Is the access key safe to commit?
Yes — the form id is the public access key, designed to live client-side. There's no secret to leak.
Do submissions ever expire?
No. Submissions are stored forever on every tier, including free.
Does anything require an API key to work?
No — the core product works with zero keys. Email falls back to console logging, spam scoring falls back to the heuristic scorer, and rate limiting falls back to an in-memory limiter.