Getting StartedIntegration GuideAuto-Reply EmailsEmail TemplatesNotificationsRules EngineSpam ProtectionPrivacy FeaturesCustom RedirectsFile UploadsWebhooksMailchimpSlackWidgetReact PackageCORS & AJAXAnalyticsAI Form GeneratorForm Templates

Privacy & Security Features

Personal+

Protect your users' data with private emails, custom honeypot fields, and domain restrictions — all built in.

1

Private Email Addresses

Mask submitter email addresses in notification emails so internal staff can process submissions without seeing full personal data.

Before — Email Visible
NameRahul Sharma
Emailrahul.sharma@gmail.com
Phone+91 98765 43210
After — Email Masked
NameRahul Sharma
Emailra****@gmail.com
Phone+91 98765 43210

Healthcare Clinic

A clinic's receptionist receives appointment request notifications. With private emails enabled, the receptionist can see there's a new request from "Ra****@gmail.com" and process it — without ever seeing the patient's full email address. The doctor can still view the full data in the dashboard.

How to enable

  1. 1Go to your form → Settings → Privacy & Security
  2. 2Toggle on "Private email addresses"
  3. 3Save Settings
2

Custom Honeypot Fields

Name your own invisible trap field to catch spam bots — even the smart ones that know about common honeypot names.

Spam Bot
fills hidden field
R
Rowen detects
strips field
Spam Blocked

Why use a custom name?

Smart bots know about common honeypot field names like _gotcha and skip them. By naming your trap field something plausible like company_fax, bots will fill it in — and get caught.

How to set up

  1. 1Go to your form → Settings → Privacy & Security
  2. 2Enter a custom honeypot field name (e.g. "company_fax")
  3. 3Add a hidden input with that name to your HTML form
  4. 4Save Settings

Code example

<!-- Add this hidden field to your form -->
<input
  type="text"
  name="company_fax"
  style="display:none"
  tabindex="-1"
  autocomplete="off"
/>

Real users never see or fill this field. Bots do — and Rowen rejects the submission.

3

Domain Restrictions (CORS)

Restrict which domains can submit to your form endpoint. This prevents unauthorized sites from posting data to your forms.

Domain restrictions are covered in detail in the CORS & AJAX documentation. Head there for full setup instructions, allowed-origin configuration, and AJAX code examples.

Best practice: layer your defenses

Enable all three — private emails for data privacy, custom honeypot for spam protection, and CORS restrictions for endpoint security. Together they provide comprehensive protection for your forms.