Privacy policy

Data we hold about you

Account and security data. When you create an account we store your email address, display name, and a hash of your password (never the password itself). Because two-factor authentication is required on every account, we also store your authenticator enrollment and, if you add passkeys, their public keys and the names you give them. If you sign in with Google or GitHub, we store the identifier and email address the provider shares, never their passwords or tokens beyond the sign-in.

Service data. Your endpoints and their configuration, your API keys (stored only as fingerprints; the key itself is shown once and cannot be read back by anyone, including us), when each key was last used, your plan and usage counters, and a workspace activity log of security-relevant events you can see on your Activity page.

Captured webhook content

The product's purpose is storing what others send you: when a sender delivers to one of your capture URLs, we store the full request and show it to you. That content is yours. We do not read, mine, profile, or advertise against it; it is processed only on your instructions: stored, searched, forwarded to destinations you configure, replayed when you ask, deleted per your retention. Payloads routed to you may contain personal data about your users; for that content you are the controller and we act as your processor.

How long data is kept

• Captured requests: your plan's retention window (3 to 365 days), with per-endpoint storage caps that evict oldest-first. You can delete any request, endpoint, or everything on an endpoint at any time, effective immediately.
• Ephemeral endpoints delete themselves and everything they captured at expiry.
• Activity events: your retention window or 90 days, whichever is longer.
• Account data: while your account exists.
• Backups: nightly, kept 14 days for disaster recovery. Deleted data leaves the live system immediately and ages out of backups within 14 days.

Where data goes

A small number of providers, each only for what it says: Cloudflare (DNS and TLS proxying for the app and website domains; the capture domain is deliberately not proxied), Resend (transactional email), and Google or GitHub only if you sign in with them. We do not sell data, share it with advertisers, or run third-party analytics; the app contains no tracking scripts at all.

Cookies

Only what the app needs to work: a sign-in cookie, a request-forgery protection cookie, a short-lived cookie carrying a plan you chose during signup, and your theme preference in local storage. No advertising or analytics cookies.

Security

All app and API traffic is TLS-encrypted. Two-factor authentication is mandatory. Passwords and API keys are stored only as hashes. Capture URLs additionally accept plain http:// by design, because some webhook senders cannot negotiate TLS and a bounced delivery is worse than a plain one; HTTPS capture is always available and recommended.

Your rights

You can read, search, export (via the API) and delete your captured data yourself, at any time. To access, correct, or export your account data, or to delete your account entirely, send a contact-page request and we remove everything within 7 days. Whatever rights your local law grants you, we honor through that same route.

This website

webhookvault.net itself is a static informational site: no accounts, no analytics, no advertising, and no cookies. Standard web server access logs (IP, user agent, URL, timestamp) are kept solely for operations and abuse detection and deleted within 30 days. Typefaces load from Google Fonts, so your browser discloses your IP to Google when fetching them (see the Google privacy policy).

Children and changes

WebhookVault is a developer tool, not directed at children under 16. If this policy changes in a way that matters, we say so on this page and, for significant changes, by email; the date above always tells you the current version.