Privacy Policy

ResponderHTTP has no analytics, no telemetry, no crash reporting and no accounts. It does not phone home, and it contains no update checker. Nothing about you or your use of the app is sent to the developer, and there is no server to send it to.

The app keeps its data in a SQLite database inside the app's own storage: in your Windows user profile on Windows, and in your home folder on Linux. That database holds:

• The HTTP, WebSocket and gRPC requests and collections you save
• The gRPC schemas you import or save to the schema library: the text of the .proto files and the compiled schema
• The Markdown documentation you write for a collection, folder or request
• Environments and their variables
• Your request history
• Cookies received from servers you sent requests to
• Application settings

Values the app treats as secrets — passwords, bearer tokens, API keys, and environment variables marked secret — are never written to the database in plain text. They are encrypted with a key held in the operating system’s credential store, which only your user account can read: Windows Credential Manager on Windows, and your desktop’s keyring on Linux (GNOME Keyring or KWallet, reached through the secret portal when the app runs as a Flatpak). The key never leaves your computer.

ResponderHTTP sends HTTP requests and gRPC calls, and opens WebSocket connections, only to the addresses you enter. It is a tool for making those requests, so the destination, the headers and the body are entirely under your control. They go directly from your computer to the server you named; they do not pass through any service operated by the developer. Loading a gRPC schema by server reflection asks the server you entered, and no one else.

gRPC follows the same rules as the rest of the app. In particular:

• Calls go directly from your computer to the address you enter, in plain text or over TLS as the lock beside the address shows. Over TLS, the server’s certificate is verified by default.
• Server reflection asks the server you entered, and no one else, for its services and message types. It happens when you ask for it, and when you leave the address field or open the method list of a request that does not use a schema from the library. Opening a saved request sends nothing.
• Imported .proto files are compiled inside the app and never uploaded. Only the files you chose, and the files they import, are read, looked up in their own folders and the import folders you chose.
• Saved gRPC requests (address, method, message, metadata and settings) and the schema library stay in the local database. Authorization credentials are encrypted as described under Credentials. Metadata is stored as you type it, so keep a token in a secret variable or on the Authorization tab: a secret variable is stored as its {{name}} placeholder, and its value is filled in only when the call is sent.
• The messages you send and receive and the metadata of a call are never written to the log. A log line names the address, the method and the status only.
• Copy as grpcurl puts a command on your clipboard and sends nothing. It contains the values of secret variables when an environment holding them is selected, so treat the copied text as you would the secrets themselves.

The app writes a local log file to help diagnose problems. Request bodies, authentication headers, tokens and cookies are deliberately kept out of it, as are the WebSocket and gRPC messages you send and receive, gRPC metadata, and the events of a streamed response; a redaction step strips credentials that would otherwise ride along inside an error message. The log stays on your computer and is never uploaded.

Importing an OpenAPI document, or saving a response to disk, reads and writes only the file you chose in the system dialog. Importing .proto files reads the files you chose and the files they import, looked up only in their own folders and the import folders you chose. When the app runs as a Flatpak, it has no access to your files of its own: the system dialog grants it the files you choose, and nothing else.

The app is a developer tool and is not directed at children.

If this policy changes, the updated version will be published at this address and the date above will change.