---
{
  "id": "platform.form.public-responses-and-privacy",
  "topic": "form",
  "title": "Public Form responses, privacy, and safe analysis",
  "locale": "en",
  "version": "2026-08-25",
  "summary": "Public submissions enforce availability and anti-abuse policy, minimize respondent identity data, and expose revision-aware display values for analysis.",
  "content": "Share tokens expose only `published`, non-archived Forms. Submission enforces rate limits, captcha, honeypot, login, dedupe, windows, capacity, and a configurable 64 KiB body limit. Never describe token construction or bypasses.\n\nAvailability and validation return typed `FORMS_*` errors; runtime is authoritative.\n\nLogin and dedupe failures use `FORMS_LOGIN_REQUIRED` and `FORMS_ALREADY_SUBMITTED`. With `allow_multiple_submissions: false`, users dedupe by user ID; anonymous respondents use an opaque browser cookie best-effort and have `respondentUserId: null`. Identity metadata has a hashed IP, user agent, and 90-day retention. Public field IDs are opaque hashes.\n\nResponses bind to their submitted revision. `list_responses.answerSummary` resolves option IDs through that definition or legacy snapshot; analyze `displayValue`, not raw IDs. Private-only `export_responses` writes revision-compatible CSV, xlsx, or PDF to personal File Center, or a native workbook for xlsx. It scans at most 10,000 responses, 16 MiB, and 500,000 cells; caps set `truncated`. Confirmed `delete_response` permanently removes one response. Cards and telemetry never contain answers, respondent metadata, share tokens, or submission tokens.\n\n`form` is not a Trigger `sourceType`; use Cron with `list_responses` for periodic processing.\n",
  "aliases": [
    "anonymous form response",
    "public submission",
    "answerSummary",
    "displayValue",
    "duplicate submission",
    "captcha",
    "response privacy",
    "summarize responses"
  ],
  "tags": [
    "form",
    "responses",
    "privacy",
    "analysis",
    "safety"
  ],
  "relatedActions": [
    "arinova.form.get_form",
    "arinova.form.list_responses",
    "arinova.form.export_responses",
    "arinova.form.delete_response",
    "arinova.cron.schedule"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/form/public-responses-and-privacy/"
}
---

Share tokens expose only `published`, non-archived Forms. Submission enforces rate limits, captcha, honeypot, login, dedupe, windows, capacity, and a configurable 64 KiB body limit. Never describe token construction or bypasses.

Availability and validation return typed `FORMS_*` errors; runtime is authoritative.

Login and dedupe failures use `FORMS_LOGIN_REQUIRED` and `FORMS_ALREADY_SUBMITTED`. With `allow_multiple_submissions: false`, users dedupe by user ID; anonymous respondents use an opaque browser cookie best-effort and have `respondentUserId: null`. Identity metadata has a hashed IP, user agent, and 90-day retention. Public field IDs are opaque hashes.

Responses bind to their submitted revision. `list_responses.answerSummary` resolves option IDs through that definition or legacy snapshot; analyze `displayValue`, not raw IDs. Private-only `export_responses` writes revision-compatible CSV, xlsx, or PDF to personal File Center, or a native workbook for xlsx. It scans at most 10,000 responses, 16 MiB, and 500,000 cells; caps set `truncated`. Confirmed `delete_response` permanently removes one response. Cards and telemetry never contain answers, respondent metadata, share tokens, or submission tokens.

`form` is not a Trigger `sourceType`; use Cron with `list_responses` for periodic processing.