Privacy policy

Last updated · October 2026 · demo build

Peekhook is a webhook inspection service. This demo build is operated by Redblock Software LLC and is intended for evaluation. This policy explains what the service stores and why, in plain language.

What we store

• Account data: email address, optional display name, a salted scrypt password hash, session records and plan state.
• Endpoint data: endpoint names, random URL slugs and optional response configuration.
• Webhook captures: method, path, query, headers, body (up to 1 MB), content type, size, inferred provider, source IP, response status and timestamps.
• Billing identifiers: Stripe customer and subscription IDs, subscription status, current period end and invoice metadata. Card data is collected and stored by Stripe, never by Peekhook.
• Push subscriptions: browser push endpoint and public encryption keys, if you enable notifications.

Retention

Captures are retained for 24 hours on the Free plan and 30 days on Pro. The public demo endpoint keeps only its most recent captures. Deleted captures are removed from the database; cached copies may persist briefly in backups. Share links expire after seven days on Pro (24 hours on Free) or when the capture is pruned, whichever comes first.

Cookies

Peekhook sets one essential cookie (peekhook_session) to keep you signed in. It is HttpOnly, SameSite=Lax and marked Secure on HTTPS. There are no advertising or analytics cookies in this build. A service worker cache may store app assets and recent API responses on your device; sign out clears the API cache.

Third parties

• Stripe processes payments, subscriptions and the customer billing portal.
• Infrastructure providers host the application and Postgres database.
• No webhook contents are sold or used to train models.

Security

Passwords are hashed with scrypt, sessions are random tokens stored only as hashes, and the app enforces same-origin JSON requests for state changes. Outbound replay requests are checked against private network ranges to prevent SSRF. No system is perfectly secure; report issues to hello@peekhook.dev.

Your choices

You can delete endpoints (and their captures) at any time, revoke share links, cancel subscriptions via the billing portal, and request account deletion by emailing hello@peekhook.dev. Deleting an account removes its endpoints and captures.

Contact

Questions: hello@peekhook.dev. This is a demonstration build; payments run in Stripe test mode and no live charges are made.