Privacy Policy

The app uses Firebase Authentication for account sign-in and Cloud Firestore for application records. Depending on how you use Hookk, records can include account identifiers, webhook URLs and settings, signing secrets, event actions and object types, payloads, delivery status, request attempts, response information, and usage counters. Do not include personal or sensitive information in event payloads unless you have an appropriate legal basis and safeguards.

API key management records key metadata; the full generated key is shown once when created. Stripe is used for paid checkout and billing portal flows. Hookk does not handle card details in the application interface.

The application uses account and configuration records to authenticate users, match events to webhook subscriptions, queue and record deliveries, show activity in the dashboard, enforce usage allowances, and support billing flows. A webhook request sends the event payload to the endpoint configured by the account owner.

Firebase provides authentication, database, and hosting-related infrastructure; Stripe provides billing services. The community page embeds App Page, a third-party service. When using the community, information is handled by that provider under its own terms and privacy practices. Confirm provider roles, regions, subprocessors, and data transfer terms before finalizing this notice.

If Google Analytics is enabled, Google receives page-view and related usage information, such as the page visited and browser/device information, to provide website analytics. Google may use cookies or similar technologies for this purpose and handles that information under its own privacy terms. Confirm the applicable consent, retention, and disclosure requirements before enabling analytics.

The current application records event and delivery history in Firestore. This draft cannot establish a complete retention period, deletion schedule, backup lifecycle, or account-deletion process. Document those practices with the service operator before publication and provide a monitored way to submit privacy requests.

Hookk uses authenticated accounts and API keys for access, and signs outbound webhook requests with endpoint-specific secrets. Users should protect their account credentials, API keys, and webhook secrets, and should verify signatures at their receiving endpoint. No internet service can promise absolute security; the actual technical and organizational safeguards need operator review.

Available rights and response timelines depend on applicable law. Add the operator identity, lawful bases, user rights, request process, complaint authority, and any required representative or contact details before publishing an approved policy.

The intended audience and age requirements must be set by the operator. Review this notice when the product, data practices, or applicable requirements change; include an effective date and describe how users will be informed of material updates.