Privacy Policy
Last updated: July 6, 2026
Heron is built local-first. The short version: the traffic you capture never leaves your machine, and the app sends us nothing about you. The details below cover the app, the website, and purchases.
The app
- Captured traffic stays on your Mac. Requests, responses, headers, bodies, and logs are stored locally. Heron has no server component that receives, mirrors, or analyzes your traffic.
- No telemetry, no analytics, no account. The app does not track usage or require sign-in.
- Diagnostics are user-initiated. If you export a diagnostics report to share with support, you generate the file yourself and choose what to do with it. Captured request/response content is structurally excluded from these reports.
- Update checks. Heron checks getheron.app for new versions (via the Sparkle framework) — only after asking for your permission, and you can turn it off. An update check is a normal web request: our host sees your IP address and the app version, and we do not build profiles from it.
- License activation. Activating a paid license sends your license key to our payment provider for validation. No captured traffic or usage data is included.
The website
- Email signup. If you leave your email address to hear about releases, it is stored by us on Cloudflare infrastructure and used only for release notifications — no marketing lists, no third-party form services. We record the address and the signup time, nothing else. Write to us any time to be removed.
- No analytics cookies. This site currently runs no analytics and sets no tracking cookies. It is served by Cloudflare, which processes standard request logs (such as IP addresses) to deliver the site.
Purchases
Purchases are handled by Dodo Payments, our merchant of record. When you buy a license, Dodo Payments collects your billing information under its own privacy policy; we receive the order details (your email address and license information), never your full payment details.
Your data, your call
We keep almost nothing, so there is little to request — but if you want your email removed from the release list or have any privacy question, contact us and we will sort it out promptly.
Changes
If our practices change, this page will be updated with a new "last updated" date. The local-first commitment — your captured traffic stays on your machine — is the product's foundation and will not change.