Privacy policy

Last updated 2026-10-24

DevTools is a set of developer tools that run in your browser. This page explains what we store, where, and how to remove it. It applies to devtools-sepia-seven.vercel.app.

Without an account

• The tools run in your browser. What you paste, type or open in a tool is processed on your device and saved in your browser's storage. It is not sent to us.
• API Studio sends the requests you build directly from your browser to the address you enter. If you install the companion browser extension, it sends those same requests from your browser. Neither passes through a server of ours.
• No analytics, no ads, no tracking cookies. We don't use third-party scripts or fonts.
• Our hosting provider (Vercel) receives standard request information when your browser loads the site, such as your IP address and browser version, and keeps it in its logs for a short time.

With an account

Signing in is optional. If you sign in, we store:

• Your email address, and the name and profile picture your GitHub or Google account shares, if you sign in that way.
• Your signed-in devices: for each one, the browser it uses, its IP address and when you signed in. You can see this list and sign devices out on your account page.
• Sign-in links we email you, until they are used or expire (10 minutes).
• A connection to your GitHub or Google account, if you use one to sign in, including the access token those services give us, encrypted. We don't use it to read anything from those accounts.
• Short-lived counters of sign-in attempts per IP address, to stop abuse.
• Your encryption key, sealed with your recovery code, if you turn on encryption. We can't open it: the key and the code are made in your browser and never sent to us in readable form. While one of your devices asks another for the key, we also keep that request (the device's name, its public key and, once approved, the key sealed for that device only) for up to 10 minutes.
• Webhook inboxes you create: each inbox's public key and a fingerprint of its read token, how many requests it received and when, and what it answers with. Requests sent to an inbox are encrypted the moment they arrive with a key only your devices (and your team, for a team inbox) have, and stored that way: the last 100 per inbox, for at most 7 days. We can't read them afterwards.
• What you sync, encrypted, if you turn on sync on a device: your API Studio collections, environments and webhook inboxes, architecture diagrams and their versions, system designs, ER diagrams, notebooks and dashboards. They are encrypted in your browser with your key before they are sent, and stored under scrambled names, so we can't read them or tell which tools they come from. We see only their size, when they changed and a version number.
• Teams you're in: the team's members (their name, email and picture, so members can see who's in it), each member's role and when they joined, the team's name and its workspace (the same kinds of data as sync), all encrypted with a team key that only members have; we see only sizes and dates. Invite links work like short links: what lets someone in is in the link itself, after the #, and an invite works once, for 7 days.
• What you publish: a hosted mock or API docs you publish from API Studio is a readable copy: for a mock, its mock responses; for docs, the collection's names, descriptions, URLs, parameters, headers and example bodies, with credentials (auth values, Authorization, Cookie and API-key headers) and secret variables left out. Our server reads it to serve it, anyone with its link can use it, and we count the calls or views. It stays until you unpublish it.
• Short links you make, if you share something while signed in: what the link opens, encrypted in your browser with a key that exists only in the link itself (after the #, which browsers never send to us), so we can't read it. We store who made it, its size and when it expires (90 days); anyone who has the link can download the encrypted copy. Without an account, share links carry everything in the link and nothing is uploaded.

We use this only to sign you in and keep your account secure. We don't sell it or share it with anyone except the services that run the site for us (below).

Without sync, an account doesn't upload your work. Sync is off until you turn it on, separately on each device.

Services that process data for us

• Vercel hosts the site and the API.
• Neon hosts the database with your account information.
• Resend sends sign-in emails.
• GitHub and Google, only when you choose to sign in with them.

Deleting your data

• Teams: leave a team on your account page; its owner can remove members or delete the team, which deletes its workspace on our server. Leaving or being removed also deletes the team's workspace from your browser.
• Webhook inboxes: Clear removes an inbox's captured requests; Delete removes the inbox and everything it captured.
• Published mocks and docs: unpublish them in API Studio or on your account page; they stop working right away.
• Short links: delete them on your account page; they stop working right away.
• Synced data: "Delete synced data" on your account page removes the encrypted copies from our server. Resetting your encryption also deletes them, because nothing can open them any more.
• Your account: delete it on your account page. This removes your account, your devices, your sealed encryption key, your synced data, your short links, what you published, the teams you own (with their workspaces), your team memberships and your GitHub or Google connections immediately.
• Work saved in your browser: clear the site's data in your browser settings. You can download a backup first from the side navigation.

Changes

If this policy changes, we'll update this page and the date at the top.

Contact

Questions: open an issue at github.com/akshaiKumar23/devtools.