Privacy Policy

The operator (the "Operator") of Hookbako (the "Service") handles information about users of the Service in accordance with the following policy.

1. Information Collected

The Service collects the following information. The Service has no account registration feature and does not ask users to enter their name, email address, or similar information.

• Contents of requests received by an inbox: The method, path, query, headers, body, sender's IP address, sender's country or region, and date and time of receipt of requests sent to the receiving URL.
• Information entered by users: Inbox names, response settings, and notes attached to requests.
• Viewing keys: Keys used to open inboxes are converted to a non-recoverable form (a hash value) before storage. The keys themselves are not stored.
• Access logs: When the Service is accessed, information such as the IP address, date and time, accessed URL, and browser type is recorded within the delivery infrastructure (Cloudflare, described below).

Secrets entered for signature verification are used only within the user's browser and are not sent to the Service's server.

2. Purposes of Use

The collected information is used only for the following purposes.

• To display received requests to the users of the inbox
• To provide the Service reliably, investigate issues, and make improvements
• To prevent and respond to misuse and attacks on the Service
• To respond as required by law

The Operator does not view the contents received by inboxes, except where required by law or necessary to respond to misuse.

3. Retention and Deletion

• An inbox and the requests it has received are automatically deleted 7 days after the inbox is created.
• Users can delete individual requests, all requests, or the inbox itself at any time from the inbox page.
• Because of recovery mechanisms maintained in case of failures, deleted information may remain in the system for a while after deletion (approximately 7 days).
• Access logs are deleted after being retained for a certain period within the delivery infrastructure.

4. Disclosure to Third Parties

The Operator does not provide collected information to third parties except in the following cases.

• Where required by law
• Where necessary to protect a person's life, physical safety, or property, and obtaining that person's consent is difficult
• Where processing is entrusted to the external service described below to the extent necessary to provide the Service

Anyone who knows the URL containing the viewing key can see the contents of the inbox. Users are responsible for managing this URL.

5. Use of External Services

• Cloudflare (Cloudflare, Inc.): Used to deliver the Service, store data, and prevent unauthorized access. Collected information is processed and stored on Cloudflare's systems.

The handling of information by this external service is governed by Cloudflare's privacy policy. Fonts used to display text are served by the Service itself; no external font delivery service is used.

6. Cookies and Similar Technologies

The Service does not use cookies or mechanisms for storing information in the browser. It also has no analytics tools or advertisements.

7. Security Measures

The Operator takes necessary and appropriate measures to prevent the leakage, loss, or damage of collected information, including encrypted communications (HTTPS), protection with viewing keys, and limits on retention periods.

8. A Request to Users

The Service is a testing tool. Do not send requests containing information that should be kept confidential, such as passwords, credit card numbers, or other people's personal information.

9. Requests for Disclosure, Correction, or Deletion

Because the Service has no account registration feature, the Operator may not hold information that can identify a user. Users can delete inbox contents themselves from the inbox page. For other requests, please use the contact details below.

10. Revisions

The Operator may revise this policy as needed. The revised policy takes effect when posted on this page.

11. Contact

For questions about this policy or reports of misuse, please contact @fourgetkun on X (formerly Twitter).

As the Service is operated by an individual, replies may take some time. Depending on the nature of the inquiry, a reply may not be possible. Thank you for your understanding.

Established: September 24, 2026
Operator: fourgetkun