Terms of service
These terms apply to everyone with a PostForm account. PostForm is operated by PostForm. Using the service means accepting them.
What the service is
You point an HTML form at our endpoint using an access key. We receive the submission, store it, and email it to a destination address you have confirmed. Storage is the guarantee: every accepted submission is written to the database before any send is attempted, and it stays readable in your dashboard whether or not the email got through. Email delivery is best-effort, because it depends on mail servers we do not run.
Access keys are not secrets
An access key is a routing identifier and it is published in your page source by design. It is not a credential and leaking one is not a security incident. What protects you is rate limiting, your monthly quota, and the fact that submissions can only ever go to a destination address you have confirmed.
Limits
- 300 submissions per rolling 30-day period, per account, across all your keys. Submissions past the limit are refused with a 429.
- Rate limits per IP and per key. Refused requests still appear in your request log.
- Submissions are capped at 64 fields, 5,000 characters per field, and 64 KB in total.
- Submissions and request logs are deleted after 30 days. Exporting anything you need to keep is your responsibility.
- Up to 20 access keys per account.
What you must not do
- Point a key at an address you do not control or have not been asked to send to. We require confirmation of every destination for exactly this reason.
- Use the endpoint to send marketing, bulk mail, or anything other than notifications of submissions to your own forms. Everything sends from a shared domain, so this is not a formality. One abuser damages every other customer's deliverability.
- Collect data you have no lawful basis to collect, or fail to disclose us in your own privacy notice.
- Attempt to exceed the limits above by automated means, or probe for other accounts' keys.
We may suspend or terminate an account that does any of these, without notice where the harm is ongoing. Where we can, we will tell you first.
Your data and your customers' data
You own your submissions. We process them on your instructions under our data processing agreement. You are the controller for what your forms collect, which means the obligations to your submitters (notice, lawful basis, responding to their requests) are yours.
Availability
There is no uptime commitment on the free tier. We run health checks and alerting and we will fix things as quickly as we can, but we do not promise a percentage and you should not build something that cannot tolerate an outage on it.
Liability
The service is provided as is. To the extent the law allows, we are not liable for indirect or consequential loss, including lost business from a submission that was not delivered. Nothing here limits liability for death, personal injury, or fraud.
Ending it
You can stop using PostForm at any time. Ask us to delete your account and we will remove your account, your keys and your submissions. Deleting a key does not delete its submissions, on purpose. That data belongs to your submitters as much as to you.
Changes
We will email account holders before a material change takes effect. Continuing to use the service afterwards means accepting the new terms.
Contact
Last updated 2026-08-04.