webhooks.sh — Privacy Policy
Last updated August 29, 2026
What webhooks.sh stores, why, and for how long. The short version: we store the webhook traffic you send us plus the minimum needed to operate and bill the service — nothing more.
What we store
- Webhook deliveries. Every request that hits your endpoint is stored as received: method, path, headers, body, the sender's IP address, and timestamps. Bodies and headers live in object storage, metadata in our database. This storage is the product.
- Bin and endpoint metadata. Slug, expiry, plan, and settings. Anonymous bins are not tied to any identity.
- View keys. Free-bin view keys are stored only as a SHA-256 hash. We cannot recover a lost view URL.
- Abuse reports. When someone reports an endpoint, we store the report text and — if the reporter volunteers it — their contact address.
- Account data (only if you create an account): your sign-in identity, email address, and an internal account ID.
- Billing state. Payments are processed by Stripe; we never see or store card numbers. We store only your plan status, keyed by account ID.
- Human verification. Bin creation is protected by Cloudflare Turnstile, which may process device signals on our behalf.
What we never do
We do not sell data, run ads, fingerprint visitors, or track people across sites. We do not inspect your traffic for advertising or profiling. Stored payloads may be scanned by automated systems to detect abuse (phishing, malware), and may be reviewed by a human after an abuse report.
Who processes the data
- Cloudflare — edge network, object storage, queues, and Turnstile (traffic passes through Cloudflare's network, which keeps its own standard edge logs);
- Bitgate-operated servers (OVH, EU) — the database behind endpoints, deliveries, and reports;
- Stripe — payment processing.
Retention
Free bins expire after 48 hours; their stored requests are then deleted, and deletion is real deletion. Abuse reports are kept while the reported endpoint exists and for 90 days after. Account data is kept until you ask us to delete it.
Your rights
You can request access to, correction of, export of, or deletion of your personal data at any time — email abuse@webhooks.sh. If your webhook traffic contains your own users' personal data, you are its controller; deleting your endpoint's data deletes it for them too.
Security
All dashboard and viewer traffic is TLS-encrypted, view keys are stored hashed, and bin contents are readable only with the secret view URL. Report security issues to abuse@webhooks.sh.
Changes
We may update this policy as the service evolves; the "last updated" date above tracks that. Material changes will be called out on this page.