What Transits Our Servers

The Path a Webhook Takes

A sender POSTs to your channel URL. The relay writes the delivery to an encrypted queue, pushes it to your Mac if it's connected, and deletes it the moment your Mac confirms receipt. That's the whole job. Everything intelligent — signature verification, parsing, running your flow — happens on your Mac.

What Transits

• The webhook itself — the request body and headers the sender transmitted, up to the size cap (~100 KB text / ~70 KB binary), plus the method, path, and arrival time. The relay forwards the sender's bytes verbatim; it does not parse, transform, or inspect them.
• Your license, once, to connect — when the app opens its connection to the relay, it presents your license as proof of purchase. That's the identity story, covered below.

What Is Stored, and for How Long

• Every delivery is briefly queued. Each accepted request is written to a queue (DynamoDB) so nothing is lost while your Mac is offline. The row is deleted the moment your Mac acknowledges the delivery — for an online Mac that's seconds.
• Encrypted at rest. The queue is stored encrypted on the server side.
• Hard 24-hour ceiling. A delivery your Mac never picks up becomes inaccessible after 24 hours — expired rows are refused at read and are never delivered — and the database physically deletes them within 48 hours of expiry.
• Channel bookkeeping, as hashes. For each channel we store a SHA-256 hash of its access token (never the token — it's shown to your app once and cannot be recovered from our side) and a salted hash identifying the owning license (never the license string itself), plus a created-at date and queue counters.

What Is Never Stored or Logged

• Bodies and headers never appear in logs. The relay's code logs error names only — never request bodies, never headers, never license strings — and a regression test pins that behavior.
• Gateway request logging is off. The API gateway in front of the relay runs with execution logging disabled, so request contents aren't captured at the infrastructure layer either.
• Access logs omit your channel URL. Your channel URL is a secret capability, so the access-log format leaves out the request path — the secret never lands in a log line. Operational logs (timestamps, status codes, error names) are kept for 14–30 days for debugging, then expire.

What the Relay Cannot Do

• It cannot tell real from forged. HMAC signature verification happens on your Mac, with a secret the relay never has. To the relay, a genuine Stripe event and a forged one are indistinguishable bytes — which is exactly the point. A pipe that can't judge your traffic also can't read meaning into it.
• It never answers for your flow. Senders always get 202 Accepted and nothing else. No response from your Mac is ever proxied back to a caller, so nothing your flow computes can leak out through the relay.
• It cannot reach into your Mac. Your Mac dials out to the relay; nothing connects in. Turn off Enable public relay in Settings → Webhooks and your public-webhook nodes stop receiving entirely.

Identity: What We Can Tie to You

Connecting to the relay requires an activated license, and a Watchflows license is a signed blob that contains the purchaser's email address. So yes: the relay can associate this connection belongs to the license bought by this email. That's the entire identity model — there is no account, no separate signup, no tracking beyond it.

Channel records store the license as a salted hash, and the license string itself is never logged. What the relay knows about you is: which channels your license owns, and when they were created.

You Hold the Kill Switches

• Per channel — Regenerate… replaces a channel URL on the spot (the old one starts returning 404 immediately); Revoke… kills it outright. Both live in the node inspector.
• Per Mac — Settings → Webhooks → Enable public relay disconnects everything without touching your channels.
• Per license — deactivating your license revokes every channel it owns, server-side. If a license is ever stolen, this is the recovery path: deactivate, reactivate, recreate.

Delivery Semantics, Honestly

The relay promises at-least-once delivery: a delivery stays queued until your Mac explicitly confirms it, so a dropped connection means redelivery, not loss. The flip side of at-least-once is duplicates — which is why the trigger on your Mac keeps a persistent record of delivery IDs that already fired. A redelivered duplicate is confirmed back to the relay (so the queued copy is deleted) but your flow does not run twice, even across an app restart.

Queued deliveries drain in arrival order when your Mac reconnects. The queue holds up to 200 requests or 5 MB per channel for up to ~24 hours — beyond that, senders get 429 and their own retry logic takes over.

What It Costs