Privacy policy

• The CLI and the studio run on your computer. They only talk to us when you use Cloud.
• Cloud keeps your email, your teams and the collections you publish, so it can share them.
• We don’t sell your data, show ads, or use your collections to train AI models.
• This website and Cloud set no tracking cookies.

curl-runner.com counts page views with Pulsora and Vercel Web Analytics. Neither sets cookies or stores anything in your browser. They record the page, the referrer, the browser, the device type and the country. Your IP address is used to work out the country and isn’t kept with the page views.

Your collections, requests, responses and environment values stay on your computer. The CLI and the studio send nothing to us unless you sign in to a Cloud server, publish, pull, sync, or open a shared link.

When you open a shared collection, the values you type into its form, such as API keys, stay on your computer. They are never sent to Cloud.

When you use curl-runner Cloud at cloud.curl-runner.com, we keep:

• Your email address, and your name if GitHub or Google gives us one.
• For each sign-in method you link, the account ID and email address it reports. With GitHub we ask for your profile and email addresses (read:user and user:email). With Google we ask for openid, email and profile. We use them once, to sign you in, and don’t keep the access token.
• Your sessions: a name such as “Browser” or the CLI, when each started and when it was last used. We store a hash of each session token, not the token.
• Your teams, your role in each, and the invites you send or receive.
• Publish tokens your team creates: a name, who made it and when it was last used. Again, only a hash.
• The collections you publish: their files, every version, who or which token published each one, and the git commit and branch when CI sends them.
• Copies of the emails we send you: sign-in codes, invites, share notices, billing notices and, unless you turn them off, occasional product emails.

Cloud uses one cookie, cr_session, to keep you signed in, and short-lived cookies while you sign in. Your IP address is used to limit how often someone can try to sign in. It isn’t stored with your account. Actions taken in the admin panel are logged with the admin’s IP address.

The Cloud database runs on servers in Germany. Only the people who run curl-runner Cloud can reach it, and we look at your data only to give you support, when the law requires it, or to keep the service secure.

Sign-in with Google only reads your name, email address and Google account ID, to sign you in. curl-runner’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove access at any time from your Google account permissions.

A team can share a collection publicly, or only with the email addresses and domains it lists. For a restricted collection we keep that list. When you open a shared collection while signed in, we record that you opened it, at most once a day. That’s how Shared with me finds it, and how the team sees whether the people on its list have opened it. Opening a public collection without signing in isn’t recorded.

If a team adds your email address to a collection, we keep it and may email you a link. The team decides who is on the list. Ask them, or us, to take you off.

Payments run through Stripe. Your card details, billing address and any tax ID go to Stripe, not to us. We keep the Stripe customer and subscription IDs, the billing interval and the subscription status.

These companies process data for curl-runner.

• Sessions end 90 days after they were last used, or when you sign out or revoke them.
• Sign-in codes expire after 10 minutes, and invites after 7 days.
• Collections and their versions stay until the team deletes them, or deletes the team.
• The admin activity log is kept for 2 years.
• Your account stays until you ask us to delete it. Some records, like copies of sent emails, stay in the database after you delete something. Write to us to have them erased.

You can ask us to show, correct, export or delete the data we hold about you. Write to hello@curl-runner.com from the email address on your account, and we’ll answer within 30 days.

Questions about this policy go to hello@curl-runner.com. If we change it in a way that matters, we’ll email Cloud account holders before the change takes effect.