Privacy Policy for HookListener.com

1. Who We Are

You can contact HookListener.com through this link.

All HookListener.com servers and data are located in Europe.

2. Data Collection

By using the services provided by HookListener.com, you accept that the following data is stored:

For payment data handled by Stripe, please refer to their privacy policy. HookListener.com does not store or mirror payment information (e.g., credit card details).

3. Analytics

HookListener.com uses PostHog to collect and gather usage statistics. For more details, refer to PostHog's privacy policies.

4. Data Retention

• For data not associated with an upgraded account, all data automatically expires and may be deleted after 90 days.
• For data linked to paid HookListener.com subscriptions, the retention policy aligns with the Terms of Use (see Section 4.2).

5. Your Rights

You have the right to delete your data at any time.

• Single objects: Deletion buttons are available for individual objects.
• Entire account: Users can delete their account and all associated data permanently.

6. Where We Send Your Data

HookListener.com does not sell your data or share it with third parties for their own purposes. Service providers that run parts of the service, such as Stripe for payments and PostHog for usage statistics, process data on our behalf as described above. Other people receive your data only when you send it to them, for example a captured request you forward to a URL you choose or a share link you create (see section 8).

7. Data Protection

We implement technical and organizational measures to protect your personal and sensitive data from loss or misuse. Your data is stored in a secure operations environment that is inaccessible to the public. We employ industry-standard encryption to protect data during transmission.

While we take significant measures to safeguard your data, please note:

• There is always some risk involved in transmitting information over the internet.
• Despite our security systems, unauthorized access or breaches remain a possibility.
• By using HookListener.com, you acknowledge and accept these risks.

If you have questions about this Privacy Policy, contact us here.

8. Hooklistener Browser Extension

This section covers the Hooklistener browser extension for Chrome and Firefox. Data that the extension sends to HookListener.com is then handled as described in the rest of this policy.

What the extension does not do. The extension itself has no analytics, telemetry, crash reporting or advertising, and it does not read your browsing history, bookmarks or cookies. HookListener.com's own usage statistics (section 3) include actions you take through the extension on our servers, such as signing in, starting forwarding or sharing a request. We do not sell data from the extension or use it for advertising.

Sign-in and tokens. You sign in by entering a short code on the HookListener.com sign-in page. The extension then receives an access token and a refresh token and stores them in your browser's extension storage, together with the id and name of the organization you select. The tokens are sent only to the HookListener.com API (app.hooklistener.com) and the forwarding relay (api.hooklistener.com), over HTTPS or WSS. Signing out deletes them from the browser and asks HookListener.com to revoke the refresh token. Uninstalling the extension deletes them from the browser but does not revoke them, so sign out first. If you create a temporary webhook URL without an account, the extension stores the URL and a viewer token that lets it read the requests captured on that URL. These stay in your browser.

Data stored in your browser. The extension uses the browser's extension storage:

• Local storage keeps your settings (API hosts and notification choices), your sign-in session, the last organization you used, your temporary URLs and their viewer tokens, the selected endpoint, your forwarding targets, the sites you enabled for interception, your mock rules, and the ids and counts of recent requests used for the toolbar badge. This data stays until you remove it in the extension or uninstall the extension. Forwarding targets and the last organization are removed only when you uninstall.
• Session storage keeps requests recorded on intercepted tabs. It is held in memory and cleared when the browser closes.

This data stays on your device unless you use one of the features below that sends it.

Recorded page traffic (Intercept). Interception is off by default. You enable it one site at a time, and your browser asks for your permission for that site. On an enabled site, the extension records the page's fetch and XMLHttpRequest requests: method, URL, request and response headers, text bodies up to 64 KB, status and timing. It can also answer matching requests with mock responses you define. Recorded requests are kept per tab and removed when the tab loads a new page or closes, when you click Clear, or when the browser closes. You can turn recording off for a site and keep the mocks. Mock rules stay in local storage until you delete them. Recorded traffic is not sent anywhere unless you click its Send button (“Send to” followed by your endpoint's name).

Data sent when you use a feature.

• Requests, temporary URLs and notifications. The extension asks HookListener.com for your endpoints, captured requests and uptime monitors while the popup is open, and once a minute in the background for the badge and notifications.
• Sending a recorded request. The Send button sends the one recorded request you choose (its method, headers and body) to your HookListener.com capture URL, where it is stored like any other captured request. The page URL and the Cookie, Origin and Referer headers are not sent. Other headers are sent as recorded, including any Authorization header the page set.
• Forwarding to localhost. While forwarding is on, HookListener.com sends the webhooks captured on your endpoint to the extension, which delivers them to a server on your own computer (localhost or 127.0.0.1 only). The extension sends your local server's response back to HookListener.com: the status code, headers, body (up to 7 MB), the local URL it called, and how long it took. HookListener.com stores this with the request.
• Replay. Sends a captured request from your browser to your local server. The result is shown in the extension and is not sent to HookListener.com.
• Forward via HookListener.com. Sends the URL you enter to HookListener.com, whose servers deliver the captured request to that URL. The owner of that URL receives the request's contents.
• Share. Creates a link to a captured request and its forward results. Anyone with the link can view them until it expires after 7 days.
• Copy buttons. Copying a URL, a sign-in code, a share link or a request as a cURL command writes it to your clipboard. A cURL command includes the request's headers and body. The extension never reads your clipboard.

Notifications. The extension can show system notifications for new requests and for uptime monitor status changes. They show the endpoint or monitor name, the HTTP method, and the request path or monitored address, never a query string or credentials. A path that looks like it contains a token is hidden. Your operating system displays notifications and may keep them in its notification history. You can turn each kind off under Account in the extension.

Permissions. The extension can always reach HookListener.com and localhost. It asks for access to any other site only when you click “Intercept this site”, the first time you send a recorded request to a capture URL on another host, or when you save a custom API host. You can remove a site's access at any time in your browser's extension settings.

Retention and deletion. Data in the browser is kept as described above, and uninstalling the extension deletes all of it. Data sent to HookListener.com (captured requests, requests you send to an endpoint, forwarding responses and share links) follows the retention and deletion rules in this policy. You can delete it from your HookListener.com account.

Limited Use. The use of information received from the Hooklistener browser extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. In particular, HookListener.com:

• uses data from the extension only to provide and improve the features described above;
• transfers it only as needed to provide those features (including to recipients you choose, such as a forwarding URL or a share link), to comply with applicable law, to protect against malware, spam, phishing or other fraud or abuse, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent;
• does not sell it, use it for personalized advertising, or transfer it to advertising platforms, data brokers or other information resellers, and does not use it to determine creditworthiness or for lending;
• does not allow people to read it unless you have given your explicit consent, it is needed for security purposes such as investigating abuse, it is required by law, or it has been aggregated and anonymized for internal operations.