Privacy policy

This policy explains what Tapwire, operated by the operator of Tapwire, collects, why, how long it is kept, and how you can delete it. Tapwire is designed to keep as little as possible for as short a time as possible.

What we collect

Requests sent to receiving URLs

When someone sends an HTTP request to a Tapwire receiving URL, we store the method, path, query string, headers, content type, body (up to the published size limit), body size, time of receipt, and the sender's IP address and approximate country. This is the core function of the service: it lets the endpoint's owner inspect the request.

Requests can contain personal data or secrets if the sender includes them. Do not send data to Tapwire that you are not allowed to share with a third-party service, and do not use it with production credentials or real customer data.

Endpoints

For each endpoint we store its ID, creation and expiry times, any custom response you configure, a one-way hash of its inspector key, and a keyed one-way hash of the IP address that created it. The creator hash is used only to enforce creation limits and cannot be reversed into an IP address without our secret key.

Your browser

The inspector stores endpoint IDs, inspector keys and your theme preference in your browser's local storage. They stay on your device. Tapwire does not set cookies.

Infrastructure logs

Tapwire runs on Cloudflare, which processes network traffic and keeps operational logs as described in Cloudflare's own privacy policy. Our application logs record errors without request bodies, headers or inspector keys.

What we do not do

• We do not sell data or share captured requests with third parties, except as required by law.
• We do not use captured requests for advertising, profiling or training models.
• We do not use analytics or tracking scripts.
• We do not show advertising in the inspector.

How long data is kept

• Endpoints and every request captured by them are deleted automatically 72 hours after the endpoint is created. Deletion runs on a schedule every 30 minutes, so data may remain for up to about 30 minutes after expiry.
• Only the newest 100 requests per endpoint are kept. Older ones are deleted as new ones arrive.
• You can delete single requests, clear the history, or delete an endpoint at any time from the inspector.
• Deleted data cannot be recovered.

Who can see captured data

Captured requests can be read by anyone who holds the endpoint's inspector key: you, and anyone you share the private inspector link with. Treat that link like a password. The receiving URL itself only lets people send data, not read it.

Security

Traffic is encrypted with HTTPS. Endpoint IDs and keys are generated with a cryptographically secure random number generator, and only hashes of keys are stored. Responses from receiving URLs are sandboxed so they cannot run code on this site. No system is perfectly secure, so avoid sending sensitive data.

Advertising

Tapwire currently shows no advertising. If advertising is introduced on informational pages in the future, this policy will be updated before it is enabled to describe the advertising provider, its cookies and your choices. Advertising will never be placed in the inspector or near captured request data.

Your rights

Depending on where you live, you may have rights to access, correct or delete personal data. Because Tapwire has no accounts, the fastest way to exercise them is to delete data directly in the inspector. If you cannot, contact us through the contact page with the endpoint ID.

Children

Tapwire is a developer tool and is not directed at children.

Changes

We will update this page when our practices change and revise the date at the top.