Privacy Policy

Everything you create in Rocketly (workspaces, collections, requests, environments, history, cookies and responses) is stored in a database on your computer. We have no access to it.

Requests you send go directly from your computer to the APIs you call. They do not pass through our servers.

The app contains no analytics and no crash reporting. Errors are written to a log file on your computer, which leaves it only if you send it to us yourself.

Updates: unless you turn off “Check for updates automatically” in Settings → About, the app checks for a new version shortly after it starts and then every 6 hours, by downloading a small file from GitHub, where our installers are hosted. Like any download, this lets GitHub see your IP address. We only see GitHub’s total download counts.

If you create an account, our server stores:

• your email address, your name if you give one, and when you verified your email address;
• your password, only as a salted Argon2 hash. We never store the password itself;
• if you sign in with Google: your Google account ID, email address and name;
• for each device you sign in on: its name (your computer’s name and operating system), an ID created by the app, when it signed in and when it was last used. Sign-in tokens are stored only as hashes.

We use this only to sign you in, keep your devices in sync, and send the emails described below.

When sync is on, our server keeps a copy of your workspaces, collections, folders, requests, saved examples, environments and global variables, so that each of your devices can download them. History and cookies are never synced.

Secret variable values sync only after you set up a secret vault, and only encrypted on your device. Our server stores the ciphertext, which it cannot decrypt; a value derived from your PIN, which lets it check the PIN without learning it; and your vault key, encrypted. Without a vault, secret values are not synced at all.

Credentials typed directly into the Auth tab (tokens, passwords, API keys and client secrets) stay on your device, unless you choose “sync it as plain text” for that request.

Everything else you sync, such as URLs, headers, bodies, scripts, saved responses and variables that are not marked secret, is encrypted in transit (HTTPS) and protected on our server, but it is not end-to-end encrypted, so it is technically readable by whoever runs the server. Mark sensitive values as secret.

When you share a request, our server stores a copy of it under a random link: the request, the values of the variables it uses, the environment name and, if you choose, its last response. Anyone who has the link can see this copy without signing in. Secret variable values are never included, and credentials are included only if you turn on “Include credentials”.

When someone sends the request from the shared page, it goes through our server, which forwards it once to the target API and returns the response. We do not store these requests or their responses.

The copy is deleted when the link expires (you choose when; one week by default), when you stop the link, or when you delete your account. Links created before Rocketly 1.2 have no expiry date.

When you send collections or environments to people, our server stores a copy of them, the recipients’ email addresses and your optional message, and emails each recipient. Secret values and credentials typed into the Auth tab are left out unless you turn on “Include secret values”. The email shows your name and email address, what you shared and your message.

Recipients are matched by email address: someone without an account sees the share after signing up with that address. We use their address only to deliver the share. Accepting imports a copy into the recipient’s workspace; changes on either side are not shared afterwards.

The copy on our server is deleted once every recipient has accepted or declined, after 30 days, or when you delete your account.

We send emails about your account (to verify your email address and to reset your password), and to the people you share collections or environments with. They are sent through Google’s Gmail SMTP service. We do not send newsletters or marketing emails.

This website uses no analytics, ads or trackers, and sets no cookies of its own. Its fonts and images are served from our own server. The only third-party script is Google reCAPTCHA, on the feature request page (see below).

The Changelog page loads release notes from GitHub in your browser, and the download links take you to GitHub. GitHub then receives your IP address and browser details, as described in GitHub’s privacy statement.

We use Google Search Console to see how this website appears in Google Search. It reports search data in aggregate and does not track visitors on this website.

The feature request form on this website sends us what you type: the title, the description, the area you choose and, if you give one, your email address, plus the page’s language. Our server emails it to us and does not store it in its database. We keep these emails in our mailbox for as long as we need them to plan and follow up, and use your email address only to answer your request.

The form is protected by Google reCAPTCHA (“I’m not a robot”), which loads only on the form’s page. To tell people from bots, Google collects information such as your IP address, browser details and how you use the page, and may set cookies, under the Google Privacy Policy and Terms of Service. Our server sends Google the captcha answer and your IP address to check it.

Requests you post on GitHub instead are public, and covered by GitHub’s privacy statement.

Our web server records the IP address, time, requested address and browser identification (user agent) of each request. These logs are kept for 14 days, to keep the service secure and to fix problems.

The sync server logs only the method and path of each request, without IP addresses, headers, tokens or content. These logs are kept for 7 days. IP addresses are also held briefly in memory to limit the rate of requests.

• to provide the service: sign-in, sync, shared links, sharing with people and account emails, and to read and answer your feature requests;
• to keep it secure: rate limiting, preventing abuse and investigating problems;
• to comply with the law.

We do not sell or rent personal data, show ads, build profiles of you, or use your data to train AI models.

Where the law asks for a legal basis: we process account, sync and sharing data to provide the service you signed up for under the Terms of Service, and recipients’ addresses to deliver what a user sends them; logs and security data for our legitimate interest in keeping the service safe; and data we are required to keep to meet legal obligations.

If you sign in with Google, we ask Google only for the basic “openid”, “email” and “profile” permissions. We receive your Google account ID, your email address, whether Google has verified it, and your name. We use them only to sign you in and to link your Google identity to your Rocketly account. We get no access to your Gmail, Drive, contacts or any other Google data.

We do not sell Google user data, use it for advertising, or share it with anyone except as needed to run Rocketly or to comply with the law. Rocketly’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Rocketly’s access in your Google Account settings at any time. Deleting your Rocketly account also deletes the link to your Google identity.

We use these companies to run Rocketly:

• Hostinger: the virtual server that runs this website and the sync service, including its database and backups;
• Google: sends our account emails and delivers feature requests to us (Gmail SMTP), provides “Sign in with Google” if you use it, and reCAPTCHA on the feature request form;
• GitHub: hosts our installers, the update feed and our public issue tracker.

They may process data in countries other than yours. We disclose data to authorities only when the law requires it.

• Account and synced data: as long as your account exists.
• Shared links: until they expire, you stop them or you delete your account. Shares with people: until every recipient has answered, at most 30 days.
• When you delete your account, your account, devices, synced data, vault, shared links and pending shares are deleted from our database immediately. They remain in our nightly database backups for up to 14 days, after which those backups are deleted.
• Sign-in and email tokens: deleted one day after they expire. Signed-out devices: deleted after 30 days.
• Feature requests: in our mailbox for as long as we need them.
• Web server logs: 14 days. Sync server logs: 7 days.

All traffic to our servers uses HTTPS. Passwords are hashed with Argon2, sign-in and email tokens are stored only as hashes, and secret values are end-to-end encrypted with your vault. No system is perfectly secure: if a breach affects your personal data, we will inform you and the authorities as the law requires.

• Use Rocketly without an account, and nothing is sent to us.
• Change your name or password, turn sync off for a device, sign out, or sign out of all devices in Settings → Account & Sync.
• Export your collections and environments from the app at any time.
• Delete your account and all synced data: Settings → Account & Sync → Delete account.

Depending on where you live, for example under the GDPR in the European Union or the Personal Data Protection Law in Vietnam, you may also have the right to access, correct, export or delete your personal data, to restrict or object to its processing, to withdraw your consent, and to complain to a data protection authority. To use these rights, contact us as described below.

Rocketly is a tool for developers and is not meant for children. Do not create an account if you are under 16.

If we change this policy, we will update the date at the top of this page. For important changes, we will announce them on this website or in the release notes before they take effect.

For privacy questions or requests, open an issue on GitHub. Issues are public, so do not post personal data there: just say that your request is about privacy, and we will reply with a private way to continue, for example by email to the address of your account.