FlosForge Caller — privacy policy

FlosForge Caller stores all workspaces, collections, environments, history, cookies, and settings as plain JSON files on your computer. It requires no user account, has no cloud synchronization, collects no telemetry, and performs no background update checks. The only network connections made are the HTTP requests you explicitly send.

What FlosForge Caller collects about you

Nothing. There is no account, no telemetry, no analytics, no crash reporting and no identifier of any kind. The app has no server of its own to send anything to, and it does not phone home to check for updates — there is nothing to check for — you download a newer release from GitHub whenever you decide to.

What it stores, and where

Workspaces and collections: One folder per workspace, with collections stored as individual JSON files alongside environments, globals, request history, and open tabs. On macOS in ~/Library/Application Support/FlosForge Caller/data, on Windows in %APPDATA%\FlosForge Caller\data, on Linux in ~/.config/FlosForge Caller/data, or wherever FLOSFORGE_CALLER_DATA_DIR points.
Secrets in environments: Environment variables—including fields marked as secret—are stored as plain text in local JSON files so they remain human-readable and easy to back up. Protect this directory with appropriate file permissions just as you would any local configuration holding sensitive API keys.
Cookie jar: Cookies set by target servers are preserved in cookies.json in the data folder and returned automatically on subsequent calls, just like in a browser. You can inspect, edit, or clear stored cookies at any time from within the app.
Exports and reports: Saved only to the specific location you choose in your system file dialog.

Everything it can connect to

Each of these is a connection you cause — by adding something, enabling something, or pressing a button — and none of them is made on a schedule you did not set.

The requests you send: Every request travels directly from your computer to the target host you specified, including requests triggered during collection runs or dispatched via pm.sendRequest inside scripts.
The demo workspace: If you choose to set up the demo workspace, its sample requests query free public testing endpoints (such as JSONPlaceholder, httpbin, and Open-Meteo) only when you press Send.
Links in About: External links to the repository and licence open directly in your system default web browser.

What never leaves your computer

Nothing is sent to FlosForge or anyone else: no user accounts, no cloud sync, no analytics, and no crash reporting.
The app never checks for updates or phones home in the background.
Scripts from imported collections run in an isolated sandbox and cannot read your filesystem or local configuration.
HTML response previews execute no JavaScript and load no external network resources.

Safeguards

Isolated interface: The window runs with context isolation, Chromium sandbox protections, and Node.js integration disabled, reaching the rest of the application exclusively through a typed bridge.
Sandboxed scripts: Pre-request and test scripts execute in an isolated worker under a strict Content Security Policy with no filesystem access and no network capabilities beyond pm.sendRequest, bounded by a configurable timeout.
Command-line runner isolation: During automated CLI runs, scripts execute in a worker thread without access to process environment variables, require(), or the host filesystem, preventing collections from accessing CI pipeline secrets.
Masked export reports: Sensitive tokens, authentication headers, and session cookies are automatically sanitized and masked in exported reports.

Your rights, and who to ask

Because the app holds nothing about you, there is nothing for the controller to access, correct or erase on your behalf: everything it knows is in files on your own computer, under your own control. Uninstalling the app leaves your data folder in place so your collections survive a reinstall. To remove all data completely, simply delete the FlosForge Caller data folder (locations listed below) containing your workspaces, collections, environments, cookies, and settings. For anything else, write to hello@flosforge.eu. The site-wide privacy policy covers this website, your rights under the GDPR, and the supervisory authority you can complain to.

Changes

This statement is checked against each release. If a version changes what the app stores or what it can connect to, the version and date at the top change with it.