Privacy

Privacy

Curlkit is built to work on your machine. This page explains what stays local and what is sent when you choose to sign in.

Last updated: October 2026

No account neededThe app works fully offline without signing in.
Local by defaultYour collections, environments and history stay on your machine.
Sync is opt-inData leaves your device only when you sign in and sync a workspace.

Local by default

You can use Curlkit without an account. Requests, collections, environments, variables, scripts and history are stored on your computer. Nothing is sent to us while you work offline.

Signing in

Signing in is optional. You can sign in with Google or with email. We use the account details from that sign-in, such as your name and email address, to identify you and connect you to your workspaces.

Synced workspaces

When you sign in and sync a workspace, its contents are stored on our servers so they can be synced. This can include:

  • Collections, requests and folders in that workspace
  • Environments and variables in that workspace
  • Scripts and test assertions attached to those requests

Variables can hold secrets such as tokens and API keys. Review a workspace before you sync it, and keep secrets you don't want to share in a local-only workspace.

Team workspaces

In a team workspace, members see its contents according to their role: owner, editor or viewer. When you invite someone, we use their email address to send and track the invitation.

Your requests

Requests you send in Curlkit go directly from your computer to the server you are calling. They are not routed through us.

This website

This site loads no third-party fonts, scripts or trackers. Your theme choice is saved in your browser's local storage under curlkit-theme.