The accepted answer is wrong. The way of getting the data doesn't matter in light of the GDPR.
Whilst it is true that it has to be personal data (about individuals residing in the EU), personal has a very broad meaning (more examples). It is true that [email protected] is not personal data. However, when the user can be identified it is personal data, even if no explicit names are used (eg. [email protected]). Moreover, if you process any data that indirectly make a person identifiable (eg. location data, ip-address, certain id's, device id's, ...), it will also be personal data.
In any case, in no way does a user entering information against your directions lift your duty to comply with the GDPR. Because, the moment you process personal data (the way you got it doesn't matter) GDPR is applicable. And processing is a very broad concept under GDPR (more examples). Even 'shredding documents containing personal data' is processing. So, the moment data "passes through your code", you are processing data. Obviously, the risks will differ with different kinds of processing, but that's a risk that you have to assess (this is in fact an obligation under GDPR).