Know what happens to your data.
No advertising or tracking analytics. Here is what stays on your device, what we store, and when it expires.
Local browser tools
Formatters, encoders, generators, and file checksums marked as browser-local process input on your device. Their inputs, secrets, and results are not sent to socket.help.
Using the same utility through the API, SDK, CLI, SSH, or MCP sends your input to a bounded server processor. Input and results are not retained as execution history.
Temporary resources
Webhook inboxes store incoming methods, paths, headers, query parameters, bodies, and timestamps for inspection. Header names containing authorization, cookie, token, API key, secret, or password markers are redacted before storage. Bodies and query parameters are preserved and may still contain sensitive data.
Mock API and mock MCP configurations, captured webhook data, and uploaded files are stored in PostgreSQL. Resources start with one-hour lifetimes, with longer retention available within plan limits. Expired resources become inaccessible immediately; cleanup runs every minute.
Files are limited to 10 MiB. The final allowed download removes the stored contents; lifecycle metadata remains until expiry or deletion. Downloads are forced attachments. Files are not scanned for malware.
Sharing and credentials
New resources default to private. Private callers need a distinct access token or current workspace access. Public endpoints work for anyone who knows the link. Anonymous management tokens control management, not private download access.
Tokens are stored on the server as hashes. Rotating a sharing token revokes the old token. Private file links contain only a resource ID; share the access token separately.
What your browser remembers
This tab’s session storage keeps current inboxes, mock APIs, file shares, and their credentials so refreshes work. Deleting a resource clears its saved access. Stale saved sessions are ignored.
We do not use tracking cookies. Signing in sets a seven-day HttpOnly, SameSite session cookie. Signing out or switching workspaces clears saved tool credentials in this browser’s open tabs. Shared tokens remain valid until rotated, exhausted, or expired.
Accounts, recovery, and billing
Accounts store a username, signup email, password hash, workspace memberships, hashed credentials, and usage counters. Only a verified email address can be used for password recovery.
Email verification and reset codes expire after 15 minutes. Queued email contents are encrypted until sent or expired. The configured email provider delivers account messages. Delivery is available only after an operator configures SMTP.
When billing is configured, Dodo Payments handles card details. The app stores Dodo Payments customer and subscription identifiers and verified entitlement state.
Operational records and backups
Application logs contain request IDs, HTTP methods, route patterns, response codes, and timings. They exclude webhook bodies, query values, and authentication tokens. IP addresses are hashed for short-lived rate-limit records.
Resource lifecycle events retain metadata for 30 days and exclude payloads. Hosting providers may retain network access logs. Operators control infrastructure logging and backup retention; deleting live data does not immediately erase an existing backup.
Privacy questions and requests
Email [email protected] for questions about processing or to request access, correction or deletion of account information. Contact us from your account email where possible; we may need to verify ownership before sharing or removing private information. Do not email passwords, API keys or sharing tokens.
Resource deletion removes live content under the published lifecycle. Backups may retain earlier copies until their retention period ends. See contact and support for reporting guidance.
Limits and deletion
You can delete a resource before it expires. Expired data is removed during cleanup and cannot be restored through the app. When an inbox reaches its history limit, existing history stays available and further captures are rejected.
Anonymous inboxes hold up to 100 requests or 1 MiB, with a 100 KiB body limit. Account inboxes hold up to 1,000 requests or 10 MiB. Storage, creation, and hosted execution quotas vary by plan. Public endpoints and total installation capacity have additional limits.
Read the plans and limits before a workflow depends on a resource. Use sample data for testing and keep an independent copy of anything important.