Privacy Policy

We collect the following categories of information:

• Account information from GitHub OAuth: your name, email address, avatar URL, and GitHub user id, retrieved when you sign in.
• Billing metadata from Stripe: Stripe customer id, the last four digits and expiry of the card on file, and your current plan. We never store the full card number on our servers.
• Service usage data: the HTTP method, URL, headers, and body of incoming webhook requests. Bodies are stored in Cloudflare R2 and metadata in Cloudflare D1, subject to the retention rules in §5.
• Subscription and session metadata: session ids and client type (VS Code extension / CLI) used to deliver webhook payloads to active clients in real time.

Webhook payloads delivered to your endpoints frequently originate from third parties (for example, other SaaS providers calling your webhook URL). Such payloads are treated as your content.

For any personal data contained in those payloads, you remain the data controller and Oh My Hooks acts as a processor that stores and forwards them on your behalf, subject to this Privacy Policy.

Access, correction, or deletion requests from third parties whose personal data you pipe through the Service must be handled by you. We will cooperate to the extent technically feasible.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Deliver incoming webhook payloads to your subscribed clients
• Process subscription payments and send billing notices
• Respond to support inquiries
• Detect and prevent abuse of the Service

We use Stripe as our payment processor. When you provide payment information, it is transmitted directly to Stripe and subject to Stripe's Privacy Policy. We receive only limited payment information (such as the last four digits of your card and its expiration date) from Stripe.

• Ephemeral webhooks (including anonymous webhooks): request payloads are never persisted — they are forwarded to subscribed clients and discarded. Webhook records themselves expire 24 hours after creation; anonymous webhooks are additionally deleted as soon as the WebSocket session ends.
• Persistent and custom-URL webhooks: source request bodies and metadata are retained for the history window of your plan (currently 30 days for paid plans) and pruned by a scheduled job thereafter.
• Forward results: the HTTP responses returned by your destination endpoints are not persisted server-side. They are surfaced only in your local client UI.
• Account and billing data: retained while your account is active, and for additional periods as required by Japanese tax and accounting law.

We rely on the following sub-processors to operate the Service:

• Cloudflare, Inc. — Workers, D1, R2, and Durable Objects (storage and compute infrastructure).
• Stripe, Inc. — payment processing. See Stripe's Privacy Policy.
• GitHub, Inc. — OAuth identity provider.

We use cookies only for essential functionality such as authenticated sessions. We do not use advertising trackers. If we introduce analytics in the future, this section will be updated.

We implement appropriate technical and organizational measures to protect your information, including TLS in transit, access controls on internal systems, and encryption-at-rest provided by Cloudflare.

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account

Deleting your account also removes your webhooks and any stored request history.

The Service is global. Your data may be processed in Cloudflare regions outside Japan. By using the Service, you consent to such cross-border processing.

We may update this Privacy Policy from time to time. Material changes will be announced on this website and reflected in the “Last updated” date above.

If you have questions about this Privacy Policy, please contact us at oh-my-hooks-support@satetsu888.dev.