Privacy

What data Mockly stores

What the service knows about you, where that data lives and how to delete it.

Updated September 14, 2026

Only what it needs

Your email, a password hash and the mocks you created.

No analytics, no trackers

No visit counters, no ad cookies, no error-tracking services.

One server, no cloud

The database and the API run on a single server we rent ourselves.

Account

Your email is used to sign in and to reset your password.
Passwords are stored only as bcrypt hashes; the server never keeps the password itself.
Signing in with GitHub stores your GitHub id, login and avatar. The GitHub access token is not stored.
Password reset codes are stored as hashes and expire after 15 minutes.
An account can be blocked for abuse: sign-in stops working and its mocks start returning an error. The reason for the block is stored.

Projects, collections and records you create are stored in the database as is.
A mock endpoint is open to anyone who knows the project public id, unless the collection is private. Don't put real personal data, passwords or keys into mocks.
Passwords of mock-auth users are stored as bcrypt hashes.
The mock request log keeps method, path, status and response time. No IP addresses or headers, and only the latest 200 entries per project.

The web server and the API write standard request logs that include IP addresses. They are used for debugging and abuse protection.
Rate limits are counted per IP address or per project id and live only in server memory.
Logs are not used for analytics and are not shared with third parties.
Addresses used for abuse can be added to a blocklist together with a reason. They stay there until the block is removed.

NEXT_LOCALE remembers your language.
mockly_oauth_state protects GitHub sign-in and expires after 10 minutes.
localStorage holds the session token (valid for 7 days), your email, login and avatar, plus the theme and the record editor mode. Signing out removes the token and profile data from the browser.
There are no ad or analytics cookies.

Projects, collections and records are deleted from the UI immediately, together with their related data.
Account deletion isn't in the UI yet. Send a request to the @mocklyapi Telegram channel and the account will be deleted with all its projects.

If anything changes, the date on this page will be updated. Questions about your data go to the @mocklyapi Telegram channel.