abuse prevention. We do not build visitor profiles and we do not use any data for advertising.

Cookies and analytics

The marketing site sets no analytics or advertising cookies. Logging into the dashboard sets a session cookie that is strictly necessary for authentication. That's it.

Service providers

We share data only with the providers needed to run the service: email delivery (submission notifications and account emails), AI spam classification when enabled (submission contents only), and payment processing for paid plans. We do not sell, rent, or trade personal data. We may disclose data when required by law.

Data retention and deletion

• Stored submissions remain until the form owner deletes the form or their account; both permanently delete the form's submissions.
• Deleting your account permanently deletes your forms and all of their stored submissions.
• If you submitted a form on someone else's site and want that data removed, contact the owner of that site, or email us and we will help.

Data security

We use commercially reasonable measures to protect the data we hold, but no method of transmission or storage is 100% secure.

Changes to this policy

We may update this policy from time to time. Changes are posted on this page with an updated date above.

Contact us

Questions about this policy? Email hello@postcatch.io.