Privacy Policy for HTTP Request Lab

About this policy

HTTP Request Lab is provided by Aktyva konsaltynh technologies. This policy describes how the Android app handles information when you build HTTP requests, inspect responses, organize your workspace, and share exports.

Privacy contact: mateuszbednarski696@gmail.com

Information accessed and stored

The app processes the information you enter, including request names, URLs, headers, query parameters, request bodies, form values, collection names, and environment variables. This information may include credentials, API keys, tokens, or personal information if you enter them.

The app saves drafts, saved requests, collections, environments, the selected environment, timeout settings, and request history locally on your device. History contains request snapshots and results, including destination URLs, timestamps, HTTP status, response headers, retained text bodies, elapsed time, retained body size, and error messages. Responses may contain personal or confidential information supplied by the servers you contact.

The app retains the latest 80 request attempts. Each attempt retains up to 1 MiB of response body data for text responses. Bodies identified as binary are not retained as text previews.

No account is required. The inspected application does not implement advertising, analytics, tracking, or automatic reporting of your workspace to the developer. It requests internet access; it does not request access to contacts, location, camera, microphone, or shared device files.

How information is used

The app uses your information to construct and send requests, substitute enabled environment variables, display responses and failures, save your workspace, reopen previous attempts, and create exports you choose to share. JSON validation and formatting occur within the app.

Network requests and recipients

Requests run when you press Send. The app sends the configured request directly to the HTTP or HTTPS destination you choose. That destination receives the URL and enabled request data, including headers, query values, applicable body content, and substituted environment values. The server and network infrastructure involved in delivering the request may also receive connection information such as your IP address.

Marking a value as secret masks it in supported editor fields; it does not prevent that value from being sent when used in a request. Disabled rows are retained locally but are not sent. Redirect responses are displayed without automatically following them.

The services you contact handle received information under their own policies. Their storage, use, sharing, and deletion practices are outside the app's control. The inspected app does not route requests through a developer-operated backend or implement automatic uploads to the developer.

Sharing and exports

When you choose an export or sharing action, the app opens Android's sharing interface. The app or recipient you select receives the exported text and handles it under its own practices.

Request and collection exports redact headers marked secret or recognized by sensitive header names, remove URL query content, redact query and form values, and omit request bodies by default. Request-and-result exports also omit response bodies and headers by default. You can choose to include request secrets when exporting a request or request-and-result record, which includes unredacted request content and, for a full record, response content.

Raw response sharing sends the retained response text without redaction. Automatic redaction does not identify every possible secret, particularly information in names, URL paths, or ordinary header values. Review every export before sharing it.

Third-party software

The app uses OkHttp to make network requests and Android and Kotlin/Compose libraries for its interface, local processing, and storage. The inspected dependencies do not include advertising, analytics, or crash-reporting SDKs. Network destinations and apps you select for sharing are the external recipients involved in those actions.

Security

On Android, the saved workspace is encrypted using AES-GCM with a key managed by Android Keystore and stored in the app's private preferences. Android application backup is disabled in the app configuration. Supported secret fields can be masked and revealed in the interface, but their values remain part of the saved workspace.

HTTPS requests use TLS with certificate validation enabled. The app also permits plain HTTP requests, which do not provide transport encryption. Protection in transit therefore depends on the destination URL you choose. No storage or transmission method guarantees complete security.

Retention and deletion

Drafts, collections, saved requests, environments, and settings remain locally until changed, deleted where controls are available, or removed by clearing the app's data or uninstalling it. History retains up to 80 attempts, with older entries replaced as new attempts are added; there is no fixed time-based expiry.

You can delete saved requests, collections and their saved requests, environments, and individual history entries, or clear all history. Removing an item from one location does not necessarily remove copies in drafts, saved requests, or history. Clear the app's data through Android settings to remove the entire local workspace.

For privacy or deletion questions, contact mateuszbednarski696@gmail.com. The inspected app has no remote workspace or account-deletion service, and the developer cannot access or erase your device's local workspace through the app. Deleting local information does not delete data already received by a request destination or sharing recipient; contact that recipient about its deletion procedures.

Children's privacy

HTTP Request Lab is a technical tool for building and testing HTTP requests. No specific target age groups were supplied, and the inspected app does not collect age information or implement a child-specific experience. The developer does not receive workspace information through an automatic collection mechanism in the inspected app. Information entered into requests can still be sent to the destinations the user chooses.

Changes to this policy

This policy may be updated to reflect changes in the app's behavior or data practices. Review the version made available with the app or its store listing for updates.

Contact

Developer: Aktyva konsaltynh technologies
App: HTTP Request Lab
Privacy questions and deletion inquiries: mateuszbednarski696@gmail.com