Privacy Policy

1. Data controller

OpenWebhook is operated by David Lorenzo García, a self-employed sole trader ("autónomo") registered in Spain.
Tax ID (NIF): 12395061Q
Address: Urbanización Espejo del Mar, 04002 Almería, Spain
Privacy contact: support@openwebhook.co

2. Data processed by OpenWebhook

The free inspector, CLI, and MCP do not require an account. If you choose OpenWebhook Pro, we also process the account and billing data needed to provide it. Depending on how you use the service, the following categories are processed:

• Session identifier. Your browser creates a UUIDv6 used to route requests to your live inspector.
• Device identifier. The first CLI or MCP run mints an anonymous device token (owh_dev_). We store only a hash of that token, the current ingest UUID, expiry, session count, last-seen time, and an optional link to a Pro account after you run openwebhook auth. The raw token stays in ~/.openwebhook/config.json on your machine.
• Webhook request data. Method, path, query parameters, headers, body, source IP, receive time, and payload size pass through server memory while a request is relayed.
• Local event history. The latest 200 events are stored in IndexedDB on your device, not in our server database.
• Optional encrypted share. If you choose Share, your browser encrypts that event with AES-256-GCM and uploads only ciphertext. Redis keeps it for 24 hours. The decryption key stays in the URL fragment and is never sent to us, so we cannot read the request. Anyone with the complete link can.
• Account data. Pro accounts include your name, email address, password hash, email-verification state, secure sessions, endpoint configuration (including an optional custom HTTP status and response body) and hashed API tokens.
• Billing data. Stripe processes payment details. OpenWebhook retains Stripe customer, subscription, price, entitlement and transaction identifiers, but not full card details.
• Forwarding status. For Pro destinations we keep the latest delivery outcome, HTTP status, duration, failure count and attempt time. We do not store the forwarded payload.
• Operational counters. The server may store the endpoint identifier (a free UUIDv6, a device ingest UUID, or an internal custom-endpoint id) and daily request counts in Redis to operate and monitor the service, including anonymous device activation. For free UUIDs we may also keep the first and last inspector viewer IP, the last webhook sender IP, a truncated viewer user-agent, and IPs that trip a rate limit, for 90 days. Payloads, headers and query strings are not stored in those counters. An opt-in share stores ciphertext only, as described above.
• Aggregate website analytics. Public pages use Simple Analytics as described below.

3. How webhook requests are handled

The server reads an incoming request and forwards it over a Server-Sent Events connection to browsers, CLI, or MCP clients listening to the matching UUID or custom endpoint. Request data exists transiently in process memory for this purpose and, for Pro, while it is sent to configured HTTPS destinations. Payloads and headers are not written to an application database, file, durable queue, or server-side event history, except when you opt in to a share link: Redis then holds ciphertext for 24 hours and we do not have the key. Daily counters and endpoint identifiers may be incremented in Redis for operations.

If no browser, CLI, MCP client or forwarding destination is connected or configured, a valid request receives a response and is discarded. Ingestion uses hooks.openwebhook.co, separated from the public website. Its reverse proxy does not create an access log containing endpoint paths, query strings or payloads.

4. Browser storage and retention

A strictly necessary first-party cookie stores the UUID for up to one year so your endpoint survives a browser restart. IndexedDB stores a maximum of 200 events for that UUID. Older events are removed automatically.

You can delete one event, clear the complete local history, or generate a new session at any time. Clearing browser site data also removes the cookie and IndexedDB records. Browser vendors may evict local storage under their own policies.

Pro login uses a strictly necessary, secure, HttpOnly first-party session cookie. Account, endpoint and billing records remain until account deletion or as required for contractual, fraud, accounting and legal obligations. Expired sessions and one-time verification records are removed periodically.

5. Purposes and legal bases

Where the GDPR applies, data is processed to:

• provide the webhook inspection service you request, under Article 6(1)(b) GDPR;
• create and administer a Pro account, process purchases, manage subscriptions and send service emails under Article 6(1)(b);
• keep the service secure, prevent abuse, diagnose failures, and understand aggregate usage, based on our legitimate interests under Article 6(1)(f) GDPR;
• comply with a legal obligation where Article 6(1)(c) GDPR applies.

The session cookie is required to provide the endpoint and is not used for advertising or cross-site tracking. OpenWebhook does not use webhook content to train AI models, build advertising profiles, or sell personal data.

6. Privacy-first analytics

Public pages use Simple Analytics to measure aggregate product usage. The integration uses no advertising cookies and is configured to respect Do Not Track. Webhook bodies, headers, UUIDs, and live event details are not sent to Simple Analytics.

7. Service providers and international transfers

OpenWebhook uses OVHcloud for hosting, Simple Analytics for aggregate web analytics, Stripe for checkout, billing and tax calculation, and Resend for transactional account email. These providers process limited data to supply their services under their own privacy and security terms. Where a provider transfers personal data outside the EEA, appropriate safeguards apply where required.

We do not sell or rent data. Data may be disclosed when required by applicable law or a valid order from a competent authority.

8. Security and appropriate use

Traffic is encrypted with HTTPS/TLS. The application runs behind a restricted reverse proxy, applies request-size and connection limits, and does not expose a payload database. No internet service can guarantee absolute security.

A free webhook UUID is a bearer secret: anyone who knows it can send requests or connect to its live stream. A custom Pro URL is intentionally public for ingestion, while reading its stream requires the owner's session or API token. Generate a new free session or revoke account tokens if access is exposed. Do not submit production secrets, payment card data, health information, credentials, or data you are not authorized to process.

9. Your responsibilities

If you configure another service to send personal data to OpenWebhook, you are responsible for having a lawful basis and for informing the affected individuals where required. Use test or synthetic payloads whenever possible.

10. Your GDPR rights

Subject to the conditions and exceptions in applicable law, you may request:

• access to personal data concerning you;
• rectification of inaccurate or incomplete data;
• erasure of data;
• restriction of processing;
• objection to processing based on legitimate interests;
• data portability where legally applicable; and
• withdrawal of consent where processing relies on consent, without affecting prior lawful processing.

Email support@openwebhook.co to exercise a right. We may need enough information to verify and locate a request. For the anonymous inspector, OpenWebhook normally cannot associate a person with a random UUID. For Pro accounts, we can locate account, endpoint, billing and forwarding-status records using the verified email address. We still cannot read webhook bodies from the server. An opt-in share may exist as ciphertext for up to 24 hours, after which it expires. Operational counters may retain a UUID or endpoint identifier and daily totals for a limited period. Local browser records remain under your control.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

11. Operational records

The application produces startup and unexpected-error logs for reliability and security. It is designed not to include webhook bodies, request headers, query strings, or UUID URLs in those logs. An internal operations panel is not public and is limited to the operator. Infrastructure providers may process basic network metadata as necessary to operate and protect their systems.

Spanish tax and accounting records related to purchases may need to be retained for the legally required period after account closure. Stripe event identifiers are retained for payment integrity and dispute handling. Verification and password-reset links expire automatically.

12. Changes to this policy

Material changes will be reflected on this page by updating the date above. The current version is always available at openwebhook.co/privacy.

13. Contact

Questions about this policy or personal data can be sent to support@openwebhook.co.