Privacy Policy

When you send a request from the API Tester, your browser posts it to Redline's server, which makes the actual HTTP request on your behalf and returns the response to you. That round trip happens in server memory only — Redline does not write your requests, responses, headers, or bodies to any database.

Your request history (method, URL, headers, body) is saved only in your browser's localStorage, capped at the last 15 requests. It never leaves your device except when you actively click Send, and it's gone if you clear your browser storage.

When you create an inbox, Redline generates a random, unguessable ID and stores it in a database. Any request sent to that inbox's ingest URL is captured in full — method, path, query string, all headers, the raw body, and the sender's IP address — and stored against that inbox ID so you can inspect it.

That data is kept until you clear it (removes the captured requests) or delete the inbox (removes everything, including the inbox itself). There is currently no automatic expiry — it's on you to clean up inboxes you're done with.

Because a captured request can contain anything a third party sends — including authorization headers, API keys, or other secrets embedded by whatever service you pointed at the inbox — treat your inbox contents as sensitive, and clear or delete them once you're done debugging. See the Security Policy for how that data is protected in the meantime.

Redline uses Google Analytics (GA4) to understand aggregate traffic — page views, referrers, approximate location, device type. No cookie is set and no visit data is stored against you until you accept the cookie banner; see the Cookie Policy for exactly which cookies that sets and how to change your choice at any time.

Analytics data is not linked to anything you do in the API Tester or Webhook Debugger — it only sees that a page was visited, not the requests or webhook payloads you send through the tools. Google retains GA4 event data for 14 months by default before it's automatically deleted, and acts as a data processor for that traffic under its own Privacy Policy.

• No account creation, no login, no password to leak.
• No analytics cookies are set, and no visit data is stored against you, unless you explicitly accept the cookie banner.
• No advertising cookies or ad personalization, ever.
• No selling, renting, or sharing of any captured data with third parties.

If that ever changes — for example, if we add sign-in or a second analytics tool — this page will be updated first.

Webhook inbox data is stored in a managed Postgres database (Supabase). Access is locked down at the database level: only Redline's own server can read or write it, using a credential that never reaches your browser. See the Security Policy for details.

If anything here is unclear, or you want an inbox's data removed and can't reach it yourself, reach out via the Contact page.