Privacy Policy

1. Overview

This Privacy Policy explains what personal data MockBase ("the Service") collects, why, how long it is kept, and the choices you have. It applies to the MockBase web application and its API.

MockBase is a developer tool for creating mock API endpoints. You can use it anonymously for a limited trial, or sign in with a third-party provider for the full feature set.

2. Data we collect

Account data (when you sign in): your email address, display name, avatar URL, and the provider account identifier returned by GitHub or Google. We do not receive or store your provider password.

Anonymous session data: a random session identifier generated in your browser to associate mocks you create before signing in.

Usage and request data: for requests sent to your mock endpoints, we record metadata and payloads in the request inspector, including the request method, path, status code, latency, client IP address, query parameters, headers, and request body.

Anti-abuse data: client IP addresses are used to meter anonymous usage so a single machine cannot bypass trial limits by creating many sessions.

3. How we use data

To operate the Service: authenticate you, store and serve your mock configurations, and show the live request inspector.

To enforce fair use: apply rate limits and monthly request quotas, and prevent abuse of the anonymous tier.

To secure the Service: detect misuse and protect availability.

4. Retention

Request logs are stored temporarily: each mock keeps up to 500 recent entries and every entry expires automatically after 7 days.

Mock version history keeps up to 30 snapshots per mock and expires after 90 days. Deleting a mock deletes its history and its request logs immediately.

Usage counters are bucketed per calendar month and expire automatically after roughly two months.

Account data is retained while your account exists. Deleting your account removes your account record, every mock you own (including its request logs, version history, and stateful data), and your support tickets.

5. Sensitive data and redaction

Credential-bearing request headers (such as Authorization, Cookie, and the mock access token header) are redacted before a request is written to the log store or streamed to the inspector, so they are not persisted in plaintext.

You are responsible for the content you send to your own mock endpoints. Avoid sending real secrets or personal data of others through mock requests.

6. Third parties

Authentication is provided by GitHub and Google via OAuth. Their handling of your data is governed by their own privacy policies.

We use Google Analytics for aggregate usage statistics; its processing of data is governed by Google's privacy policy.

The Service relies on infrastructure providers for hosting, databases, and caching. Payment processing, when introduced, will be handled by a third-party payment provider; MockBase will not store full card details.

7. Cookies

A session cookie is used to support the OAuth sign-in flow.

We use Google Analytics to understand aggregate, anonymized usage of the marketing and product pages (for example, which pages are visited). Google Analytics sets its own cookies and processes data, including your IP address, under Google's privacy policy. We do not use advertising cookies.

You can block analytics cookies using your browser settings, a tracker-blocking extension, or Google's opt-out browser add-on.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing.

Your Account page has a Download your data button, which exports your profile, the mocks you own, your team memberships, and your support tickets as a single JSON file.

Your Account page also has a Delete account button, which permanently removes your account, the mocks you own, and your support tickets. Two situations require a manual step first: an admin account cannot self-delete (contact another admin), and an account that owns a team must delete or hand off that team before its own account can be removed.

9. Changes

We may update this policy as the Service evolves. Material changes will be reflected here.