Privacy and retention

Short version: your secrets are stored encrypted, the content of your events is not stored at all, and one button deletes everything.

What is stored

• The address of your channel and your Stripe signing secret, encrypted with a key kept in a vault that the application code can use but cannot read. The dashboard never shows them again, only the last characters of the address.
• Your rules and a few counters: events received, delivered, refused.
• A journal line per event: the Stripe event id, its type, the title of the message (which contains the amount), the amount and currency, and what was done with it. Kept 30 days, and at most the 200 latest per connection.

What is not stored

• The body of the events: customer names, email addresses, card details and metadata pass through to write the message and are not kept.
• Any Stripe API key. None is asked for.

Who can open a dashboard

Whoever holds its private link. The key is in the part of the link after the #, which browsers do not send to servers; only a hash of it is stored. There is no way to recover a lost link: create a new connection and delete the endpoint in Stripe.

Deleting

"Delete this connection" on the dashboard removes the connection, its secrets and its journal at once. A connection that received no event and was not opened for 90 days is deleted automatically.

Measurement

The site counts visits and a few actions (a test sent, a connection created) with a first-party cookie, without any third-party tracker. The counts cannot be traced back to a person.