Privacy and terms

Who holds your data

This service is run by Lukia Siyolo, the responsible party for the personal information it holds under South Africa's Protection of Personal Information Act (POPIA).

What is stored

For your account: your email address and an opaque identifier, both received from id.iamlukia.com when you sign in there, which is the service that signs you in and holds your identity; when the account was created and when you last signed in; and a session record while you are signed in. That session record holds your email address too, inside the sign-in token the session keeps. It is deleted when you sign out, when id.iamlukia.com signs you out, when your identity is erased there, when you delete your account here, and when the session lapses after 30 days.

For each captured request: method, path after your token, raw query string, headers exactly as received, raw body bytes, size, time, and the source address our proxy reported, plus the status it was answered when you set the session to simulate failures. Nothing else is added and nothing is inferred.

For each replay you send: the target URL, the time, whether it was re-signed, and what the target answered — its status, its first twenty headers and the first 16 KB of its body — or why it was refused. Replays are kept with the request and deleted with it.

Why it is collected

Your email address and identifier, to tie your sessions to you. This inspector sends nothing to that address.

The requests you capture, so you can inspect, verify and replay them, which is the service. Each one's source address is kept with it so you can see who sent it; rate limits count by address in memory and write nothing down.

The masked report goes to Anthropic only when you press Explain with Claude, to write the explanation.

None of it is used for anything else: no analytics, no advertising, and no one it is shared with beyond the sub-processors below.

What is never stored

Your signing secrets and passphrases. Verification is a pure function over the stored request and the value you paste. The canonical string it builds contains your passphrase, which is why it is shown masked and written nowhere. A re-signed replay uses the value you paste for that one request and keeps neither it nor the signature it made.

Explain with Claude sends the trace and the canonical string, with your passphrase masked out, to Anthropic's API. Neither passphrase nor signature leaves this server, and the explanation is not stored.

How long

A session lives 7 days; everything is deleted 24 hours later in one cascade. Database backups rotate on a 7-day cycle — deliberately shorter than the 8-day retention, so a backup cannot outlive the promise above.

Delete session now erases it immediately — the honest answer to "I pointed production at this by mistake". Delete account erases everything.

Sandbox only, and why

This is a debugging tool, not a payment processor. Real payloads carry real customers' names, amounts and references. Only the signed-in account that owns a session can read its captures, but anyone holding the capture URL can send to it.

Sub-processors

Processing is in South Africa, apart from the optional explain button, which goes to Anthropic.

Service level

Best effort, roughly 99%. There is no SLA. One machine, one region, maintenance when it happens. Don't build anything that depends on this being up.

Terms of use

The service is free, and the terms are the ones above in one place: use it with sandbox credentials and test data only, never production traffic or real customers' details; there is no service level; and a session sending abusive traffic may be ended without notice. The service may change or stop.

Your rights

POPIA gives you the right to know what is held about you and to have it corrected or deleted (sections 23 and 24). What is held is listed under What is stored above, and your sessions and what they captured are on your own screens. Your address is changed at id.iamlukia.com, and this inspector's copy follows the next time you sign in.

If you believe your information has been mishandled, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.

Deleting your account

Delete account erases your address, every session with every capture and replay in it, and any sign-in record still outstanding, and signs out every browser you are signed in on. It is immediate and cannot be undone.

Delete account removes what this inspector holds. Your iamlukia.com identity stays; erase it at id.iamlukia.com.

Database backups rotate on the 7-day cycle above, so a copy can outlive it in a backup for up to 7 days.

Sign in, and the control appears here.