Privacy

For each request sent to a trapdoor: the method, the path, the query string, every header, the body, the size, the source IP address, the country the request came from, and the time it arrived.

Bodies are truncated at 256 KB on free trapdoors and 5 MB on Pro. The reported size is always the true size, so a truncated capture says so rather than pretending to be complete.

Authorization, Cookie, X-Api-Key and similar headers are never stored as sent. They are reduced to a fingerprint — the scheme, the first and last four characters, and the length — which is enough to confirm the header arrived and looks right, and not enough to reuse.

The same applies to credential-looking fields in a query string, a JSON body at any depth, or a form body: api_key, access_token, client_secret, password and the like.

This is a safety net, not a guarantee. It matches on names, so a secret in a field called something unexpected is stored as sent. Do not rely on it — send test credentials, not real ones.

Anyone holding the trapdoor URL. There are no accounts, so the ten-character id in the link is the entire access control. It is generated from a cryptographic random source and is not guessable, but it is shareable — treat the link as a secret.

The operator can read the underlying database, as anyone running a service can. Captures are not looked at except when investigating a fault or abuse report, and they are not sold, shared, or used to train anything.

A trapdoor keeps its most recent 200 requests on the free tier or 5,000 on Pro; older ones are deleted as new ones arrive. The trapdoor itself is deleted 7 days after its last request on the free tier, or 90 days on Pro, and deleting it deletes every capture with it.

You can delete a trapdoor and its captures at any time from the inspector, or clear the captures while keeping the trapdoor. Deletion is immediate and permanent.

The IP address that created a trapdoor, used only to enforce the limit on how many can be created per hour. Nothing else about you is recorded: no analytics, no tracking pixels, no third-party scripts, no cookies. The site sets no cookies at all.

Owner secrets and licence keys are held in your browser's local storage. They are sent to the server only when you use them, and are never written to a log.

Payment is handled entirely by Stripe. Card details never reach Trapdoor and are never stored by it. What is kept is your email address, a Stripe customer and subscription identifier, the licence key, and when the subscription renews.

Stripe processes payment data as its own controller under its own privacy policy at stripe.com/privacy.

The application runs on Vercel and the database is Neon Postgres, hosted in the United States. Using Trapdoor from elsewhere means the data described here is transferred there.

Most of what is stored is under your own control already: export a trapdoor as JSON or HAR, clear its captures, or delete it outright — all without asking anyone.

For anything that is not — a copy of the billing record, deletion of a licence and the email attached to it — write to greykiko@icloud.com and it will be done. Depending on where you live you may have statutory rights of access, correction, deletion, or objection; those are honoured regardless of whether the law in question applies.

Inspector pages are served with noindex, and robots.txt disallows both /e/ and /t/ — crawling a trapdoor would mean firing it. A well-behaved crawler will not index a shared link. A badly behaved one is not something any site can prevent, which is another reason to treat the link as a secret.