Privacy Policy

What webhooks.sh stores, why, and for how long. The short version: we store the webhook traffic you send us plus the minimum needed to operate and bill the service — nothing more.

What we store

• Webhook deliveries. Every request that hits your endpoint is stored as received: method, path, headers, body, the sender's IP address, and timestamps. Each bin or endpoint keeps them in its own storage on Cloudflare; bodies over 128 KB go to Cloudflare object storage. This storage is the product.
• Bin and endpoint metadata. Slug, expiry, plan, and settings. Anonymous bins are not tied to any identity; a claimed bin is linked to the account that claimed it.
• Forwarding. If you forward an endpoint's requests, we send each one to the URLs you add. We store those URLs and, for every attempt, its time, the response status code and a short error code, never the response body.
• View keys. Free-bin view keys are stored only as a SHA-256 hash. We cannot recover a lost view URL.
• Abuse reports. When someone reports an endpoint, we store the report text and — if the reporter volunteers it — their contact address.
• Account data (only if you create an account): your sign-in identity, email address, and an internal account ID.
• Billing state. Payments are processed by Stripe; we never see or store card numbers. We store only your plan status, keyed by account ID.
• Human verification. Bin creation and abuse reports in the browser are protected by Cloudflare Turnstile, which may process device signals on our behalf. Programmatic bin creation does not use Turnstile; it is rate-limited per IP address instead.

What we never do

We do not sell data, run ads, fingerprint visitors, or track people across sites. We do not inspect your traffic for advertising or profiling. Stored payloads may be scanned by automated systems to detect abuse (phishing, malware), and may be reviewed by a human after an abuse report.

Who processes the data

• Cloudflare — edge network, request storage, object storage, and Turnstile (traffic passes through Cloudflare's network, which keeps its own standard edge logs);
• Bitgate-operated servers (OVH, EU) — the database behind accounts, endpoints, billing, and abuse reports;
• Stripe — payment processing (via Bitgate's central payments service);
• Postmark — delivery of sign-in and account emails (processes your email address);
• Google — sign-in identity, if you create an account or claim a bin (via Firebase Authentication);
• Simple Analytics — cookie-less, fingerprint-free visit statistics on the public pages of webhooks.sh: marketing, documentation, sign-in, and claim pages. It never runs on bin viewers, the dashboard, or API pages;
• Totallytics (operated by Bitgate) — cookie-less visit statistics on the same public pages: page path, referrer, UTM tags, browser, screen size, language, and a country derived from your time zone. Visits are counted with a hash of IP address and browser that changes daily, without cookies, local storage, or cross-site identifiers. On our servers it also counts API requests by route and response status, never request bodies or IP addresses.

Retention

Anonymous free bins expire 48 hours after creation. Claiming a bin with a free Google sign-in disarms the self-destruct and gives newly captured requests a 30-day rolling history; requests captured before claiming keep their original expiry — claiming is not retroactive. Paid plans retain deliveries for 90 days from receipt.

The moment a delivery expires it stops being readable, and the bin's own storage deletes it, body and forwarding records included, in its regular cleanup. As a backstop, a fixed storage-lifecycle rule deletes every stored body no later than 100 days after storage. Requests captured before October 2, 2026 also left records in the database of our previous delivery pipeline; we are deleting those. Deletion is real deletion.

One bounded exception: if a bin's storage is briefly unavailable, we hold the request in a fallback object until it can be stored, then delete that copy. Leftover fallback copies expire on their own within 30 days and are never used to serve reads. Operator backups and abuse evidence follow their own finite, documented windows.

Abuse reports are kept while the reported endpoint exists and for 90 days after. Account data is kept until you ask us to delete it.

Your rights

You can request access to, correction of, export of, or deletion of your personal data at any time — email abuse@webhooks.sh. If your webhook traffic contains your own users' personal data, you are its controller; deleting your endpoint's data deletes it for them too.

Security

All dashboard and viewer traffic is TLS-encrypted, view keys are stored hashed, and bin contents are readable only with the secret view URL. Report security issues to abuse@webhooks.sh.

Changes

We may update this policy as the service evolves; the "last updated" date above tracks that. Material changes will be called out on this page.