Privacy Policy

1. Summary

Curlew is a local-first app. We do not run servers that receive your data, we have no accounts, and we do not collect analytics, telemetry, or crash reports. Everything you create in Curlew stays on your Mac unless you choose to send a request, export a file, or share it yourself.

2. Information Stored on Your Device

Curlew saves the following on your Mac, in the app's own storage or in a workspace folder you choose:

• Workspaces, collections, folders, requests, environments, variables, and scripts.
• Request history and the responses you have received, so you can review them later.
• App settings and preferences, such as appearance and the counter for the free requests included before a subscription is needed.
• Secrets, such as environment secret values, authentication credentials, OAuth tokens, and client certificates, which are stored in the macOS Keychain rather than in workspace files.

This information is under your control. You can delete it at any time by removing items in the app, deleting the workspace folder, or deleting the app's data and Keychain entries.

3. Information We Do Not Collect

We do not collect, receive, or have access to any of the following:

• The APIs, URLs, or servers you call, or your request bodies, headers, and responses.
• Your credentials, tokens, or variable values.
• Usage metrics, device identifiers, advertising identifiers, or location.
• Crash reports or diagnostics generated by Curlew itself.

Curlew contains no third-party analytics, advertising, or tracking software, and we do not sell or share personal data.

4. Network Connections

Requests you send from Curlew go directly from your Mac to the servers you specify. They are not routed through any intermediary service operated by us. What those servers do with the data you send is governed by their own policies.

Features you choose to use may also contact the services you configure, for example an OAuth 2.0 authorization or token endpoint, or a URL you import a specification from. Sign-in for OAuth 2.0 happens in your system browser.

If you run the built-in mock server, it listens on your Mac and is reachable according to the address and port you set; you are responsible for any network exposure that results.

5. Secrets and Keychain

Values marked as secret, and credentials entered in a request's Auth tab, are stored in the macOS Keychain and are excluded from workspace files, history, and exports. Anything you type directly into a URL, header, or body is saved as written, so use a secret variable for sensitive values. Be careful when sharing exports, documentation, or workspace folders that you did not review.

6. Subscriptions and Payments

Curlew Pro is an optional auto-renewing subscription purchased and managed through the App Store. Apple processes your payment and handles your Apple ID and subscription status; we never receive your payment details. Curlew verifies your entitlement on your device using Apple's StoreKit. Apple's own privacy policy applies to purchases.

7. Notifications

If you enable request monitors, Curlew may ask for permission to show macOS notifications when a monitored request starts failing. These notifications are generated locally on your Mac. You can revoke permission at any time in System Settings.

8. Command-Line Runner

The optional curlew command-line runner works on the files and environment you give it and sends requests directly from the machine it runs on. It does not transmit any data to us. Reports it writes (JUnit, JSON, Markdown) are saved where you tell it to.

9. Children's Privacy

Curlew is a developer tool and is not directed at children. Because we collect no personal information, we do not knowingly collect any from children.

10. Your Rights

Since we do not hold personal data about you, there is generally nothing for us to access, correct, or delete. Your data is on your own device, and you can view, export, or erase it yourself. If you have a privacy question or request, contact us through the Support page.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a new revision date. If a change is material, we will make a reasonable effort to highlight it in the app or release notes. Continued use of Curlew after an update means you accept the revised policy.

12. Contact

Questions about this policy can be sent through the Support page.