Privacy Policy

Last updated: July 3, 2026

1. Information We Collect

We collect the following types of information:

Account Information

  • Email address (required for account creation)
  • Username and display name
  • Password (bcrypt hashed, never stored in plain text)
  • Email verification status

Webhook Data

  • Request headers, body, and metadata from webhooks you receive
  • IP addresses (SHA-256 hashed for privacy)
  • Request timestamps and method types
  • This data is retained for 30 days then automatically deleted

Usage Information

  • Login times and locations (with hashed IPs)
  • Feature usage patterns for improving the service
  • Error logs for debugging and security purposes

2. How We Use Your Information

We use collected information to:

  • Provide and maintain the webhook testing service
  • Authenticate users and manage accounts
  • Send email notifications (verification, password reset)
  • Monitor and improve service performance
  • Detect and prevent abuse or security threats
  • Comply with legal obligations

3. Data Storage and Security

Your data is stored on Cloudflare's infrastructure (Workers, D1 Database, KV) with the following security measures:

  • Passwords hashed with bcrypt (industry standard)
  • API keys hashed with SHA-256 before storage
  • IP addresses hashed with SHA-256 for audit logs
  • HTTPS encryption for all data in transit
  • Optional webhook payload encryption (AES-256-GCM)
  • Rate limiting to prevent abuse
  • Account lockout after 5 failed login attempts

4. Data Retention

Data Type Retention Period
Webhook requests 30 days
User accounts Until manually deleted
Audit logs 90 days
API keys Until revoked or expired

5. Data Sharing

We do NOT sell or share your personal information with third parties except:

  • Service providers (Cloudflare) who host the platform
  • Legal requirements (court orders, law enforcement requests)
  • Protection of rights and safety of users and public

6. Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your account and associated data
  • Export your webhook history (within retention period)
  • Revoke API keys at any time
  • Opt out of non-essential communications

7. Cookies and Tracking

We use minimal cookies for:

  • Authentication tokens (JWT stored in localStorage)
  • CSRF protection
  • Security headers (HSTS, CSP)

We do NOT use third-party analytics or tracking cookies.

8. Third-Party Services

The Service uses the following third-party providers:

  • Cloudflare - Infrastructure hosting (Workers, D1, KV)
  • GitHub/Google OAuth - Optional authentication providers
  • Cloudflare Turnstile - CAPTCHA for bot prevention

Each provider has their own privacy policy governing data processed on their platforms.

9. Children's Privacy

This Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

10. International Users

The Service is operated from the United States. If you are accessing from outside the US, please be aware that your data may be transferred to and processed in the United States.

11. Changes to Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance.

12. Contact Us

For privacy-related questions or to exercise your data rights, please contact us through our support channels.