Cliff DevPrivacy policies

Shuttle API — Privacy Policy

Last updated: September 8, 2026

Shuttle API ("the App", "we", "us") is a developer tool for composing, sending, and inspecting network requests on Mac, iPhone, and iPad. This policy explains what information the App handles, where it is stored, and the choices you have.

We designed Shuttle API to be private by default: your collections, credentials, and responses live on your devices and in your iCloud account, and we do not run a server that receives them.

At a glance

  • We do not operate a backend server that stores or processes your requests, responses, collections, or credentials. If you enable it, your data syncs through your own iCloud account.
  • The App has no user accounts to create or maintain — there is nothing to sign in to.
  • There are no analytics, no telemetry, and no crash-reporting SDKs. The App sends us nothing of its own accord — not on first launch, not when it crashes. The one exception is the update check, which runs only when you press it; see Checking for updates below.
  • We do not sell, rent, or share your data, and there is no advertising or tracking.
  • The App's network traffic is the requests you compose and send, to the servers you address, plus iCloud sync if you turn it on, plus the update check if you press it.
  • You can erase everything the App stores from Settings → Data.

Who this policy covers

This policy applies to the Shuttle API apps for macOS, iOS, and iPadOS distributed through the Apple App Store and TestFlight.

Information the App handles

Everything the App holds is content you created or imported:

  • Collections, folders, and requests — names, URLs, methods, query and path parameters, headers, request bodies, documentation, and tags.
  • Environments and variables — the global, collection, environment, and folder values you define. Values you mark as secret are held in the device Keychain rather than in the App's data files.
  • Credentials — bearer tokens, usernames and passwords, API keys, OAuth 1.0 and 2.0 client secrets and access tokens, AWS keys, Hawk and NTLM credentials, and any client certificate and private key you import. These are stored so the App can send them on your behalf.
  • Scripts — the JavaScript you write to run before and after a request, and any helper module you save in a folder's settings.
  • History — a snapshot of each request you send and the response it received, capped at the most recent 200 entries, so an entry stays replayable after the request is edited or deleted.
  • Saved examples and run reports — responses you choose to keep on a request, and the results of a collection run.
  • Cookies — cookies returned by the servers you address, kept per collection in the App's own jar.
  • Settings — your theme, language, layout, shortcut bindings, proxy configuration, timeouts, and TLS options.

The App does not collect or receive your name, email address, contacts, photos, location, browsing history, health data, or advertising identifiers. It does not read files you have not explicitly chosen in a file picker.

Where your data is stored

  • On your device. Collections, requests, environments, history, settings, and cookies are written as inspectable JSON files in the App's own Application Support directory. Nothing there leaves the device unless you enable iCloud or export a file yourself.
  • In the device Keychain. Every value you mark as secret, and every stored credential, is held in the Keychain rather than in those JSON files, protected by the system.
  • In your private iCloud container (optional). If you enable iCloud sync, your collections, environments, and history are stored in the App's private iCloud container under your Apple ID. Only your Apple ID — and devices signed into the same Apple ID — can access this data. We have no access to it.

We hold none of it. There is no Shuttle-operated database, log, backup, or cache of your content anywhere.

The requests you send

This is the one part of the App that necessarily involves other parties, and it is worth being precise about.

When you send a request, the App connects to the host you addressed and transmits exactly what you composed — the URL, headers, body, cookies, and any authentication values you configured. That data goes to that server's operator, not to us. Which servers you address, what you send them, and what they do with it are governed by your relationship with them, not by this policy.

A few consequences worth knowing:

  • Credentials leave the device when you send. That is the point of an API client, but it means a token entered here is transmitted to whatever host you point the request at. Check the URL before sending a request that carries a credential.
  • Turning off TLS verification removes a protection. The App lets you disable certificate verification or trust a custom certificate authority for a specific host. Doing so means the connection can no longer be trusted to reach the party it claims to. The App will not override your choice, and this policy cannot protect data on a connection you chose to weaken.
  • A proxy sees your traffic. If you configure a proxy, requests pass through it, and its operator can see them.
  • Scripts run with full access. Pre-request and post-response scripts, including any module you require and any code you paste from elsewhere, can read and modify your variables and environments — including secret ones — and can change the request before it is sent. Review anything you paste.
  • The mock server listens locally. When you start it, the App accepts connections on the port you chose. On a shared or untrusted network, other machines may be able to reach it. It serves only the OpenAPI document you loaded, and stops when you stop it.

How your data is used

Your information is used only to make the App work: to build and send the requests you compose, to display the responses, to substitute your variables, to authenticate as you have configured, to run your scripts and folder runs, and to sync between your own devices if you enable iCloud.

We do not use your data for analytics, profiling, advertising, machine-learning training, or any purpose unrelated to the App's core function. We cannot, because we never receive it.

Checking for updates

Settings has a Check for update button. Nothing checks on its own: not at launch, not in the background, not on a schedule. No check happens unless you press it.

When you do, the App sends one request to our site carrying three things: which app it is, the version you are running, and your language, so the release notes can come back in it. It carries nothing about you, nothing from your collections, and no identifier of any kind — there is no account, and the App has none to send. What comes back is a version number and its notes.

We keep nothing from these requests. Our site is hosted by Vercel, and as with any web host their infrastructure necessarily handles the connection itself — the address it came from, and the time — under Vercel's own privacy policy. We do not use that for anything, and we build no record of who checked, or when.

If you would rather send nothing at all, do not press the button. Everything else in the App works the same either way.

Third-party services

The App integrates no third-party SDKs at all — no analytics, no advertising, no crash reporting, no feature flags, no A/B testing. Its platform dependencies are Apple iCloud, and only if you enable sync, and the host of our own site for the update check described above; your use of it is also governed by Apple's privacy policy: apple.com/legal/privacy.

Any diagnostics you may choose to share with Apple are governed by your device's analytics settings and Apple's privacy policy. If you send us a crash report or a wire transcript yourself, by email, we receive whatever you chose to include — the App strips secrets from exports and masks credentials in transcripts by default, but you should still read what you are sending.

The App reads and writes file formats defined by other projects (Postman, Insomnia, Bruno, Thunder Client, HAR, OpenAPI). Those are file formats, not services: importing one reads a file you selected, and contacts nobody.

Permissions the App may request

You are always in control. The App may ask for the following, and you can change or revoke each in System Settings (Mac) or Settings (iPhone/iPad):

  • Network access (all) — to send the requests you compose. This is the App's core function.
  • Local network (iPhone/iPad) — only if you address a host on your local network, or run the mock server.
  • Files you select (all, optional) — to open a .proto file, a certificate, a data file for a collection run, or a collection to import, and to save an export. The App receives access to the file you picked and nothing else.
  • iCloud (all, optional) — to sync your collections between your own devices.

The App never requests camera, microphone, location, contacts, calendar, photo library, or notification access, because it has no feature that needs any of them.

Data retention and deletion

  • Everything the App stores stays until you delete it. There is no expiry and no server-side copy to outlive it.
  • History is capped at the most recent 200 sends; older entries are dropped automatically as new ones arrive.
  • Deleting a collection or an environment removes it and its secrets from the Keychain. A deleted request or folder goes to the App's Trash first, its secrets with it, where the 25 most recent deletions wait to be put back; emptying the Trash, or an entry falling off the end of it, removes them and their secrets for good.
  • Settings → Data → Erase removes everything the App stores on that device in one action.
  • If you enabled iCloud, deleting the data also removes it from your iCloud container. You can also manage the App's data in your iCloud storage settings.
  • Uninstalling the App removes its local files and Keychain entries from that device.

Security

  • Secrets and credentials are stored in the system Keychain, not in the App's data files, and are protected by the device's own protections.
  • Exports strip secret values by default, and wire transcripts mask Authorization, Cookie, and similar headers until you explicitly ask to see them.
  • Requests use TLS wherever the URL you entered does, with certificate verification on by default.
  • Data in transit to iCloud is protected by Apple's encrypted services.
  • No Shuttle-operated server ever stores or processes your content.

While no method of transmission or storage is 100% secure, we rely on Apple's platform protections to safeguard what is on your device, and we minimize risk by never receiving your data in the first place.

Children's privacy

Shuttle API is a developer tool, is not directed to children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect personal information from children.

Your rights

Because we hold none of your data, there is nothing for us to disclose, correct, or delete on your behalf. You can access, export, or delete everything directly in the App, or through your iCloud storage settings. Depending on where you live, you may have additional rights (such as access, correction, portability, or deletion) under laws like the GDPR or CCPA; since we operate no server and hold no personal data, those requests are satisfied by the App's own export and erase functions. For anything else, contact us using the details below.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date shown on this page, and significant changes may also be noted in the App or its release notes. If required by applicable law, we will provide additional notice or request your consent before changes take effect.

Contact

If you have questions about this policy or how Shuttle API handles your data:

Email: cliffrubio.dev@gmail.com