Blog / Technical Guides

Send Lovable Form Submissions to Google Sheets (No Paid Tool)

By Keyona Meeks, Founder, ReRev Labs · Oct 31, 2026 · 8 min read

The short answer: Make a Google Sheet, paste a short Apps Script into it, and deploy the script as a web app. That gives you a URL. Point your Lovable form at that URL and each submission becomes a new row. It costs nothing beyond the Google account you already have. The catch is that a public URL can be spammed, so the script below includes a secret word and a trap field.

By the end of this post, you'll be able to:

Create a Google Sheet that receives form submissions from your Lovable site.
Deploy a small Apps Script as a web app and know which settings matter.
Ask Lovable to connect your form to it, and test that a row arrives.

Someone fills in your contact form at 9 PM. You do not see it until Thursday, because the message went to a page you never open. By then they have called someone else.

A form that sends rows to a sheet fixes the first half of that problem. You can see every inquiry in one place. This post builds that with tools you already have. I wrote it for a Lovable site, but the same steps work for any site that can send a form post.

What are we building?

Three pieces:

A Google Sheet with a tab called Submissions.
An Apps Script attached to that sheet. It waits for a form post and adds a row.
Your Lovable form, which sends its fields to the script's web address.

No third-party form service sits in the middle. Your data goes from your site to your own sheet.

How do you set up the sheet?

Create a new Google Sheet. Name it something you will recognize, such as Website inquiries.
Rename the first tab to Submissions. The script looks for that exact name.
In row 1, type these headers: Received, Name, Email, Message.

If your form has other fields, add a header for each one and add the field names to the FIELDS line in the script. The order of the headers must match the order of FIELDS, after Received.

How do you add the script?

Open the sheet. Choose Extensions → Apps Script. Delete the sample code, paste the script below, and choose Save.

If you have never used Apps Script, read what Google Apps Script is first.

// Receives form posts from your site and adds a row to this sheet.
const SHEET_NAME = 'Submissions';
const FIELDS = ['name', 'email', 'message'];   // must match the form field names
const SECRET = 'change-this-word';             // must match the value your form sends
const MAX_LENGTH = 2000;

function doPost(e) {
  const p = (e && e.parameter) || {};
  if (p.secret !== SECRET || p.website) {      // wrong secret, or the hidden trap field is filled
    return reply_({ ok: false });
  }
  const lock = LockService.getScriptLock();
  lock.waitLock(10000);
  try {
    const sheet = SpreadsheetApp.getActive().getSheetByName(SHEET_NAME);
    const row = [new Date()].concat(FIELDS.map(function (f) {
      return clean_(p[f]);
    }));
    sheet.appendRow(row);
  } finally {
    lock.releaseLock();
  }
  return reply_({ ok: true });
}

function clean_(value) {
  let text = String(value === undefined ? '' : value).slice(0, MAX_LENGTH);
  if (/^[=+\-@]/.test(text)) text = "'" + text;  // stop a typed formula from running
  return text;
}

function reply_(obj) {
  return ContentService.createTextOutput(JSON.stringify(obj))
    .setMimeType(ContentService.MimeType.JSON);
}

Change change-this-word to a word only you know. Do not use a password you use anywhere else. This word will be visible in your site's code, so it works like a stamp, not like a lock. It stops casual junk. It does not stop someone determined.

Here is what the script does.

It reads the fields the form sent.
It rejects the post if the secret word is wrong, or if a hidden field called website has anything in it. People do not see that field. Many spam bots fill in every field they find.
It waits its turn with a lock, so two submissions at the same moment do not write over each other.
It cuts each value to 2,000 characters.
If a value starts with =, +, - or @, it adds an apostrophe, so a spreadsheet does not treat typed text as a formula.
It adds one row.

How do you deploy it as a web app?

In the Apps Script editor, click Deploy then New deployment.
Next to Select type, open the settings and choose Web app.
Fill in the deployment configuration. Run it as yourself. Set access to anyone, so your visitors do not need a Google account. Anyone with the URL can then send it a post, which is why the secret word and trap field matter.
Click Deploy and approve the permissions. Google will ask you to authorize the script, because it writes to your sheet.
Copy the web app URL.

Source: Google's web apps guide, checked October 30, 2026. Menu names change. If a step looks different on your screen, check that page.

One thing to know now: when you change the script later, the live URL does not pick up the change on its own. You have to deploy a new version. If your fix does nothing, that is the first thing to check.

How do you connect the form in Lovable?

Open your project in Lovable and ask it to change the form. Here is a prompt you can adapt:

Change the contact form so it sends the fields name, email and message
to this URL with a POST request:
PASTE-YOUR-WEB-APP-URL-HERE

Send the data as URL-encoded form fields (URLSearchParams), not JSON.
Also send a field called secret with the value PASTE-YOUR-SECRET-WORD,
and add a hidden text field called website that is left empty and is
not visible to people. Show a thank-you message after the form is sent.

The code Lovable writes should look something like this:

await fetch(WEB_APP_URL, {
  method: "POST",
  mode: "no-cors",
  body: new URLSearchParams({ secret, name, email, message, website }),
});

Two choices in that snippet are on purpose. The data goes as form fields, not JSON, so the browser treats it as a simple request. And the request uses no-cors, which means your site sends the form but cannot read the reply. The site cannot tell you whether the sheet accepted the row. Your form will show the thank-you message either way. That is a real limit. Read the next section.

How do you test it?

Open your live site, or the Lovable preview, and submit the form with test text.
Check the Submissions tab. A row should appear within a few seconds.
Submit it once more with a message that starts with =1+1. The cell should show that text, not 2.
If nothing arrives, open Executions in Apps Script. It shows each time the script ran and any error.

Do the test before you tell anyone the form works. A form that fails quietly is worse than one that is obviously broken.

Where does an LLM fit in this?

Not in receiving the form. Saving a row is a rule, and plain code does it the same way every time. An LLM is useful later, if your inquiries come in as messy free text and you want a short summary or a category. Even then, I would keep a person checking the result before anything is sent to a customer.

Where this has limits

No confirmation. With no-cors, your site cannot see whether the script succeeded. If the script fails, the visitor still sees a thank-you. Check the Executions page now and then. For a business that lives on inquiries, a hidden failure matters.
Spam. The secret word is visible in your site code. The trap field catches simple bots. Neither stops a determined sender. If spam gets heavy, a service built for it is the better tool.
Quotas. Apps Script has daily limits. Check Google's quotas page, which I checked on October 30, 2026. A contact form is far below them. A site with heavy traffic is not.
It does not notify you. A new row is not an alert. If nobody opens the sheet, you have a quiet inbox in a new place. Add an email alert to the script, or a notification rule in the sheet.
Private data. Do not collect health, payment or ID details this way. Check with a professional before you decide where that data lives.
I tested the script, not your site. I checked the script with mock data. I did not run it against a live Lovable site, so test it on yours.
One owner. The script runs as you. If your account changes or you leave, the form stops. Write down who owns it.

If you want the form, the sheet and the follow-up wired together so a new inquiry gets answered, you can apply on /letstalk. Bring a description of your form and what happens today after someone sends it. Do not send passwords or login details.

Still working on getting the site itself live on your domain? Read how to deploy a Lovable website to your own domain. If your site sends email through MailerLite, read the MailerLite and Lovable trap.

Frequently asked questions

Do I need a paid tool or a Zapier account?

No. This uses a Google account, an Apps Script and your site. Paid tools can be easier to set up and send confirmations. This is the free path for a simple form.

Will it work if my visitors do not have a Google account?

Yes, if you set access to anyone when you deploy. The script runs as you, so visitors do not sign in.

I changed the script and nothing happened. Why?

The web app URL runs the version you deployed. Deploy a new version after you change the code, and test again.

Can I get an email when someone submits?

Yes. You can add a line that sends you an email in the script, or set up a notification rule in the sheet. Email sending has a daily limit, listed on Google's quotas page.

Is this safe to use for customer data?

For a basic contact form, many small businesses do this. The sheet is private to you until you share it. The web address that receives posts is public, so keep sensitive data out and limit who can open the sheet.

What if I would rather not touch code?

Then ask for help, or use a form tool you already pay for. The point of this post is that you can have your inquiries in one place without adding another subscription.

Read next: Replace Typeform with a form you own if you want the same setup without Lovable, get form notifications by email if you do not need the full sheet, and the Lovable launch checklist when the rest of the site goes live.