Privacy Notice
This Privacy Notice explains what walkindb collects when you use the hosted API at https://api.walkindb.com, why we collect it, how long we keep it, and your rights under the General Data Protection Regulation (GDPR).
The walkindb hosted Service is operated from Portugal by walkindb (the “Operator”, “we”, “us”), with infrastructure located in the United Kingdom (see §1.1 and §5 below). For the purposes of GDPR, the Operator is the data controller for personal data processed in connection with the Service.
Summary in plain language
- You don’t have an account. We don’t collect a name, an email, a phone number, or a payment method.
- We do log every API request, but minimally. We record: timestamp, source IP address, instance ID, HTTP status code, and the byte length of your SQL — but never the SQL itself, never the parameters, and never any rows returned.
- We keep those access logs for 7 days, then delete them. This window exists so we can respond to abuse reports and lawful subpoenas filed within a week of an incident.
- We do not read your SQLite databases. They live on disk for at most 10 minutes, then they are deleted automatically.
- We do not run analytics, ads, or trackers on the API. No cookies are set by the API.
- We do not sell your data, share it with third parties for marketing, or train machine-learning models on it.
If that’s all you need, you can stop reading. The rest of this document is the legally rigorous version.
1. Data we process
1.1 Access logs (the only personal data we process for the API)
Every request to an API endpoint (/sql, /kv, /doc) results in one structured log entry containing the fields below. (Health checks at /healthz and the machine-readable spec at /openapi.json are not logged.)
| Field | Example | Why we collect it |
|---|---|---|
timestamp | 2026-04-11T14:32:11Z | Operations, debugging, and correlating with abuse reports. |
source_ip | 198.51.100.42 | Rate limiting in real time, and abuse / subpoena response after the fact. |
instance_id | 018f2b...a3 | Linking a complaint about a specific instance to the IPs that touched it. |
http_method | POST | Operational metrics. |
http_status | 200 | Operational metrics and rate-of-error tracking. |
sql_byte_length | 42 | Operational metrics; helps us understand load. The SQL text itself is not logged. |
user_agent | curl/8.5.0 | Operational metrics; helps us understand who is using the Service. |
endpoint | /doc | Which interface was used — one of /sql, /kv, /doc, /healthz, /openapi.json. Operational metrics; tells us which interfaces people actually use. Only the interface name is recorded, never the full path — a request to /doc/my-private-notes is logged as /doc, so collection names you choose are not stored. |
What we explicitly do not log:
- The SQL text of your query.
- The values of any parameters bound to your query.
- The columns or rows returned by your query.
- The contents of your walk-in SQLite database at any point.
- Any header other than
User-AgentandX-Walkin-Session. - A
X-Walkin-Sessiontoken is not retained in logs in plaintext; only the corresponding instance ID is logged.
1.2 Walk-in instance contents
When you submit a query, the Service may create a SQLite database file under our control. The contents of that file are determined entirely by your queries. They are not read, indexed, mined, scanned, or analyzed by us. They exist on disk only for the lifetime of the instance (target: 10 minutes), after which the file is deleted.
We do not maintain backups of walk-in instance contents. We do not snapshot them. They are not replicated to any third party.
1.3 Email correspondence
If you contact us at [email protected], [email protected], [email protected], or [email protected], we will retain the contents of your message for as long as necessary to handle your request and to maintain a record of the matter. Email is processed by our email provider (currently a free or low-cost forwarding service; the specific subprocessor may change and will be listed in this notice when relevant).
1.4 Landing page (walkindb.com)
The landing page at walkindb.com is hosted on Cloudflare Pages. It uses Cloudflare Web Analytics, and no other analytics, advertising, or tracking service.
We chose Cloudflare Web Analytics specifically because of what it does not do:
- It sets no cookies and writes nothing to your browser's local storage. There is no consent banner on this site because, under the ePrivacy Directive, none is required for storage-free measurement.
- It does not fingerprint you. It does not build a device or browser fingerprint, and it does not use any client-side identifier to recognise you across visits or across sites.
- It does not track you across websites. Measurement is confined to
walkindb.com. - Your IP address is not stored by the analytics product. Cloudflare uses it transiently to derive a coarse country-level location and then discards it.
What it collects is aggregate page-level data: the URL visited, the referring site, and general device/browser class (for example “mobile / Chrome”), plus page-load performance timings. We use this only to understand which pages people find useful. We cannot single you out from it, and we do not attempt to.
Cloudflare is already our DNS provider and our page host, so this introduces no new subprocessor — it is the same vendor under the same data-processing terms. Cloudflare's own description of the product is at cloudflare.com/web-analytics.
Opting out. Because measurement runs in the page, any content blocker or a browser “Do Not Track”/tracker-blocking setting will prevent it, and nothing on this site will break as a result. The API at api.walkindb.com carries no analytics of any kind (§1.1), so using walkindb via curl or an SDK is entirely unmeasured beyond the 7-day access log described above.
If we ever change or add an analytics tool, we will update this notice and disclose the tool here before doing so.
2. Legal basis for processing (GDPR Article 6)
We process the access-log data described in §1.1 on the following legal bases:
- Legitimate interests (GDPR Article 6(1)(f)) — operating the Service securely and reliably, defending against abuse and DDoS attacks, and being able to respond to abuse reports and law-enforcement requests. We have balanced this interest against the rights of users by minimizing what we collect and by limiting retention to 7 days.
- Legal obligation (GDPR Article 6(1)(c)) — when we are required by court order, subpoena, or applicable EU/Portuguese law to retain or disclose data.
3. Retention
| Data | Retention |
|---|---|
| Access logs (§1.1) | 7 days from the timestamp of the request, after which entries are deleted by an automated job. Entries subject to a litigation hold or law-enforcement preservation request are retained until the hold is lifted. |
| Walk-in instance contents (§1.2) | Approximately 10 minutes from instance creation (the TTL); deleted by the Service automatically. |
| Email correspondence (§1.3) | As long as necessary to handle the matter and to maintain an institutional record, typically up to 2 years for abuse and security correspondence. |
4. Sharing and disclosure
We share the personal data described in this notice only in the following circumstances:
- With our hosting and infrastructure providers to the extent technically necessary to operate the Service. The current providers are:
- OVHcloud (United Kingdom region) — runs the virtual server that hosts the API.
- Cloudflare, Inc. (United States, with EU presence) — DNS for
walkindb.comandapi.walkindb.com. The API is not proxied through Cloudflare; only DNS resolution is handled there. - Email is handled by a forwarding provider; specific subprocessor will be disclosed here when production email is set up.
- In response to a binding legal request — court order, subpoena, or other lawful process — we will disclose the relevant access-log entries to the requesting authority, to the extent we possess them and are required to do so. Where the law allows, we will notify the affected user (which, for anonymous traffic, typically means publishing aggregate transparency information).
- To respond to a credible abuse report, we may share the relevant log entries (timestamp, IP, instance ID, status) with the complaining party or with the relevant authority.
We do not sell personal data, do not share personal data with advertisers or data brokers, and do not use personal data for training machine-learning models.
5. International transfers
Our primary infrastructure is in the United Kingdom, on OVHcloud’s UK region. The Operator is established in Portugal (European Union), so personal data processed by the Service is transferred from the EEA to the UK.
That transfer is covered by an adequacy decision. On 19 December 2025 the European Commission renewed its adequacy decision for the United Kingdom under the GDPR, running to 27 December 2031. Adequacy means the Commission has determined that the UK provides a level of protection essentially equivalent to EU law, so no additional safeguard — no Standard Contractual Clauses, no separate transfer-risk assessment — is required for us to host your data there. If that decision were to lapse or be revoked, we would either move the infrastructure back into the EEA or put Standard Contractual Clauses in place, and would update this notice before doing so.
Cloudflare’s DNS service is provided from the United States and other jurisdictions; Cloudflare is certified under the EU-US Data Privacy Framework, and our use of Cloudflare for the API is limited to DNS-only resolution (no proxying of API traffic), which keeps the personal data we send them to a minimum.
6. Your rights under GDPR
If you are in the European Economic Area, you have the following rights with respect to your personal data:
- Right of access (Article 15) — to ask whether we hold personal data about you and to receive a copy.
- Right to rectification (Article 16) — to ask us to correct inaccurate data.
- Right to erasure (Article 17, “right to be forgotten”) — to ask us to delete personal data about you.
- Right to restriction of processing (Article 18).
- Right to object (Article 21) — to object to processing based on our legitimate interests.
- Right to lodge a complaint with a supervisory authority. The Operator’s lead supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD) in Portugal. You may also lodge a complaint with the supervisory authority of your own country of residence within the EEA.
To exercise any of these rights, contact [email protected]. Be aware that, because we collect the minimum necessary data and retain it for only 7 days, our ability to identify “your” data is limited to the IP address you provide in your request and to log entries that are still within the retention window at the time we receive your request. For requests about data older than 7 days, we will most likely no longer hold the data at all.
We will respond to verifiable requests within 30 days of receipt, in line with GDPR Article 12(3).
7. Children
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has used the Service in a way that involves personal data being collected, please contact [email protected] and we will delete the relevant log entries.
8. Security
We protect the access logs described above with industry-standard measures: minimum-privilege OS user, no public network exposure for the log store, log rotation and automatic deletion, and security hardening of the host (firewall, automatic security updates, no password authentication for SSH). We will publish the bullet-point version of our hosting controls in SECURITY.md in the open-source repository.
No security model is absolute. The single most effective protection for your data is to not store anything sensitive in walkindb in the first place. This is why the AUP forbids storing personal data about identifiable third parties in walk-in instances.
9. Changes
We may update this notice. Material changes will be reflected in the “Last updated” date at the top and announced in the walkindb changelog. We will not retroactively expand retention or share previously collected data in ways inconsistent with the notice that was in effect when the data was collected.
10. Contact
- Privacy and data-subject requests: [email protected]
- Abuse: [email protected]
- Security: [email protected]
We do not yet have a designated Data Protection Officer (DPO); the Service does not currently meet any of the conditions in GDPR Article 37(1) that would require one.