What Hookscope stores, and why.
Webhook payloads
Every request sent to an inbox URL is stored as-is: method, headers, body, and query string. The authorization and cookie headers are redacted before storage. Anonymous inboxes (no account) expire automatically after 48 hours. Inboxes attached to an account are kept until you delete them.
Account & session
If you create an account, we store your email and a hashed password. Signing in sets a session cookie used to keep you authenticated — this cookie is essential to the product and isn't part of the consent choice below.
Analytics
We use Vercel Analytics to understand aggregate traffic (page views, referrers). It doesn't use cookies or persist a per-visitor identifier, and it only runs after you accept the cookie banner. Declining, or not answering, keeps it off.
Replay
When you replay an event, the stored payload is sent from our server to the destination URL you provide. We don't send it anywhere else.
Questions
Reach out at jiordiviera.me.