What the analysis browser observes
Google Chrome must be installed on your machine; it is the only additional application apispy requires. apispy opens a dedicated Google Chrome profile and observes its traffic through the Chrome DevTools Protocol. Chrome has already handled HTTPS when the capture receives the request and response information. There is no root certificate to install and no system proxy to configure.
This scope is the analysis browser, not every application on your computer. The browser makes normal network connections to the sites you visit. Its persistent profile can retain sign-ins between captures.
What stays on your machine
The application builds its inferred models locally and saves a resumable session in a local SQLite database, together with generated specifications. Closing the analysis browser stops capture and saves the session. Reopening it continues into the same workspace.
Domain icons are retrieved through the analysis browser from the website itself and cached locally. The application does not use a third-party favicon lookup service.
How example values are handled
Captured observations can contribute example values to the generated documentation. apispy filters values under property names recognized as passwords, tokens, API keys, cookies and similar sensitive fields. It also guards certain personal-data field names. Header values are not stored in the inferred documentation; header names and authentication schemes can be recorded.
These filters are heuristics, not a guarantee of anonymization. Unrecognized field names and retained examples can still expose information. Review exports before sending them to another person or service.
Multipart submissions retain field names and file markers rather than uploaded file contents. Non-JSON stream text can appear as truncated samples. The separate Chrome profile may retain cookies and other browser data needed to keep your browsing session signed in.
Control what enters the workspace
Exclude a domain to stop new observations for that exact host and remove it from workspace totals. Previously captured data is retained so the domain can be restored later. Exclusion does not delete those earlier observations.
The app’s reset action clears the current capture after confirmation. It is not a promise to erase browser-profile data or exported files. Manage those separately when you need to remove them.
This website
This marketing site serves static pages, images and locally hosted fonts. It contains no analytics script, advertising tracker or sign-up form. Normal web requests still reach the hosting provider, whose operational logging depends on deployment configuration.
Pricing and license terms for a future paid version have not been announced. If accounts, payments or optional online services are introduced, their data handling will need to be documented when they become available.