There are no accounts here, so there is very little about you to hold. What there is, and for how long, is below.
An endpoint URL is unguessable, but it is not a secret and it is not protected by a password. Anyone who has the URL can read every request sent to it. Do not send real credentials, API keys, personal data or customer records through an endpoint — use fake values.
When something sends a request to your endpoint, the whole request is stored so it can be shown back to you: the method, the path, the headers, the body, the query string and the sending IP address. That is entirely under the control of whoever sends the request. If a request carries a password, a token or someone's personal details, that is what gets stored, so send fake values rather than real ones. Bodies over 64KB are stored truncated, and anything over 2MB is refused outright with a 413 rather than accepted and quietly discarded. The stored request is deleted 30 minutes after it arrives, and the sending IP goes with it. The interface shows that address partly masked; the full value exists only in storage, for those 30 minutes.
Anyone with the endpoint URL. Endpoint names are random enough not to be guessed, but they are not authenticated — treat the URL itself as the only thing standing between your requests and a stranger. Endpoint contents are not indexed and there is no directory or search of active endpoints.
Running a web server produces access logs: IP address, time, path, response code and user agent. These are separate from what the inspector shows you and are used to keep the service up and to deal with abuse. They are kept for 30 minutes and then rotated away — the same window as everything else here.
Nothing loads until you accept it. On your first visit a bar asks; until you answer, and forever if you decline, no analytics script is fetched and no cookie is set. Declining takes one click, the same as accepting, and there is no third time of asking — the answer is kept in your browser, not in a cookie. If you accept, Google Analytics runs on the public pages — home, use cases, about, contact, this page and live traffic. It sets two first-party cookies, _ga and a _ga_ pair, which count you as the same visitor across pages and across visits for up to two years. Google receives the page you looked at, roughly where you are, your browser and device, and how you arrived. It deliberately does not run on an endpoint page. The URL of your endpoint is the only thing protecting it, and analytics reports the page address it runs on — sending that to a third party would hand over the key to every request you captured. Nothing about your endpoint, and nothing it has received, reaches Google. Blocking the script changes nothing about the tool. Every page, every endpoint and every captured request works exactly the same with analytics blocked, and there is no banner asking you not to.
mylocalhost.com receives a large volume of requests aimed at people's own machines, because the name appears in example code and default configuration. None of it is answered with anything useful. It is treated exactly like any other request: logged, then dropped after 30 minutes. Nothing sent to this domain by mistake is kept beyond that window, and none of it is read, published or passed on. What does persist is counting. Running totals — how many requests, which paths, how many countries — are incremented as requests arrive and kept indefinitely, because a tally holds nothing about the person who sent it. The Live Traffic page is built from those counters plus a rolling view of the last 30 minutes.
The service runs on a server in Sydney, Australia, operated by OVH. Requests you send necessarily pass through their network and hardware, and captured requests do not leave that server. Nobody else is contacted by default. The typeface is served from this server rather than from Google Fonts, so loading a page reaches no third party at all. Google receives analytics only from the public pages, and only after you have accepted — never anything from an endpoint. Beyond that: no email list, no CDN holding your data, and no advertising network. Live Traffic carries a card linking out to another project, rotating between a few. It is a plain link and nothing more — no script, no pixel, no redirect counting your click, and the site it points at is told nothing about you. Which one shows is decided here when the page is built, so there is no cookie deciding it either.
This is a developer tool and is not aimed at children.
If this page changes in a way that affects what is stored or for how long, the date below changes with it. There is no mailing list to notify, so the date is the record.
Write to hello@mylocalhost.com. If you want a specific endpoint's requests dropped before they expire, send the endpoint name and they will be removed.
Last updated 24 August 2026