Your webhooks are sealed before we ever see them.

What leaves your Mac

• The relay: a WebSocket connection authenticated with your account token, used to receive events and send acknowledgments. Provider secrets never leave your Mac; only the token that identifies your account and device does.
• Sign-in email: to sign in, your email address goes to the relay, which emails you a six-digit code through Resend, an email delivery service. Resend receives your address and the message with the code in it, nothing else. Verifying the code goes to the relay only.
• License validation to Polar: your license key and an activation ID, at most once per day.
• Update checks: about once a day, WebhookMon asks updates.uresk.net whether a newer version exists. The request says which version of WebhookMon you have and one word for its license state: in trial, licensed, trial ended, or license needs attention. We add that to a daily count per version and state — that count is all we keep. We don't store your IP address or anything else that could tell your Mac apart from anyone else's. Updates themselves still download from GitHub. You can turn off automatic update checks on the License tab of WebhookMon → Settings (Check for updates automatically).

Forwarding a webhook to your local server is a direct connection from your Mac to the address you configured; it does not pass through anything we operate.

The relay

The relay (hooks.getwebhookmon.com) receives webhooks from providers and delivers them to your Mac. It stores:

• Per event: one ciphertext copy per device, sealed with HPKE to that device's public key before it's ever written. The relay never holds a private key and cannot read an event. A copy is deleted when your device acknowledges it, after 24 hours, or earlier if per-endpoint storage caps evict it — in which case your device is told how many events it lost.
• Per account: your email address, your devices' public keys and names, hashed copies of account tokens, your endpoints' ids and names, and whether you opted in to release announcements.
• Daily usage per account: how many events your endpoints have counted against your account's daily limit, one number per day. Endpoints count in blocks (of 50, then 5, then 1 as your account nears its limit), so it can run up to a few hundred events ahead of the events actually received. Each day's number is deleted once the day is more than two days past, and when you delete your account (if that step fails, the two-day purge still removes it).
• Sign-in codes: the email address entered and a hashed copy of the code, kept only long enough to redeem or expire. A code stops working after ten minutes, and unverified sign-in rows are purged within two hours.
• A count of new accounts: when an account is created, the relay tells EventBar, our own notification service, that it happened. That message carries no email address, account id or device detail, only that a new account exists, so we can see sign-ups without looking at the database.
• Per endpoint: its id, your account id, when it was created, when one of your Macs was last connected to it (updated at most once a day), when it was paused if it is paused now, your devices' ids and public keys, and for each device how many events were dropped, refused or expired since it last connected and whether it has been told about a pause or about your account reaching its daily limit, so your Mac can tell you what it missed.
• Counters: events per minute and per day for each endpoint, and each day how many events the endpoint has counted against your account's daily limit and whether the account reached it, for the limits that keep the service usable for everyone.
• Nothing else. No IP address or user agent is stored outside the ciphertext, and there's no analytics on the relay itself.

This website

getwebhookmon.com is hosted on Cloudflare Pages. It uses Google Analytics to measure visitor counts and referral sources; the app and the relay do not. Purchases are processed by Polar, whose privacy policy governs checkout.

The provider request form

The provider request form is the one part of this site that stores anything you type. When you send it, we keep:

• What you entered: the provider's name, and the link and your email address if you gave them.
• When and from where: the time, and whether the form was opened from this website or from the app (and then which screen and which version of the app). The app only opens the page in your browser; it sends nothing itself, and nothing from your webhooks.
• Nothing else. No IP address or user agent, and no link to a WebhookMon account.

Requests are kept in a database of their own, separate from the relay's. Each request is also emailed to us through Resend, the service that sends sign-in codes, which receives the same fields. Cloudflare Turnstile checks that a person is sending the form; it runs in your browser and is covered by Cloudflare's privacy policy. We use your email address only to tell you that the provider shipped or to ask you about it. To have a request deleted, email [email protected].

What stays on your Mac

Your device's private key, account token, provider signing secrets and license are stored in the macOS Keychain under com.suresk.webhookmon. Captured events, headers, verdicts and delivery history are stored in a local SQLite database at ~/Library/Application Support/WebhookMon/events.sqlite and are never uploaded anywhere by WebhookMon.

Contact

Questions? Email [email protected].