Privacy Policy

Effective: 2026-05-05 · Last updated: May 5, 2026

This policy explains what data Webhook Notifier (the "Service") collects, why, where it goes, and how long it is kept. The Service is operated by Alltrons B.V. ("Alltrons", "we", "us"), alltrons.com, registered in the Netherlands.

1. Who is the data controller

Alltrons B.V. is the data controller for the personal data described below. For questions, requests, or to use any of the rights listed in §10, contact [email protected].

2. What we collect

Data you generate by installing and using the app

  • Device identifier. An opaque random UUID we generate on first launch. Stored on the device and on our server. It is not your Apple ID, IDFA, advertising ID, or hardware identifier.
  • Push notification token. On iOS this is your APNs token. On Android it is your FCM registration token. Used only to deliver pushes to that device.
  • Device label. A short two-word nickname like "Calm Otter", picked at random on first launch. You can rename it from Settings. The owner of any webhook you subscribe to sees this label in their subscribers list.
  • Bearer token (hashed). A 256 bit secret generated on the device on first launch. We store only an Argon2id hash plus a non secret lookup index. The plaintext never leaves the device.

Data you create by using the Service

  • Webhook configuration. The name you give a webhook, the HTTP methods you allow, optional header and body match rules, and your time window, sound, volume, and bypass silent preferences.
  • Webhook secret (hashed). Created when you create a webhook. Stored only as an Argon2id hash. The plaintext is shown to you once and never persisted.
  • Webhook subscriptions. Which devices have joined which webhooks.

Data third parties send to your webhook URL

  • The HTTP method, request headers (with Authorization, Cookie, and Proxy-Authorization stripped before storage), and request body, capped at 64 KB. Stored as the audit log of incoming events so you can review past events in the app. You control what is sent here by configuring the system that calls the webhook. Do not put data in the body that you would not want logged on our server.

3. What we do not collect

  • No advertising identifiers (IDFA, GAID).
  • No analytics SDKs (Google Analytics, Firebase Analytics, Mixpanel, etc). FCM is used only for push delivery on Android.
  • No location data.
  • No contacts, calendar, photos, or other personal data on the device.
  • No tracking across apps or websites.
  • No demographic data, age, gender, or anything you did not enter yourself.

4. Why we collect it (lawful basis)

Under GDPR our lawful basis is performance of a contract (Art. 6(1)(b) GDPR). We collect what we need to provide the notification service you have asked us to provide. There is no legitimate interest, consent, or marketing processing.

5. Where the data lives

  • Our server hosting the API and database is in the European Union. The provider may change. Data does not leave the EU as a result of our routine operations.
  • iOS push delivery. The APNs token plus your alert payload travel through Apple's APNs infrastructure in transit. Apple is the processor for that hop.
  • Android push delivery. The FCM token plus your alert payload travel through Google's Firebase Cloud Messaging in transit. Google is the processor for that hop. The payload contains the webhook name and a body excerpt.
  • DNS for webhook-notifier.com is hosted by Cloudflare. Cloudflare sees only DNS resolution traffic. No application data.

6. Who else sees the data

No third party processors beyond §5. We do not sell, share, rent, or trade any of the data.

7. How long we keep it

  • Device record, push token, bearer hash. Until you delete the device from inside the app (Settings > Sign out), or until the device has not opened the app in 12 months, whichever comes first. After that the device record and all subscriptions tied to it are deleted.
  • Webhook configuration and secret hash. Until you delete the webhook, or until the device that created it is deleted.
  • Audit log of incoming events. The most recent 30 days, then automatically pruned. Earlier than that you cannot see past events either.
  • Backups. Encrypted nightly database backups, retained 14 days, then permanently destroyed.

8. Security

  • All API traffic is over HTTPS (TLS 1.2 or higher). HTTP is permanently redirected.
  • Bearer tokens and webhook secrets are stored as Argon2id hashes. A full database dump does not yield plaintext credentials.
  • Authorization headers on incoming webhook requests are not written to logs.
  • Server access is restricted to SSH key authentication. The database is not exposed to the public internet.
  • The mobile clients pin to bundle identifier eu.dl0.webhook and use ATS or Network Security Config to prevent cleartext fallback in production.

9. Children

The Service is not directed at children. We do not knowingly process data from anyone under 16. If you are a parent and believe your child has registered a device, write to [email protected] and we will delete the record.

10. Your rights (GDPR)

If you are in the EU or EEA you have the right to:

  • Access. Ask for a copy of the data we hold about your device.
  • Rectification. Correct any data you cannot edit yourself in the app.
  • Erasure. Have it deleted. This is also one tap inside the app under Settings > Sign out.
  • Restriction of processing.
  • Portability. Receive an export of your audit log and webhooks in JSON.
  • Object to processing.
  • Lodge a complaint with your supervisory authority. For Alltrons that is the Dutch Autoriteit Persoonsgegevens.

To use any of these rights write to [email protected]. We respond within 30 days.

11. Changes to this policy

If the policy materially changes we publish the updated version here and bump the Effective date at the top. Trivial corrections are made silently.

12. Contact

Alltrons B.V.
alltrons.com
Privacy contact: [email protected]
Support contact: [email protected]
Security contact: [email protected]