What we collect.

Analytics on this site

We use Google Analytics to see which pages help people get started — which guide, which use case, which post. Nothing is loaded until you accept the banner: every storage permission starts denied, so no analytics cookie is written to your browser before you say yes. Declining is remembered too, and we do not ask again.

If you accept, Google Analytics records the pages you visit, where you arrived from, a rough location derived from your IP address, and your browser and device type. It sets its own cookies (_ga and _ga_*) to recognise a returning visit.

We never enable Google's advertising features. The advertising permissions — ad_storage, ad_user_data and ad_personalization — are denied permanently and are not what the banner asks about. We do not sell anything to advertisers and we run no ads.

In the dashboard

The same measurement runs on app.zhooky.app under the same consent, with two deliberate restrictions. Page addresses are stripped of identifiers before they are reported — a hook page is recorded as /hooks/:id, never with the real id — and query strings are dropped entirely, because that is where one-time tokens live. Page titles are replaced with that same stripped path, so the names you give your hooks are not sent either.

We do not send Google an account identifier. Analytics cannot be tied back to your zhooky account by us or by them. The admin area is not measured at all.

Your webhook data

Requests sent to a hook — headers, bodies, everything — are stored on our own servers: PostgreSQL for the requests, self-hosted object storage for large bodies. Not in a third-party bucket, and never sent to Google. Requests are deleted after 7 days on the free tier, and a hook keeps at most 1,000 of them, so a busy hook's oldest requests are deleted sooner than that — sooner still if its inbox is turned off, which removes a request once its notifications are done rather than waiting on either number above.

When something breaks on our side, the error goes to Sentry — the only third party that ever hears about one of your requests, and then only when one fails. What it receives is an allowlist rather than a redaction: the error and its stack, the service name, and a request id we generated. Not your headers, not your bodies, not the query string, not a hook key, and not what a queued job was carrying. The Sentry SDK collects all of those by default; performance tracing is switched off and the list of what we let through lives in a reviewed file, so widening it is a visible change rather than a setting someone flips.

A hook key is a bearer secret. It is never written into the request path we store, and it never appears in a dashboard URL, which is why no analytics report can contain one. The FAQ covers what happens if one leaks.

In the mobile app

The app carries no analytics, no crash reporter and no advertising SDK. Nothing measures what you do inside it, and it never asks to track you across other apps, because there is nothing it would do with the answer.

Four things do leave your phone, and each is there to make a feature work:

• A push token. Apple or Google issues it for this installation and we store it so a notification can reach this device. It identifies an installation, not a person — reinstalling produces a new one, and removing the device in the app deletes the old one.
• Your e-mail address, but only if you attach one. An account starts anonymous. If you sign in with a magic link, Google or Apple, we keep the address so your hooks follow you to another device. The only e-mail we ever send to it is a sign-in link — there is no newsletter and no marketing.
• Your subscription state. If you subscribe in the app, RevenueCat handles the purchase on our behalf and we send it your account identifier so the subscription lands on the right account. We do not send it your e-mail address. Apple takes the payment; neither we nor RevenueCat ever see your card.
• The requests you receive. These are the webhook contents described above, and they reach the app the same way they reach the web inbox.

All of it is tied to your account, which is what makes it work — a notification has to know which phone to ring. None of it is shared with anyone for advertising, and none of it is sold.

Deleting your account from the app's settings removes the account, its hooks, its devices and the requests they hold. One record stays, and only if you ever paid: the log of what the payment provider told us, kept so a billing question has an answer. What deleting your account removes sets out both halves, and how to delete it if you cannot open the app.

Change your mind

Checking your current choice…

Turning it off stops any further measurement immediately. Cookies Google already set are cleared by your browser's own cookie controls.