Privacy policy

Last updated November 5, 2026

Monkeytail collects no data. The app has no analytics, advertising, tracking, telemetry, account system or developer-operated backend. We never receive your requests, responses, collections or credentials.

About the app

Monkeytail is an open-source API client for iPhone, iPad, Mac and Apple Vision Pro, with an Apple Watch companion. Its source code is public at github.com/iebb/Monkeytail, so you can check everything on this page yourself.

On your device

Workspaces, collections, requests, environments, globals, scripts, proxy settings and request history are stored in the app's own storage, protected by platform file protection and, on the Mac, the app sandbox. Credentials are stored in those files, or in the system Keychain if you turn on Use Keychain in Settings (off by default). Response bodies stay in memory unless you save a snapshot or export them. Device backups follow your Apple settings.

iCloud sync

iCloud sync is on by default. It stores workspaces, collections, environments, globals and scripts in your own iCloud Drive and shares them between your devices using your existing Apple account. No Monkeytail account is involved, and we cannot access this data.

Include credentials is also on by default, so authentication and other sensitive fields sync too. Turn it off in Settings to keep credentials on each device, or turn off iCloud sync to keep everything local. Cookies, client certificates, uploaded files, saved snapshots and request history never sync. Turning sync off stops transfers but doesn't delete files already in iCloud; manage those in Apple's iCloud storage settings.

Connections you choose

When you send a request, Monkeytail connects directly to the server and any proxy you chose. They receive what is needed to handle the request, including its headers, body, credentials and your network address, and their own privacy practices apply. Importing a collection never sends a request on its own.

Importing from other services

If you choose to import from Postman, Insomnia, Hoppscotch or GitHub, Monkeytail signs in to that service directly from your device, the same way its own app does. Your sign-in and session are sent only to that service, used only for that import, and discarded afterwards. They are never stored and never sent to us.

Authentication, cookies and certificates

OAuth opens your chosen provider in a private browser session; that provider may ask you to sign in. Tokens are stored with your workspace. Cookie jars and client certificates stay on your device, in files or the Keychain, and are never synced or sent to us. Offline mocks run on the device, and the optional mock server only listens on the device's own loopback address.

Apple Watch

Favourite requests are copied from your iPhone to your Apple Watch with Apple's WatchConnectivity. The Include credentials & body option controls what is copied. The Watch sends requests directly to your servers, and responses stay in memory.

Files and scripts

Monkeytail reads only the files and photos you pick for import or upload, and writes only the files you export. Exports can include saved credentials. Scripts run locally in an isolated JavaScript context; their only network access is pm.sendRequest, which goes to the servers the script names, through your selected proxy. Each request has a Run scripts switch to turn scripts off.

Your choices

You can edit or delete any workspace data, clear history, turn off sync or credential sync, or delete the app to remove its local data. Exported files and backups stay under your control.

Contact

If you email support@ieb.app, we receive what you send and use it only to reply. Please don't include passwords, tokens or private request contents.

Changes

We will update this page if Monkeytail's data practices change. The date at the top shows the latest revision.