Privacy
Privacy Policy
Yamlet is a local-first desktop API client. It has no account, no sign-in, and collects no usage analytics.
Last updated: 24 May 2026
The short version
Yamlet stores your collections, requests and environments as plain YAML files on your own machine. It does not send your data anywhere except to the API endpoints you choose to call. There is no telemetry, no tracking, and no account.
What Yamlet stores, and where
- Your workspace — collections, requests, environments and globals — is read from and written to YAML files in the folder you open. Yamlet never uploads it.
- Local app cache — a small JSON file in your user app-data directory records recently opened workspaces and, per workspace, your open tabs, active tab and selected environment, so your session restores on reopen. It stays on your device.
- Secrets — tokens, client secrets and other credentials you enter live in your workspace YAML and/or the active environment, on disk. Treat those files accordingly (for example, keep secrets out of version control).
Network activity
Yamlet only makes network connections that you initiate:
- Sending a request contacts exactly the URL you configured, with the headers, body and auth you set. Every request includes a
User-Agent: Yamlet/1.0.0header. - OAuth 2.0 contacts the token and authorization endpoints you configure (for example your identity provider). For the authorization-code flow, Yamlet opens your system browser and listens on a temporary local
127.0.0.1address to receive the redirect — nothing leaves your machine beyond the provider you specified. - Yamlet does not phone home, check for updates automatically, or send diagnostics.
This website
This marketing site is hosted on GitHub Pages and the Download and Releases links point to GitHub Releases. When you visit the site or download a build, your request is handled by GitHub, whose own data practices apply. The site sets no cookies and embeds no advertising trackers.
Third parties
- GitHub — hosts the source, the release downloads and this site (GitHub Privacy Statement).
- API endpoints & identity providers you configure — receive the requests and OAuth calls you make through Yamlet. Their handling of that data is governed by their own policies.
Your responsibility for secrets
Because everything is local YAML, you control your credentials. Avoid committing files containing real tokens or secrets to shared repositories, and prefer environment variables for sensitive values.
Contact
Questions about privacy, or anything else? Email piyushdoorwar+yamlet@gmail.com or open an issue on GitHub.