Privacy Policy

Last updated: 14 August 2026

This policy explains what apipreflight.com (operated by Phillip Wilson, a sole trader in Australia) collects about you, why, and what you can do about it.

The short version

• You can use the basic Service without an account and without giving us your name.
• We do not sell your data, and we do not run advertising trackers.
• We collect the minimum needed to run the Service: an email if you sign up, the mocks you create, and limited technical logs.
• Calls to your mocks are logged for 30 days so you can inspect them. Credentials in headers are redacted before storage, and response bodies are never stored.
• You can ask us for a copy of your data, or ask us to delete it, at any time.

What we collect

If you create a mock without an account

We store the mock definition itself (method, path, status, headers, response body, delay) and the time it was created. We do not ask for your name or email, and calls to these mocks are not request-logged. The mock is deleted automatically 7 days after creation.

If you create an account

We store your email address and authentication details (handled by Supabase — we never see your password), plus the mocks, collections and settings you create. If you subscribe to a paid plan, Stripe stores your billing details and sends us your subscription status, customer identifier and the last four digits and brand of your card. We never receive or store your full card number.

Requests made to your mock endpoints

This is the part specific to a service like ours, so it deserves plain language. When an application calls one of your mock URLs — on apipreflight.io or on a domain of your own — we process that request in order to answer it, and we may record details of it — method, path, query string, headers, body, the response we returned and how long it took — so that you can inspect it in your dashboard.

Whatever your application sends to a mock endpoint may be stored in those logs. If your app sends real customer data to a mock, that data lands in our logs. Please point mocks at test data only.

Precisely, for a mock saved to an account, each call records:

Logging applies to mocks saved to an account, on every plan — your plan changes how much history the dashboard shows you and whether you can export it, not what is recorded. Mocks created without an account are not request-logged at all. You can clear a mock's log yourself at any time, and deleting a mock deletes its log with it.

Sequences

If you use response sequences, we store a counter per caller so consecutive calls can advance through the sequence. The caller is identified by an X-Mock-Session header if one is sent, and otherwise by IP address. Nothing else about the caller is kept, and these counters are deleted after 7 days of inactivity.

Proxy passthrough

If you switch an endpoint to proxy passthrough, you are instructing us to forward requests to a server you nominate. We send that server the request as received — including the Authorization header, which is the point of the feature — and return its response to the caller. That destination is chosen by you and is outside our control; its own privacy practices apply to what it receives. We do not store the response it returns; we record only the URL we forwarded to, in your request log.

A domain's owner can verify it with us, after which only their account may proxy to it. If another account tries, we refuse the request and record the attempt — the domain, the destination URL, and the account and mock it came from — and include it in a daily summary sent to our own support address so we can follow it up. We keep those records for 90 days. This is abuse prevention, and it is the only case where we send details of your activity to ourselves rather than simply showing them to you.

Technical logs and analytics

Our hosting provider records standard server logs (IP address, timestamp, requested URL, user agent) which we use to keep the Service running, apply rate limits and investigate abuse. We use privacy-friendly, aggregate traffic measurement and do not use third-party advertising or cross-site tracking cookies.

Cookies

We use cookies only where they are needed to make the site work: keeping you signed in, and security. There is no advertising or profiling cookie to opt out of. The mock-serving domain apipreflight.io is deliberately session-free and does not set authentication cookies at all.

Why we are allowed to use it

Where privacy law requires a legal basis, ours is: performing our contract with you (running the Service and billing you), our legitimate interests (keeping the Service secure, preventing abuse), and consent where you have given it. In Australia we handle personal information in line with the Australian Privacy Principles.

Who we share it with

We do not sell personal information. We share it only with the providers needed to run the Service:

We may also disclose information where required by law. Most of these providers are located overseas, mainly in the United States, so your information may be stored or processed outside Australia. Our off-site backups are the exception: they are held in Australia.

How long we keep it, and how it is removed

• Mocks created without an account: deleted automatically 7 days after creation, by a job that runs daily. The mock, its endpoints and its responses are removed outright — not archived.
• Account data and saved mocks: kept until you delete them or close your account. Deleting a mock deletes its endpoints, responses, request log and sequence counters in the same operation.
• Request logs: deleted 30 days after the call, by the same daily job. You can also clear a mock's log yourself at any time, which takes effect immediately.
• Sequence counters: deleted after 7 days without use.
• Closing your account removes your mocks, endpoints, responses, request logs and sequence counters. Your subscription record is retained only as part of the billing records below.
• Billing records: kept as long as tax and accounting law requires (generally five years in Australia). Card details are never held by us — see Stripe, above.
• Backups: two kinds. Our database provider keeps its own backups for operational recovery, and we take a nightly encrypted copy of the database — including account email addresses and authentication records — to Amazon S3 storage in Australia. That copy is kept for 30 days and is deliberately write-once: it cannot be altered or deleted early, including by us, which is what makes it useful against ransomware and mistakes. So data you delete disappears from the live Service immediately, and then persists in that backup until the copies containing it age out — up to 30 days. Backups are not read except to recover from a failure.

Security

Traffic is encrypted in transit with HTTPS. Data is stored with row-level access rules so one account cannot read another's. Administrative keys are held server-side only. No system is perfectly secure, and as set out in our terms, mock endpoints are public by design — please keep real secrets out of them.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, or restrict how we use it. Email support@apipreflight.com and we will respond within a reasonable period, normally 30 days. If you are unhappy with our response you may complain to the Office of the Australian Information Commissioner (oaic.gov.au), or to your local data protection authority.

Children

The Service is not directed at children and accounts require you to be at least 16.

Changes

We may update this policy. If a change materially affects you, we will give notice on the site before it takes effect.

Contact

Privacy questions or requests: support@apipreflight.com.