Privacy Policy

Websnag is a webhook debugging tool built for developers. We take a straightforward approach to privacy: we collect only what we need to provide the service, we are transparent about what that includes, and we delete it on a clear schedule.

What We Collect

Account information

When you sign up, we store your email address and basic profile information provided through GitHub OAuth or magic link authentication. This includes your username and user ID managed by Supabase Auth.

Webhook data

When an external service sends a request to your Websnag endpoint, we capture and store:

• HTTP method (GET, POST, PUT, etc.)
• Request headers
• Request body (up to 1 MB)
• Query parameters
• Content type
• Source IP address
• Payload size in bytes
• Timestamp of receipt

This is the core of what Websnag does. Without storing these fields, we cannot show you what your webhooks contain.

AI analysis results

When you request an AI analysis of a webhook payload, the analysis output (source identification, event type, summary, key fields, and generated handler code) is stored alongside the original request so you can reference it later.

Usage and billing

We track monthly request counts and AI analysis counts per account to enforce plan limits. If you subscribe to the Pro plan, we store your Stripe customer ID and subscription ID. We do not store credit card numbers or payment details directly — Stripe handles that.

How We Use Your Data

• Display captured webhook requests in your dashboard so you can inspect and debug them.
• Provide AI-powered analysis of webhook payloads when you request it.
• Enforce plan limits (endpoint count, request volume, AI analysis quota).
• Process payments through Stripe for Pro subscriptions.
• Send transactional emails related to your account (authentication, billing).

We do not sell your data. We do not use your webhook payloads to train AI models. We do not serve ads.

Data Retention

Webhook request data is automatically deleted based on your plan:

Deletion is handled by an automated job that runs on a regular schedule. Once the retention window passes, the request data (including headers, body, query parameters, source IP, and any AI analysis) is permanently removed.

Account information and subscription records are retained as long as your account exists. If you delete your account, all associated data (endpoints, requests, usage records, and subscription info) is permanently deleted.

Third-Party Services

Websnag relies on the following third-party services to operate. Each has its own privacy policy governing how they handle data:

• Supabase — Database hosting, user authentication, and real-time data delivery.
• Stripe — Payment processing for Pro subscriptions. Stripe receives your payment details directly; we never see or store card numbers.
• Anthropic (Claude API) — AI-powered webhook analysis. When you request an analysis, the webhook method, headers, and body are sent to Anthropic for processing. Anthropic does not use API inputs to train their models.
• Vercel — Application hosting and serverless function execution.
• Upstash — Rate limiting via Redis to protect the service from abuse.

Your Rights

You can:

• Delete individual requests or bulk-delete requests from your dashboard at any time.
• Delete your endpoints, which permanently removes all associated request data.
• Export your data by downloading request history as JSON from the dashboard.
• Delete your account to permanently remove all your data from our systems.
• Contact us with questions about your data or to request its removal.

Contact

If you have questions about this privacy policy or how your data is handled, reach out at privacy@websnag.dev.