Privacy
This page says what Hookdrills keeps about you, how long it keeps it and how it is deleted. Using the site without signing in stores nothing about you in the site's database. The data in the next three sections is stored there only if you sign in with GitHub. Signing in is the one way to have an account, and the site never holds a password. The last section, on Cloudflare, also covers requests made without signing in.
Your GitHub name, email and avatar
Your first sign-in copies your GitHub name (your login, if you have set no name), your email address and a link to your GitHub avatar into the site's database, with whether GitHub has verified the email and the times the record was created and last changed. The site stores the link and not the image, and a later sign-in does not update your name, email or avatar link.
How long: until your account is deleted. Nothing removes them sooner.
Asking to delete your account adds two dates to the same record, when you asked and when it is due to be deleted, until you cancel or it is deleted.
Your IP address and user agent
Each sign-in creates a session, a database record that holds the user agent your browser sent, which names the browser and its system, a token that a cookie in your browser also holds, and the times the record was created and last changed. The record has a field for an IP address, which the site leaves empty: the login is set never to store an address, whatever a request carries. Cloudflare's own logs do hold your address, as the last section says.
How long: a session and its cookie stop working 7 days after the session was last renewed, and using it renews it at most once a day. Its record is normally deleted when you sign out, which the Sign out button on the main page does. A record that remains after you sign out, or one you did not sign out of, stays until your account is deleted, even after the session has stopped working, since the site does not remove old sessions by itself.
Your GitHub account ID and tokens
A sign-in also stores your GitHub account ID and the tokens GitHub issues for it, which the site can use to
reach GitHub on your behalf, with the permission they were issued for and the times the record was created and
last changed. The site asks GitHub for one permission, user:email, and for nothing more.
How long: the account ID stays until your account is deleted. Each sign-in replaces the stored tokens with new ones, and the last ones stay until your account is deleted, even after GitHub stops accepting them.
How your data is deleted
Deleting an account removes all of the data in the three sections above from the site's database together.
The Delete account button on the main page asks for this. Your account is then deleted after at least 30 days, normally within 31. Until then, the data above stays in the database, and you can press Keep my account to cancel, or Delete now to delete it at once.
You can stop the site's access to your GitHub account at any time, in GitHub's settings under Applications, Authorized OAuth Apps. That stops the stored tokens working, and it does not delete anything the site has stored.
A mail to support
If you write to support, your email address and your message pass through Cloudflare and are kept at Google, in a Gmail inbox used only for support. Deleting your account does not remove them.
How long: up to 90 days after the problem it reports is fixed. It is then deleted from the inbox by hand, which does not guarantee that Google or Cloudflare remove their copies. A mail that reports no problem counts as fixed once it is answered.
What Cloudflare keeps
The site and its database run on Cloudflare. Cloudflare keeps a history of the database, which cannot be turned off, so that it can be restored to an earlier moment. Data deleted from the database can remain in that history for up to 30 days.
Cloudflare also logs every request that reaches the site's server code, whether or not you are signed in or finish signing in. That includes the sign-in's requests and the check of whether you are signed in that the main page makes each time it loads, so each visit to the main page reaches these logs even if you never sign in. Each log holds the address asked for, your full IP address, your user agent and may hold other info such as your country, region, city, timezone etc. These logs are kept for up to 7 days by Cloudflare and then removed, and deleting an account does not remove them sooner.