Policies

Privacy Policy

Thook forwards the notifications of your services (GitHub, GitLab, Gitea, Bitbucket, Netlify or any generic webhook) to a Telegram chat. This page lists everything it keeps, so you can decide whether you are comfortable with it.

What the bot stores

• Your Telegram Chat ID. It is needed to know where to deliver the notifications. It is the ID of the chat, not your name, username, phone number or profile.

• The keys of your webhooks. The random identifier in your webhook URLs and the secret key used to verify the signature of the requests. You can replace the secret key at any time with /rotate.

• Your settings. For example the /cleanup preference, and how many times you used the /start command.

• A monthly counter of delivered messages, for each month and each service (for example GitHub or Generic). It does not record when each message was sent.

• The state of a run, for 7 days. To edit the message of a CI run (started, running) instead of sending a new one, the bot keeps the id of the Telegram message and the latest step of that run. Firestore deletes it automatically after 7 days.

What the bot does NOT store

• It does NOT store the content of the messages you send or receive.

• It does NOT store the payload of the webhooks. The payload is read, turned into a Telegram message, delivered and discarded.

• It does NOT store timing details of when you send messages.

Logs

To keep the service running and find errors, the servers write technical logs (for example the Chat ID and the type of the event of an error). They do not contain the content of your messages and are kept for the default retention of Google Cloud logging.

Where the data goes

• Telegram receives the notifications, as with any bot. Its privacy policy applies to them.

• Cloudflare sits in front of the website and of the webhook URLs, to speed up and protect them. Every request passes through it, including the webhooks you send to Thook, but the content is only relayed and not stored by Thook. Cloudflare processes technical data such as the IP address, and provides aggregated traffic statistics without cookies or scripts in the pages. Its privacy policy applies.

• Google (Firebase / Google Cloud) hosts the website, the bot and the database. It may process technical data such as the IP address of the requests, to serve the pages and protect the service.

• The services you connect (GitHub, GitLab and so on) send the webhooks to the Thook URLs. What they send is decided by their own settings.

Your data is not sold, not shared for advertising and not used to profile you.

The website

The website has no analytics scripts, no advertising and no tracking cookies. The only statistics are the aggregated traffic numbers that Cloudflare provides at the network level (see above). The only thing saved in your browser is the theme you choose (light or dark), in the local storage, and it never leaves your device.

Keep your webhooks private

Anyone who knows a webhook URL can send messages to your chat. Do not publish it, use the secret key where the service supports it, and run /rotate if the key is exposed.

Your control and deletion

You can stop the notifications at any time by removing the webhook from your service or blocking the bot. To have your Chat ID, keys and counters deleted, open an issue on the GitHub repository and say which chat the data belongs to. Never publish your secret key.

Changes

If what is stored changes, this page is updated before the change goes live. The history is public in the repository.

Simple fair usage policy

• The bot is free and offered without any guarantee.

• If needed, rate limits could be introduced in the future.

• Use the bot and webhooks in an appropriate mode: no spam, no abuse, no attempt to overload the service or to send messages to chats that did not ask for them.

• Access can be limited or removed to protect the service and the other users.