Privacy policy

The short version

• No account, ever. There is nothing to sign up for, so there is no name, email address or password to store.
• No cookies from us and no analytics. No Google Analytics, no Plausible, no Umami, no PostHog, no pixel, no fingerprinting script. With advertising switched off, this site makes no third-party requests at all.
• We store what you send to your own webhook URL — headers, body, query string — plus the sending IP address, which exists only so abuse can be dealt with.
• It deletes itself. Everything in a webhook URL is erased 7 days after the last request it received, and 30 days after it was created at the very latest.
• Signing secrets never leave your browser. The signature verifier computes the HMAC on your device.
• Advertising is the only third party. Google serves the ads and sets its own cookies. Nothing else is embedded.

Who is responsible

TryWebhook is operated by an independent developer based in India. For anything on this page, write to privacy@trywebhook.com.

In the language of the GDPR and India's Digital Personal Data Protection Act, we are the controller for the data described below. Cloudflare, which hosts the service, is the only processor.

Just reading the site

Visiting a page here writes nothing to your device and sends nothing about you anywhere. The pages are static files. There is no session, no visitor id, no A/B bucket and noSet-Cookie header. Fonts are the ones already installed on your system, so not even a font request leaves your browser.

Cloudflare, as the network that serves those files, sees the connection itself — your IP address, the URL requested, your user agent — the same way any web host does. That is described inCloudflare's privacy policy. We do not receive those logs and cannot query them.

Creating a webhook URL

Pressing the button generates a random identifier and creates storage for it. We record when it was created and when it expires. Nothing about you is attached to it: no IP address, no fingerprint, no cookie. Two URLs created from the same browser one second apart are, to us, unrelated.

What is stored when a webhook arrives

For each request delivered to one of your URLs, we keep:

• the HTTP method, the sub-path and the query string;
• every request header, exactly as sent;
• the first 256 KB of the body, byte for byte — larger bodies are truncated and flagged as such;
• the total body size, the content type and the time it arrived;
• the sending IP address, and the country and network (ASN) Cloudflare reports for it.

You decide what is in that payload, and we cannot see it coming. If the system you are debugging sends customer names, email addresses, card metadata or access tokens, all of it is stored as sent and is readable by anyone holding your URL. Point test-mode or staging traffic at a debugging tool, never live production traffic containing real personal data. If something sensitive does arrive, delete that request — or the whole URL — immediately.

Why the sender's IP address is kept

Only so that abuse can be acted on. A free endpoint that accepts anything from anyone attracts people using it as a drop for phishing forms and credential harvesting, and without the source address a report about it cannot be investigated or blocked. That is our legitimate interest in keeping it.

It is not counted, aggregated, enriched, resold or used to build a profile of anything. It is shown to whoever holds the URL, it is deleted with the rest of the request, and it is disclosed outside that only if we are compelled to by law or are responding to a specific abuse report.

How long any of it lasts

• 7 days from the last delivery. The clock resets each time the URL receives a request, so a URL something is actively sending to stays alive. Reading it in the inspector does not extend it — only traffic does.
• 30 days from creation, absolutely. Activity cannot push a URL past this ceiling. Nothing here is permanent.
• The newest 500 requests per URL. Once a URL overshoots that, the oldest are dropped to bring it back down.

You can also delete a single request, clear every request, or destroy the whole URL from the inspector at any moment. Deletion is immediate, permanent and unrecoverable — there is no trash, no soft-delete flag and no backup a deleted URL can be restored from. When a URL expires, its storage is dropped in exactly the same way.

Your webhook URL is a credential

There are no passwords here, which means the URL is the password: anyone who has it can read every request it captured and send new ones to it. Two consequences worth knowing.

First, the inspector keeps the identifier in the part of the address after the#. Browsers never transmit that fragment to the server and never include it in aReferer header, so opening the inspector does not leak your URL to us or to any page you click through to. Second, pasting the URL into a public issue tracker, a screenshot or a Stack Overflow question hands it to everyone who reads that. Treat it like a token.

What your browser keeps locally

One entry in localStorage, under the key trywebhook.recent: up to eight recently created URLs with their creation and expiry times, plus a label if you set one. It is what fills the "recent" list so you do not lose a URL by closing a tab.

It is never transmitted anywhere — not to us, not to anyone. It is not a cookie and is not sent with requests. Clearing site data for this domain in your browser removes it, and in private browsing it disappears when the window closes.

Signing secrets

The signature verifier — both the standalone tool and the tab inside the inspector — runs entirely in your browser using the WebCrypto API built into it. The secret you paste is held in a JavaScript variable and nothing more: it is never uploaded, never logged, never written tolocalStorage, sessionStorage or a cookie, and reloading the page erases it. You can confirm this with your browser's network tab, which is the only assurance worth having.

Infrastructure

The whole service runs on Cloudflare Workers, with each webhook URL's data held in a Cloudflare Durable Object. Cloudflare is our only subprocessor and processes this data on our instructions under its data processing addendum. Its network is global, so your requests are handled at the location nearest the sender, which may be outside your country.

We do not use any other analytics provider, error tracker, session recorder, CRM, mailing list or customer support platform, because there is nothing for them to be connected to.

Advertising

This site is free and is paid for by advertising. Google, through AdSense, is the only advertising partner, and ad units appear on content pages only — never inside the inspector, where your captured payloads are displayed.

Google and its partners use cookies and similar device identifiers to serve and measure those ads, and may use them for personalisation based on your prior browsing. That processing is Google's, underGoogle's own terms for sites that use its services. You can turn personalisation off atMy Ad Center, and in the EEA, the UK and Switzerland a consent dialog appears before any non-essential cookie is set — decline it and you still get the site, with non-personalised ads.

Google never receives the contents of your webhook URLs, because no ad code runs on the page that displays them. The cookie page goes through this in more detail.

What we never do

• Sell or rent your data. There is no buyer and no data worth selling.
• Build a profile of you across sites or sessions.
• Email you. We have no address for you and no list to add it to.
• Ask who you are, or make you prove it.
• Read the contents of your captured requests, except where a specific abuse report makes it necessary.

Children

This is a developer tool and is not directed at children. We do not knowingly collect anything from anyone under 13 — or under 16 in the EEA — and since there is no registration there is nothing for a child to register.

Your rights, and the awkward part

Depending on where you live you have rights of access, correction, erasure, objection and portability over personal data relating to you.

The awkward part is that we cannot identify you. There is no account to look you up by, so the only handle on any piece of data here is the webhook URL it belongs to. In practice:

• Erasure is a button. Delete the request or the URL from the inspector and it is gone at once — faster than any request to us could be handled.
• For anything else, email privacy@trywebhook.com with the webhook identifier. Without it we have no way to find the data, and we will not accept other evidence of ownership, because a stranger who can describe a URL should not be able to reach into it.
• If your data was sent to someone else's URL — a system sent your details to a debugging endpoint you do not control — send us the endpoint URL, which is usually visible in the configuration, the email or the form that pointed at it, and we will delete it. It is worth being blunt about the limit here: each URL's storage is separate and there is no index across them, so without the URL itself we have no way to search for your data, and neither has anyone else.

You can also complain to your data protection authority. In the EEA and the UK that is your national supervisory authority; in India, the Data Protection Board.

Changes to this policy

The date at the top of this page moves whenever something here changes in substance. There is no mailing list to notify you, which is the trade-off for not having your email address. Continuing to use the service after a change means you accept it.

Contact

Privacy questions and data requests: privacy@trywebhook.com. Abuse of a webhook URL: abuse@trywebhook.com, or use thereporting page.