We collect only what is needed to reply. A honeypot field and basic validation reduce spam; stronger rate limiting needs a backend.