Webhook Inspector

Privacy Policy

Webhook Inspector has no accounts. It stores only what is needed to show you the requests sent to your URLs, and deletes it automatically.

Updated:

This policy covers webhook.voronyuk.com: the website, the web tool, the API, the CLI agent and the MCP server at /mcp used by AI assistants such as Claude and ChatGPT.

What we store

  • Session. When you open the tool, we create an anonymous session: a random token in a cookie (wi_session) and a public hash used in your URLs. There is no signup, and we do not ask for your name, email or any other personal data.
  • Your webhook URLs and their settings: name, custom response (status, headers, body, delay) and forwarding target, if you set one.
  • Captured requests: everything sent to your URLs: method, path, query string, headers, body (up to 1 MB) and the sender's IP address. Captured requests can contain personal data or secrets sent by third parties. Webhook Inspector stores them only so that you can inspect them.
  • Connected apps (OAuth): when you allow an app such as Claude or ChatGPT to connect, we store the app's self-reported name, its redirect addresses and hashes of the access tokens issued to it.
  • Preferences: the interface language (wi_lang cookie) and, in your browser only, UI settings such as the relay target.
  • Technical logs: the server and its proxy log connection metadata (IP address, time, status) and errors for security and troubleshooting.

We do not use analytics, advertising or tracking cookies, and we do not include third-party scripts.

How we use it

Only to provide the service: show captured requests to you and to the apps you connected, return the responses you configured, forward requests where you asked us to, enforce rate limits and protect the service from abuse. We do not sell data, profile users or use captured requests to train AI models.

Who can see your data

  • You, in any browser that has your session cookie or session link.
  • Apps you connected through the consent page, such as Claude or ChatGPT. They can read your URLs and captured requests and change their settings until you disconnect them. What an AI assistant does with the data it reads is governed by that assistant's own privacy policy.
  • Forwarding targets you configure. If you turn on forwarding or replay, the request is sent to the address you chose.

Knowing a webhook URL only allows sending requests to it, not reading them. We do not share data with third parties, except our hosting provider (Hetzner Online GmbH, Germany), which stores the servers, and when required by law.

Retention

  • Captured requests are deleted automatically after 72 hours, and each URL keeps at most the last 1000 requests.
  • Sessions with all their URLs and requests are deleted after 30 days without activity.
  • OAuth access tokens expire after one hour, refresh tokens after 30 days; disconnecting an app deletes its tokens immediately.
  • Server logs are rotated and kept for a limited time.

You can delete data at any time yourself: clear the requests of a URL, delete a URL or disconnect an app in the tool.

Security

All traffic uses HTTPS. Session and OAuth tokens are stored only as hashes. Responses of captured URLs are served in a sandbox, and the session cookie is never stored with captured requests.

Contact

Questions about this policy or a request to delete data: webhook-support@voronyuk.com. When writing about a session, include its hash (the first part of your URLs), never the session link.

Changes

We will update this page when the service changes what it stores. The date at the top shows the latest revision.