Note: @ekes mentioned we want to check what we did to prevent session cookie getting set.

Discussing at Merge Tuesday - @ekes to double check if there's seesion cookies getting set

No session cookie being set. Not even on submission.

It sets the cache control header to no-cache on a submission return page. So with cache time in core enabled the page would be like cache-control max-age=86400, public with the form, and it becomes must-revalidate, no-cache, private for the submission response. Which all seems sensible.

There is also no spam control though ;-)

Other non-related concern would be putting something about personal information somewhere, not to be encouraging councils to end up with personal info in the db.

@andybroomfield mentions the need for a council to get a DPA (approval from the legal department) before deploying this a form.

@ekes highlights the need to encourage users to NOT submit personal data.

Also - we might be able to include default options to make use of the long term storage and purge results.

Discussing at Merge Tuesday - perhaps just show a message when enabling the module with a little more detail in the README.

perhaps just show a message when enabling the module
with a little more detail in the README.

Done, and done.