Data Privacy
Everything you do in Curlex stays on your computer. Curlex makes no outbound network connections of its own — the only requests that leave your machine are the API requests you explicitly send.
Where Your Data Lives
| Data | Where it is stored |
|---|---|
| Collections, environments, workspaces, settings | On your local disk inside the app's own database (IndexedDB inside the Tauri webview) |
| Passwords, tokens, and Vault secrets | In your operating system's secure keychain — macOS Keychain, Windows Credential Manager, or Linux libsecret |
| Large response bodies | In a temporary folder on your local disk, managed by the app |
| Console log output | In memory only — cleared when you restart the app, or downloadable from the Console before restart |
What Curlex Does Not Do
- No telemetry. Curlex does not send usage statistics, crash reports, feature analytics, or any other data to Curlex servers.
- No cloud account required. You do not need to create an account, verify an email address, or sign in to use any feature.
- No mandatory sync. Git Sync is entirely optional. If you do not configure it, nothing leaves your machine.
- No API request inspection. The requests you send go directly from your machine to the API server you configure. Curlex is not a proxy and does not intercept or log your traffic anywhere outside the app.
Git Sync and Privacy
If you enable Git Sync and push to a remote repository, your collection and environment data is transmitted to that remote. This is entirely under your control:
- Secret variable values are scrubbed before being written to Git — the keys are present but sensitive values are replaced with a placeholder like
{{env.SECRET_REDACTED}}, so credentials are not exposed even in a private repository.
Auto-Update
Curlex checks for updates automatically in the background. This involves a network request to the update server to check for a newer version. No personal data or usage information is included in this request — it is a version check only.
All updates are cryptographically signed. Curlex verifies the signature before applying any update.