Privacy

When you submit a comment, the form sends your name, email address, comment, consent acknowledgement, and the relevant post details to Netlify. Netlify stores the private form submission and applies spam controls. A verified server-side event then sends the site owner a signed moderation notification through an owner-controlled Google Apps Script that has send-mail permission only.

To make failed notifications retryable, a short-lived copy of your email address is stored as AES-256-GCM ciphertext in the private moderation store. Plaintext email is used only in memory while sending the notification and as its reply-to address; the encrypted copy is removed immediately after confirmed delivery and is also removed by any decision or expiry. Your email is never written in plaintext to the website's comment stores, displayed on the website, or placed in the public source repository.

If a comment is approved, the public comment store contains only the submitted name, the publication date, and the approved comment text. Private moderation copies are reduced to content-free decision records after approval, rejection, or expiry. Rejected comments and spam are deleted manually from Netlify Forms promptly. Other raw form submissions are deleted manually after moderation and, in every case, within 90 days. Any later email conversation is handled separately in Gmail.