Privacy Policy

Last updated: May 2026

The short version

Rostyman is a local-first desktop application. Your collections, environments, request history, vault secrets, and all other workspace data are stored on your device in a local SQLite database. None of this data is transmitted to Rostyman's servers — because we don't receive it.

What data Rostyman collects

Anonymous analytics

Rostyman sends anonymous usage analytics to our analytics server (analytics.rostyman.com) unless you disable it. A one-time transparency notice on first launch makes this clear and offers a single-click disable. You can also disable it at any time in Settings → Privacy. The data is:

  • A hashed device ID (random UUID, SHA-256 hashed before sending — not tied to your identity)
  • App version, operating system, and screen resolution
  • Which features you used in the session (e.g. "used GraphQL", "used AI") and session duration
  • Country (derived from IP via Cloudflare, IP is never stored)

We never collect: request URLs, headers, bodies, API keys, collection names, environment variables, file paths, response data, or any personally identifiable information.

Update checks

Rostyman checks for updates every 4 hours by contacting the GitHub Releases API (api.github.com/repos/rostymanteam/rostyman). This request includes your current app version and platform. No other information is sent.

AI Assistant

If you use the AI Assistant with an external provider (OpenAI or Anthropic), the messages you send are transmitted to that provider according to their respective privacy policies. Using Ollama routes all AI requests to a local model running on your machine — no data leaves your device.

File Sharing

File transfers and chat messages in the File Sharing module are sent directly device-to-device over your local network using TLS 1.3. No data passes through Rostyman's servers. Transfers are between you and the recipient only.

Your workspace data

All of the following is stored exclusively on your device and never transmitted to us:

  • Collections and requests
  • Environments and variables
  • Vault secrets (API keys, tokens)
  • Request history
  • Workflow definitions
  • App settings and themes
  • Git-based storage (your repositories are your own)

Website (rostyman.com)

This website is hosted on Cloudflare Pages. Cloudflare may collect standard web server logs (IP address, browser type, pages visited) per their privacy policy. We use Google Analytics 4 to measure aggregate site traffic (page views, geographic regions, referrer sources) — no personalized advertising and no third-party trackers beyond GA itself. You can opt out via the standard Google Analytics opt-out browser extension.

Newsletter

If you opt in to our newsletter, we store the email address you provide solely to send you product updates and release news. We never sell or share it, and every email includes a one-click unsubscribe link. You can unsubscribe at any time, after which we remove your address from the list. Subscription is entirely optional and has no effect on downloading or using Rostyman.

Contact

Questions about this policy? Contact us at [email protected].