Bristle / Privacy & data

Privacy & data

Bristle’s core workflow runs locally. This page describes the current beta and its public website.

Updated 2026-11-04

Inside the app

No vendor account, cloud sync service, telemetry, crash-report upload, or automatic update service is built into this release. Bristle sends API requests only through the workflows you use: configured API and proxy endpoints, OAuth providers, imported specification URLs, and requests made by reviewed scripts.

The optional sample contacts httpbin.org when you send its requests. OAuth may briefly listen on loopback for a callback. The optional mock server listens on 127.0.0.1 after you start it and stops when the app exits.

Files, private state, and secrets

Collection definitions are readable YAML files in folders you choose. Recognized credential fields can use local vault references. Arbitrary request text, bodies, headers, saved examples, and exported files can still contain sensitive information.

Private draft and history payloads, cookies, OAuth tokens, and secrets are encrypted locally with an OS-protected key. On macOS, that uses Electron’s Keychain integration. History index metadata such as identifiers, timestamps, and outcomes remains readable. If secure storage is unavailable, sensitive state is session-only and the app says so.

Local encryption does not protect against a compromised user session or prevent authorized device administration. Your operating system, network, and workplace tools operate independently of Bristle.

Retention and deletion

History defaults to seven days or 500 MiB, with up to 10 MiB of retained response body per run. Full-response downloads, recovery files, migration backups, and other private data are separate from that history limit. Explicit downloads are ordinary files and may contain raw secrets.

Removing the app retains your collection folders and private profile. Open the latter through Settings → Open local data folder before uninstalling if you need to locate it.

This website and downloads

This website uses no analytics, tracking pixels, third-party fonts, cookies, advertising, or signup forms. It is hosted on GitHub Pages. GitHub processes request information, including IP addresses for security, and serves release downloads under its privacy statement. Public release download counts are available through GitHub; no app usage is sent with them.

Downloading the app does not require a GitHub account. Opening a GitHub issue or subscribing to releases uses GitHub’s own account and privacy controls.

When you contact us

GitHub issues are public. Email you send to alexchasejones@icloud.com is handled by that mailbox’s provider, iCloud, and used to respond to your request. Include only the information needed to reproduce a problem; remove tokens, passwords, customer data, and internal URLs.

There is no automated upload of your collections or diagnostics. For privacy or deletion requests concerning information you sent directly, contact the same address.