Privacy Policy

Account information. Your email address, an optional display name, and a password hash if you sign up with email. If you sign in with GitHub or Google, we receive your email address and basic profile details from that provider. We never see your password for those services.

Workspace content. Everything you create in APIMock: workspaces, endpoints, response bodies, Data API collections and records, fault rules, folders, imported OpenAPI specs, team invitations, and personal access tokens (stored hashed).

Mock request logs. When someone calls one of your mock endpoints, we record the method, path, status, timing and size. If you switch an endpoint to full capture, we also store query and path parameters, headers, and previews of the request and response bodies. Headers and cookies that look like credentials (for example Authorization, Cookie, or anything named like a token, secret, API key or password) are replaced with [REDACTED] before they are saved.

Usage counters. Monthly request totals per workspace, used to enforce the free-tier limits.

Analytics. On our public pages we use Google Analytics to understand aggregate traffic, such as which pages are visited and roughly where visitors come from. We also use Microsoft Clarity to record how visitors move through the site (clicks, scrolling and page layout) so we can find confusing or broken screens. In the dashboard, Clarity sees only the layout: the text on screen, including your workspace content, request logs and API tokens, is masked in the browser and never sent, and anything typed into a form is always masked.

Support conversations. If you contact us through the help widget, we keep your messages, your email address and, when you're signed in, your name and active workspace so we can answer you.

We use your information to:

• run the service: serve your mocks, show request history, and sync your team;
• sign you in and keep your account secure;
• enforce usage limits and prevent abuse;
• send account emails such as confirmations, password resets and invitations;
• understand, in aggregate, how the product is used so we can improve it.

We do not sell your data, use it for advertising, or use your workspace content to train machine-learning models.

• Mock request logs are deleted automatically after 7 days.
• Workspace content is kept until you delete it or delete your account.
• Account information is kept while your account exists and removed when you delete it, except where we must keep limited records to meet legal obligations or resolve disputes.

We share data only with the service providers that help us run APIMock, and only as much as they need:

• Supabase hosts our database and handles authentication.
• Our hosting provider serves the website and mock traffic.
• GitHub and Google, if you choose to sign in with them.
• Google Analytics for aggregate traffic on public pages.
• Microsoft Clarity for session recordings and heatmaps, with dashboard content masked.
• Help Scout runs our help widget and stores support conversations.

Members of a workspace can see that workspace's content and request logs. Mock endpoints are public URLs: anyone with the address can call them unless you turn on endpoint authentication. We may also disclose information if required by law or to protect the service and its users.

APIMock is free. Tips through Buy Me a Coffee are processed by that service under its own privacy policy; we never receive your payment details.

We use cookies that are needed to keep you signed in. Google Analytics sets its own cookies on our public pages to measure visits, Microsoft Clarity sets cookies to group page views into a visit, and the Help Scout help widget stores data in your browser to keep your support conversations. You can block or delete cookies in your browser; blocking the sign-in cookies will prevent you from using the dashboard.

You can view, edit and delete your workspaces, endpoints and data at any time from the dashboard. To get a copy of your data, correct it, or delete your account and everything in it, email [email protected]. We respond within 30 days.

Depending on where you live, you may have additional rights, such as objecting to certain processing or complaining to your local data protection authority.

Data is encrypted in transit, workspace data is isolated with database row-level security, and access tokens are stored hashed. No system is perfectly secure; if you find a vulnerability, please tell us at [email protected].

Our providers may process data in countries other than yours. Where that happens, we rely on their standard safeguards for international transfers.

APIMock is a developer tool and is not directed at children under 16. We do not knowingly collect their personal information.

We will update the date at the top of this page when the policy changes, and notify account holders by email of significant changes. See also our Terms of Service.

Questions about this policy or your data: [email protected].