Privacy and retention

HookFork stores account details, encrypted provider credentials, webhook payloads, resource relationships, and delivery history.

The tenant owner controls project access. The operator can access infrastructure for support and recovery. HookFork does not claim end-to-end encryption or certification.

Retention contract

Terminal payloads have a seven-day default. Pending or paused payloads remain held until resolution or an explicit owner expiry. Event metadata, delivery records, and deduplication records remain until the operator explicitly deletes the tenant.

Minimal relationship evidence also remains until tenant deletion. The service does not infer safe retirement from current Subscription state or event order. Retained metadata counts against the tenant event limit. It cannot recreate an expired payload.

Account creation stores an email and password hash. Email verification is not enabled. A one-time recovery code supports account recovery. Billing records bind only this tenant to Stripe payment objects. Processed billing payloads expire after 30 days; billing bindings remain until tenant deletion. Legacy access requests expire after 30 days.

The operator handles infrastructure recovery and deletion requests, not commercial access approval. Backup retention remains separate.

Website analytics

The public home page uses the operator's self-hosted Umami service for aggregate visit statistics. Umami collects page visits and technical browser data. The tracker excludes URL queries and fragments and respects Do Not Track.

The tracker uses no analytics cookies. It does not run on account, billing, dashboard, invitation, recovery, or documentation pages. HookFork sends no form values, account identifiers, webhook data, or custom events to Umami.

Infrastructure

HookFork uses Stripe, Cloudflare, and the operator's Kubernetes infrastructure. Infisical supplies infrastructure secrets. Source and destination applications retain their own data responsibilities.

Payment access and technical source verification are separate. Verify your source and receiver before a production cutover.