Hooks receives a webhook, keeps it, and deletes it 3 days later. The tries to send it to your target are deleted with it. You can delete an event, a source or your whole account at any time.
What Hooks stores
Your sign-in email. Hooks uses it to know whose sources they are and to send you an alert email.
Each source: its name, its secret id, its target URL, whether you paused it, and the time you made it.
Each event: the time, the method, the path, the query string, the headers, the body and its size. The headers and the body are whatever the sender put in them. This can include personal data of other people, and headers such as Authorization. Do not send secrets that you cannot lose.
Each try to send an event to your target: the time, the status code, a short error text and how long it took. Hooks does not keep the answer of your target.
A count of events for each day and month, to apply the limits.
Hooks never stores these items:
The IP address of the sender of a webhook.
Cookies, and the headers that name the sender or the network: cf-*, x-forwarded-*, x-real-ip, true-client-ip, cdn-loop and host.
Your target
When you set a target and verify it, Hooks sends the full webhook to it: the method, the headers and the body. Hooks adds a few headers of its own, such as X-Hooks-Event-Id. Hooks sends a check with a random challenge to your target before it sends any event. Hooks never follows a redirect.
Alert emails
When an event fails 5 times, Hooks sends one email to your sign-in address. It sends at most one email for each source in 24 hours. The email has the name of the source and a count. It has no event data.
Delete my account
Sign in and choose "Delete my account". The server then deletes all your sources, events, tries and counters. It also deletes your sign-in account. This cannot be undone.
Your sign-in is shared with Kevin's other apps. So you are signed out of them too. A request goes to Kevin automatically. He deletes what those apps keep for your account soon after.
Signing in
To sign in you use Google (on Google's site) or a code sent to your email. The sign-in service keeps your email and sets a cookie on utilarium.app (and on kamadorueda.com when the sign-in goes through it) for 30 days. For details, read the sign-in section of Coro's privacy page. A sender of webhooks does not sign in.
Where it runs
Hooks runs on Cloudflare. The records are in Cloudflare D1. Like any web host, Cloudflare sees the IP address of every request. To limit how many requests one source takes, Cloudflare counts requests by source. Hooks does not store or log any address.
Analytics and error reports
Cloudflare Web Analytics can add a small script to the pages, to measure visits and speed. We do not control that script. Our own code sets no cookie and keeps no profile of you.
If the page has an error, it sends a report with the error message, page type and browser. It has no event, header, body or email. Cloudflare keeps technical request logs, with no IP address, for 7 days. Our logs have no source id, header or body. For about 1 in 10 requests, Cloudflare also records the browser and operating system, the language, the network and an approximate location.
