Feature — collecting
Save & continue
Save and continue gives a respondent a resume link keyed on a
24-character token, so a long survey can be finished in more than one
sitting. Partial answers are held in a table that has no row-level
security policies at all and is reachable only through
SECURITY DEFINER database functions, which means no
browser client can read another person's half-finished response even
if it knows the table exists.
Why half-finished responses matter
Most survey abandonment is not disagreement. It is a phone battery, a meeting starting, a question that needs a figure from a colleague, or a form opened on the bus and never reopened. A grant application or a service review with sixty questions is not a single-sitting task, and treating it as one quietly filters your sample down to people with a free half hour.
Save and continue removes that filter. It is most useful on surveys built with conditional logic and section-based layouts, where the respondent is already being asked to work through several screens rather than one short page.
How the resume link works
A 24-character token is minted for the session, and answers are saved against it as the respondent works. The finish-later control gives them the link containing that token. The token is the whole credential — there is no email address, password or respondent account behind it. Opening the link restores the answers recorded so far and puts the respondent back into the survey.
That has two practical consequences worth stating plainly:
- The link is portable. Start on a phone, finish on a desktop. Nothing is tied to the original browser session.
- The link is a bearer credential. Anyone holding it can continue that response. Tell respondents to treat it like a private link, and do not ask for information in a survey that you would not want reachable from a URL somebody could forward.
NumoForms does not email the link out. Respondents copy or bookmark it themselves, which is a smaller surface than a message sitting in a shared inbox — but it does mean you should say, in the survey's own wording, that the link is the only way back in.
Where partial answers live
Completed responses and partial responses are stored separately, and the partials table is deliberately locked down harder than anything else in the product.
| Control | How it is implemented |
|---|---|
| Direct client access | Impossible. The partials table carries no RLS policies, so the default deny applies to every browser client. |
| The only route in | SECURITY DEFINER functions, which run with the definer's rights and accept the token as their argument. |
| Token length | 24 characters. |
| Location | Supabase, London (eu-west-2), the same region as completed responses. |
| Encryption | TLS in transit, AES-256 at rest, provided by the platform. |
Why "no policies" is stricter than "a policy"
Row-level security denies by default: a table with RLS on and no policy matches nothing, for anybody. Writing a policy is what opens a door, and a subtly wrong policy is the most common way survey tools leak between tenants. Here there is no door to get wrong. The only path to a partial response is a function that was written for exactly that job, and the function is the thing that decides what a token entitles you to see.
This matters more than usual because responses insert straight from the browser rather than through an application server. The same reasoning is why the private upload bucket issues short-lived signed URLs instead of making files readable.
How it behaves in each layout
NumoForms has three respondent layouts, and saving works in all of them, though it feels different in each:
- Classic — one scrolling page. Saving is for the respondent who has filled in the top half and needs to fetch a number.
- Paged — a section per screen. The natural pattern: finish a section, save, come back to the next one.
- Conversational — one question at a time, with one-tap questions auto-advancing. Saving here is what stops a fifty-step sequence being all-or-nothing.
Close dates, caps and partials
A survey can carry a close date and a response cap, and both are enforced by a database trigger rather than by the interface. Because responses insert directly from the browser, UI-level enforcement would be a suggestion; a trigger is a rule. The practical effect for save and continue is that a resume link does not exempt anyone from the close date. If you are running a consultation that closes at midnight, say so in the survey, and give people enough notice that a saved response is still worth returning to. When a survey is closed, respondents see your custom closed message rather than a generic error.
Clearing partials before you go live
Testing a long survey means creating partials. The results screen has a clear-test-responses action that removes the completed responses, the uploaded files and the partial responses together, so "we tested it properly" and "the dataset is clean" are not in tension. Do this before publishing, not after the first real response arrives.
What it does not do
Being specific about the edges is more useful than a feature list:
- No respondent accounts, and no way to look up your own link later.
- No email delivery of the resume link, because the product does not send email to respondents.
- No CAPTCHA on the resume route, and the dwell-time floor does not apply to resumed partials; the honeypot and the per-minute rate limit still apply on submission.
- No offline or kiosk mode — a resume link needs a connection.
Related
Save and continue is one part of the collecting side of the product. See also file uploads and signed URLs, how accessibility is handled for keyboard and screen-reader respondents, and the product overview for how building, collecting and analysing fit together. If you are assessing us for a public-sector consultation, the security page covers storage location and sub-processors.
Common questions
Do respondents need an account to save their progress?
No. There are no respondent accounts. Progress is tied to a 24-character token carried in the resume link, so a respondent can come back on a different device without signing in to anything.
Where are partial answers stored?
In a separate table inside the same UK Supabase project (London, eu-west-2) as the completed responses. That table has no row-level security policies at all, so no browser client can read or write it directly. Every read and write goes through SECURITY DEFINER database functions.
Can I delete partial responses?
Yes. Clearing test responses on a survey removes the partial responses and the uploaded files along with the completed responses, so a survey can be reset to genuinely empty before it goes live.
Is the resume link emailed to the respondent?
No. NumoForms does not send email to respondents. The link is shown on screen for the respondent to copy or bookmark, which also means it never sits in an inbox that somebody else can read.
Long surveys, finished properly.
Turn on save and continue and the respondent gets a resume link they can copy or bookmark. A sixty-question consultation stops being a single-sitting task, which stops it quietly filtering your sample down to people with a free half hour.
- A 24-character resume link, not a respondent account
- Start on a phone, finish on a desktop
- Clearing test responses removes partials and uploads too
