legal

Privacy policy

Last updated: October 2026

The short version: API Craft is built so that we hold as little of your data as possible. The application has no account system, no telemetry, and your API projects never leave your machine.

Data controller: Florian Varrin, Rue des Peupliers 7, 1400 Yverdon-les-Bains, Switzerland. Contact: support@api-craft.dev.

The application (desktop app and CLI)

  • Your project data (specs, requests, environments, secrets, responses) is stored as files on your own disk. It is never transmitted to us or to any third party by the application. There is nothing to breach on our side, because nothing is there.
  • No telemetry. The application sends no usage analytics, no crash reports, no identifiers. The update check below is the only request it ever makes to us.
  • Update check. The desktop app checks releases.api-craft.dev for updates when it starts and when you ask it to. The request says which version you are running and which channel you are on, so that we know which versions are still in use. Like any HTTPS request, it also exposes your IP address to our hosting provider (Cloudflare). Nothing else is attached: no account, no identifier, nothing about your projects. See Downloads and update checks.
  • License verification happens entirely offline, against a public key embedded in the application. Your license file is read locally and never uploaded.

Downloads and update checks

releases.api-craft.dev serves the installers, the standalone binaries and the update manifest. We count what it serves, in aggregate and nothing more.

What we keep is a table of counters. One row per day, per combination of: the kind of request (a download from this site, an install, a reinstall, an update, an update check), the release channel, the platform, the version, which client asked, and the country the request came from. Each row holds a number. The Linux install script says whether it was a first install or a reinstall, which it works out from whether the app was already on your disk; it sends that as a single 0 or 1.

What we do not keep: your IP address, your user agent, any cookie, any identifier, or anything that could link two requests to the same person or machine. There is no per-request record to link them with. The counter goes up by one and the request is forgotten.

Cloudflare, as our hosting provider, still handles the request itself (your IP address included) in order to deliver the file; see Cloudflare's privacy policy.

This website

  • The site is static, served by Cloudflare Pages. Cloudflare processes standard server logs (IP address, user agent) to operate the service; see Cloudflare's privacy policy.
  • No analytics scripts, no advertising, no third-party trackers, no cookies. A single localStorage entry stores your light/dark theme preference; it never leaves your browser.
  • Checkout. Clicking Buy loads Paddle's checkout, which sets its own cookies under Paddle's privacy policy. Nothing from Paddle loads before that click.
  • Team interest form (on the pricing page): if you submit your email, we store it (email address and timestamp, nothing else) to send you one notification when the Team tier ships. We do not add you to a newsletter. Email support@api-craft.dev any time to have it deleted.

Purchases

Checkout is operated by Paddle.com Market Ltd as merchant of record. Paddle collects the data needed to process payment and tax (name, email, billing country, payment details) under Paddle's privacy policy. We never see your payment details.

From Paddle we receive your name, email address and order details, which we use to issue and send your license file and to provide support. Your license is emailed automatically through Cloudflare Email Service. We keep this purchase record for as long as licensing and accounting obligations require.

Support

Support runs through a public GitHub repository, where anything you post is public under GitHub's privacy policy, and through support@api-craft.dev, hosted with Proton Mail.

Your rights

You can request access to, correction of, deletion of, or a portable copy of any personal data we hold (in practice: a purchase record and possibly a Team-interest email). Write to support@api-craft.dev. We respond within one month, as required by Swiss and EU data protection law. If we need more time, we will tell you and give you a new deadline.

You also have the right to lodge a complaint with a supervisory authority: the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or your national data protection authority if you reside in the EU/EEA.

We do not sell personal data. We share it only with the processors named above (Cloudflare, Paddle, Proton, GitHub), each strictly for the purpose described.

Changes

If this policy changes materially, the "last updated" date above changes and license holders are notified by email.