Privacy Notice
This Privacy Notice explains what walkindb collects when you use the hosted API at https://api.walkindb.com, why we collect it, how long we keep it, and your rights under the General Data Protection Regulation (GDPR).
The walkindb hosted Service is operated from Portugal by walkindb (the “Operator”, “we”, “us”), with infrastructure located in France (see §1.1 and §5 below). For the purposes of GDPR, the Operator is the data controller for personal data processed in connection with the Service.
Summary in plain language
- You don’t have an account. We don’t collect a name, an email, a phone number, or a payment method.
- We do log every API request, but minimally. We record: timestamp, source IP address, instance ID, HTTP status code, and the byte length of your SQL — but never the SQL itself, never the parameters, and never any rows returned.
- We keep those access logs for 7 days, then delete them. This window exists so we can respond to abuse reports and lawful subpoenas filed within a week of an incident.
- We do not read your SQLite databases. They live on disk for at most 10 minutes, then they are deleted automatically.
- We do not run analytics, ads, or trackers on the API. No cookies are set by the API.
- We do not sell your data, share it with third parties for marketing, or train machine-learning models on it.
If that’s all you need, you can stop reading. The rest of this document is the legally rigorous version.
1. Data we process
1.1 Access logs (the only personal data we process for the API)
Every request to https://api.walkindb.com results in one structured log entry containing:
| Field | Example | Why we collect it |
|---|---|---|
timestamp | 2026-04-11T14:32:11Z | Operations, debugging, and correlating with abuse reports. |
source_ip | 198.51.100.42 | Rate limiting in real time, and abuse / subpoena response after the fact. |
instance_id | 018f2b...a3 | Linking a complaint about a specific instance to the IPs that touched it. |
http_method | POST | Operational metrics. |
http_status | 200 | Operational metrics and rate-of-error tracking. |
sql_byte_length | 42 | Operational metrics; helps us understand load. The SQL text itself is not logged. |
user_agent | curl/8.5.0 | Operational metrics; helps us understand who is using the Service. |
What we explicitly do not log:
- The SQL text of your query.
- The values of any parameters bound to your query.
- The columns or rows returned by your query.
- The contents of your walk-in SQLite database at any point.
- Any header other than
User-AgentandX-Walkin-Session. - A
X-Walkin-Sessiontoken is not retained in logs in plaintext; only the corresponding instance ID is logged.
1.2 Walk-in instance contents
When you submit a query, the Service may create a SQLite database file under our control. The contents of that file are determined entirely by your queries. They are not read, indexed, mined, scanned, or analyzed by us. They exist on disk only for the lifetime of the instance (target: 10 minutes), after which the file is deleted.
We do not maintain backups of walk-in instance contents. We do not snapshot them. They are not replicated to any third party.
1.3 Email correspondence
If you contact us at [email protected], [email protected], [email protected], or [email protected], we will retain the contents of your message for as long as necessary to handle your request and to maintain a record of the matter. Email is processed by our email provider (currently a free or low-cost forwarding service; the specific subprocessor may change and will be listed in this notice when relevant).
1.4 Landing page (walkindb.com)
The landing page at walkindb.com is hosted on Cloudflare Pages. It currently uses no analytics, no cookies, and no third-party trackers. If we add a privacy-respecting analytics tool in the future, we will update this notice and disclose the tool here.
2. Legal basis for processing (GDPR Article 6)
We process the access-log data described in §1.1 on the following legal bases:
- Legitimate interests (GDPR Article 6(1)(f)) — operating the Service securely and reliably, defending against abuse and DDoS attacks, and being able to respond to abuse reports and law-enforcement requests. We have balanced this interest against the rights of users by minimizing what we collect and by limiting retention to 7 days.
- Legal obligation (GDPR Article 6(1)(c)) — when we are required by court order, subpoena, or applicable EU/Portuguese law to retain or disclose data.
3. Retention
| Data | Retention |
|---|---|
| Access logs (§1.1) | 7 days from the timestamp of the request, after which entries are deleted by an automated job. Entries subject to a litigation hold or law-enforcement preservation request are retained until the hold is lifted. |
| Walk-in instance contents (§1.2) | Approximately 10 minutes from instance creation (the TTL); deleted by the Service automatically. |
| Email correspondence (§1.3) | As long as necessary to handle the matter and to maintain an institutional record, typically up to 2 years for abuse and security correspondence. |
4. Sharing and disclosure
We share the personal data described in this notice only in the following circumstances:
- With our hosting and infrastructure providers to the extent technically necessary to operate the Service. The current providers are:
- OVHcloud (France) — runs the virtual server that hosts the API.
- Cloudflare, Inc. (United States, with EU presence) — DNS for
walkindb.comandapi.walkindb.com. The API is not proxied through Cloudflare; only DNS resolution is handled there. - Email is handled by a forwarding provider; specific subprocessor will be disclosed here when production email is set up.
- In response to a binding legal request — court order, subpoena, or other lawful process — we will disclose the relevant access-log entries to the requesting authority, to the extent we possess them and are required to do so. Where the law allows, we will notify the affected user (which, for anonymous traffic, typically means publishing aggregate transparency information).
- To respond to a credible abuse report, we may share the relevant log entries (timestamp, IP, instance ID, status) with the complaining party or with the relevant authority.
We do not sell personal data, do not share personal data with advertisers or data brokers, and do not use personal data for training machine-learning models.
5. International transfers
Our primary infrastructure is in France (European Union). Cloudflare’s DNS service is provided from the United States and other jurisdictions; Cloudflare is certified under the EU-US Data Privacy Framework, and our use of Cloudflare is limited to DNS-only resolution (no proxying of API traffic), which keeps the personal data we send them to a minimum.
6. Your rights under GDPR
If you are in the European Economic Area, you have the following rights with respect to your personal data:
- Right of access (Article 15) — to ask whether we hold personal data about you and to receive a copy.
- Right to rectification (Article 16) — to ask us to correct inaccurate data.
- Right to erasure (Article 17, “right to be forgotten”) — to ask us to delete personal data about you.
- Right to restriction of processing (Article 18).
- Right to object (Article 21) — to object to processing based on our legitimate interests.
- Right to lodge a complaint with a supervisory authority. The Operator’s lead supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD) in Portugal. You may also lodge a complaint with the supervisory authority of your own country of residence within the EEA.
To exercise any of these rights, contact [email protected]. Be aware that, because we collect the minimum necessary data and retain it for only 7 days, our ability to identify “your” data is limited to the IP address you provide in your request and to log entries that are still within the retention window at the time we receive your request. For requests about data older than 7 days, we will most likely no longer hold the data at all.
We will respond to verifiable requests within 30 days of receipt, in line with GDPR Article 12(3).
7. Children
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has used the Service in a way that involves personal data being collected, please contact [email protected] and we will delete the relevant log entries.
8. Security
We protect the access logs described above with industry-standard measures: minimum-privilege OS user, no public network exposure for the log store, log rotation and automatic deletion, and security hardening of the host (firewall, automatic security updates, no password authentication for SSH). We will publish the bullet-point version of our hosting controls in SECURITY.md in the open-source repository.
No security model is absolute. The single most effective protection for your data is to not store anything sensitive in walkindb in the first place. This is why the AUP forbids storing personal data about identifiable third parties in walk-in instances.
9. Changes
We may update this notice. Material changes will be reflected in the “Last updated” date at the top and announced in the walkindb changelog. We will not retroactively expand retention or share previously collected data in ways inconsistent with the notice that was in effect when the data was collected.
10. Contact
- Privacy and data-subject requests: [email protected]
- Abuse: [email protected]
- Security: [email protected]
We do not yet have a designated Data Protection Officer (DPO); the Service does not currently meet any of the conditions in GDPR Article 37(1) that would require one.