Privacy
What is stored, where it lives, and when it is deleted. Written as specifics rather than reassurance.
The short version
No analytics, no cookies, no third-party scripts, no advertising, no account. 14 of the 20 tools transmit nothing anywhere, because they have no endpoint to transmit to. The 6 that need a server say so on their own pages, in the words that are true of them.
Stored on your device
All of it in localStorage, all of it cleared by clearing site data for this domain. None of it is readable by us.
| What | Why | Kept |
|---|---|---|
| Theme preference | So the site does not flash the wrong colours on load. | until cleared |
| API tester history | Method, URL, status and timing only. Credential-shaped query parameters and any user:password in the URL are replaced with REDACTED before writing. | last 25 |
| Webhook and mock manage tokens | Proof that you created a session. Held only in your browser; the server keeps a hash and cannot recover the token. | until the session expires |
Stored on a server
Two things, both temporary, both deleted by expiry rather than by a cleanup job you have to trust.
| What | Detail | Kept |
|---|---|---|
| Captured webhook requests | Headers, query, body and an approximate sender address. The last octet of an IPv4 address is zeroed before storage; IPv6 keeps only the /48 prefix. | 60 minutes |
| Mock definitions and request logs | What you defined, plus the last 50 requests your mock answered. Sender addresses truncated the same way. | 24 hours |
Both can be deleted immediately from their own pages, and both are reachable only with the manage token held in your browser.
Never stored
- Credentials, bearer tokens, API keys or private keys of any kind.
- Request or response bodies passing through the API tester. They are forwarded and returned to you; nothing is written down on the way through.
.envcontents. That tool never makes a network request at all — the file is read by your browser and never uploaded.- The URLs you submit to the header checker, OG inspector or diff. They are fetched and the result is returned; no log of what was asked for is kept.
One thing worth knowing
A webhook URL and a mock URL are public by necessity — a provider or your own client has to be able to call them without credentials. The identifiers are random and unguessable, and both expire on their own, but anyone holding the URL can send to it or read what a mock returns. Do not put anything in a mock response body that you would mind a stranger reading.
Fonts and hosting
Fonts are served from this domain, not from a third-party CDN, so using the site makes no request to anyone else. Hosting is on Vercel, which processes requests to operate the site; there is no analytics or advertising product attached to it.