Privacy Policy
Last updated: September 13, 2026
This policy explains what data Railhook Cloud, the hosted service at railhook.io, processes and why. It does not cover copies of Railhook you run on your own servers: there, you are the operator and your data never reaches us.
Who we are
Railhook is an open-source webhook gateway released under the MIT license. Railhook Cloud at railhook.io is operated by the project maintainer. You can reach us at [email protected].
What we process
- Account data: your name, email address, organization name and a hash of your password — or, if you sign in with Google, your Google account identifier instead of a password.
- Webhook data: the payloads, headers and delivery attempts you send through the service.
- Technical logs: IP address, user agent and request metadata.
We do not process payment data. There are no paid plans yet.
Why we process it
- To provide the service: receive, store and deliver your webhooks and show you their history.
- To keep it secure and prevent abuse, including a Cloudflare Turnstile check when you register.
- To send transactional email: address verification and password reset.
Sign in with Google
If you choose to sign in with Google, we request only the openid, email and profile scopes. We use the name, email address and account identifier Google returns only to create your account or sign you in. We do not use Google user data for advertising, do not sell or transfer it, and do not use it for any other purpose.
Railhook's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it
- Webhook events on the Free plan are kept for 7 days.
- Account data is kept until you delete your account. You can delete it in the product.
- Backups roll over, so deleted data leaves them over time.
Who processes it for us
- Hetzner — hosting, in the EU (Helsinki).
- Cloudflare — CDN, DNS and the Turnstile check.
- Resend — transactional email.
- Google — only if you choose to sign in with Google.
What we do not do
We do not sell your data, and we do not use advertising trackers.
Your rights
You can ask for a copy of your data, have it corrected, or have it deleted by writing to [email protected]. You can also delete your account yourself in the product.
Changes
When this policy changes, we update this page and the date at the top.
Contact
Questions about this policy: [email protected].