Privacy · last updated 2026-10-06
Privacy policy.
There is very little here to have a policy about. No accounts, no tracking, and nothing you send is kept. This page sets out exactly what the service sees, and for how long.
The short version
- No accounts. No email address, name, password or third-party login is ever collected.
- No cookies. The service sets none. No local storage, no session storage, no fingerprinting.
- No analytics and no third-party scripts. Nothing on these pages is loaded from anybody else, so no third party gets to watch your visit.
- Nothing is saved. Captured requests are not written down, copied or archived anywhere. There are no backups, because there is nothing to back up.
- Automatic purge. A session and everything in it is destroyed 2 hours after its last activity, and whenever the service is restarted.
What is held, and for how long
Generating a session records three things: its random slug, when it was created, and when it was last used. When a request arrives at your endpoint, the service holds on to the following for as long as the session lives, and no longer:
- the HTTP method, path, query string and protocol version
- the request headers as sent
- the request body, up to 256 KB
- the network address the request came from
- the time of arrival and the captured size
Anyone who knows the session slug can see all of it. That is why the slug is unguessable, and why you should not hand it around. It is discarded as soon as any of these happens, whichever comes first:
- you clear the session history from the inspector
- newer captures push it out — each session keeps only its 30 most recent requests
- the session goes 2 hours with no request and no inspector open
- the service is restarted, which clears every session at once
No copy survives any of those. Once a capture is gone it is gone for good, including from our side.
Logs
What you send is not logged. Request payloads, headers, paths and session slugs never appear in any log we keep. The hosting provider that sits in front of this service keeps its own standard access logs, which record IP addresses and request lines in the ordinary way; that is outside our control and is true of any site you visit.
Sensitive data
Please don't send real credentials, access tokens, payment details or personal data to a SnapHook endpoint. This is a debugging tool on the open internet, and anyone holding your session URL can read what was sent to it. Use test-mode keys and made-up data. The promise not to keep your data protects you from us. It does not protect you from whoever else has your link.
Children
SnapHook is a developer tool with no user profiles and is not directed at children. No age information is collected because no personal information is collected.
Your rights
Nothing here is tied to a person, so there is no account to access, export or delete. If you want a session gone before it expires, clear it from the inspector. Closing the tab and waiting 2 hours comes to the same thing.
Changes
If this policy changes, the date at the top of the page changes with it. Material changes will not be applied retroactively to data already purged, since purged data cannot be recovered.
Contact
Questions about this policy, or a report of abuse of the service, can be raised by email — the address is on the contact page. The terms of use describe what the service may not be used for.