What the analysis browser observes
Google Chrome must be installed on your machine; it is the only additional application apispy requires. apispy opens a dedicated Google Chrome profile and observes its traffic through the Chrome DevTools Protocol. Chrome has already handled HTTPS when the capture receives the request and response information. There is no root certificate to install and no system proxy to configure.
This scope is the analysis browser, not every application on your computer. The browser makes normal network connections to the sites you visit. Its persistent profile can retain sign-ins between captures.
What stays on your machine
The application builds its inferred models locally and saves a resumable session in a local SQLite database, together with generated specifications. Closing the analysis browser stops capture and saves the session. Reopening it continues into the same workspace.
Domain icons are retrieved through the analysis browser from the website itself and cached locally. The application does not use a third-party favicon lookup service.
How example values are handled
Captured observations can contribute example values to the generated documentation. Under property names recognized as passwords, tokens, API keys, cookies and similar sensitive fields, apispy publishes a variable such as {{ACCESS_TOKEN}} in place of what it saw, so the document says what to substitute without carrying the value. It does the same for certain personal-data field names. Header values are not stored in the inferred documentation; header names, authentication schemes and whether a bearer token was JWT-shaped can be recorded, which is what lets the specification describe how the API authenticates.
These filters are heuristics, not a guarantee of anonymization. Unrecognized field names and retained examples can still expose information. Review exports before sending them to another person or service.
Multipart submissions retain field names and file markers rather than uploaded file contents. Non-JSON stream text can appear as truncated samples, with credential-looking tokens rewritten as variables. The separate Chrome profile may retain cookies and other browser data needed to keep your browsing session signed in.
Control what enters the workspace
Exclude a domain to stop new observations for that exact host and remove it from workspace totals. Previously captured data is retained so the domain can be restored later. Exclusion does not delete those earlier observations.
The app’s reset action clears the current capture after confirmation. It is not a promise to erase browser-profile data or exported files. Manage those separately when you need to remove them.
Application launch statistics
Starting with v0.2.1, apispy sends a small first-party usage signal on startup: a random installation identifier, a random event identifier, the application version, operating system and processor architecture. It contains no capture data, URLs, account details or machine name. The server hashes the installation identifier to distinguish first observed launches from reopenings. Events and inactive installation records are removed after 180 days.
You can turn this off in Help → Share app launch statistics, or start the app with APISPY_TELEMETRY=0. The app works normally without this signal, including offline. Development builds do not send it. Existing v0.2.0 releases do not contain launch measurement.
This website
This marketing site serves static pages, images and locally hosted fonts. It uses first-party usage measurement to count browsing sessions and download requests. A random identifier in session storage groups page visits in the same tab until 30 minutes of inactivity; no tracking cookie, fingerprint, referrer or query string is collected. Do Not Track and Global Privacy Control are respected. Known robots are excluded. Download counts measure requests, not completed transfers. Events are retained for 180 days. IP addresses are not stored in the statistics database; they are briefly used in memory for rate limiting. Normal web requests still reach the hosting provider, whose operational logging depends on deployment configuration.
The download page links to an optional contribution page hosted by Stripe. Following that link leaves this website. Stripe handles the payment under its own terms; this website neither receives nor stores payment details, and contributing is not required to download or use apispy.
Pricing and license terms for a future paid version have not been announced. If accounts, payments or optional online services are introduced, their data handling will need to be documented when they become available.