Privacy Policy

Effective 16 October 2026

Short version: Postie has no account and no analytics, and we run no servers that see your requests. Your collections stay on your Mac. Data only leaves it when you send a request, when Postie checks for updates, or when you turn on an optional feature that talks to a service you chose.

Postie is a macOS app made by Oğuz Berk Açar under the OBA Labs name (“we”). This policy covers the Postie app and this website, postie.obalabs.app.

1. What stays on your Mac

Your workspace: collections, folders, requests, environments, history and saved responses are kept in one file, workspace.json, in the app's data folder (~/Library/Application Support/app.obalabs.postie).
Secrets: secret variable values and credentials typed into auth forms (bearer tokens, passwords, API key values, OAuth client secrets) are stored in the macOS keychain, not in that file.
History: request headers are not kept in history, and secret values that appear in URLs are masked.
OAuth 2 tokens are held in memory only and are gone when you quit.

We cannot see any of this. Deleting the app and its data folder removes it; keychain items can be removed in Keychain Access.

2. What leaves your Mac, and where it goes

When	What is sent	To whom
You send a request	The request you built: URL, headers, body, credentials	The API you are calling, directly from your Mac
Postie checks for updates (shortly after launch, then every few hours)	A download of the latest release manifest; GitHub sees your IP address and the request	GitHub (github.com/oguzberkacar/postie-releases)
You sign in with OAuth 2	What the sign-in page asks for	The identity provider configured in your request
You turn on team sync (optional)	Your email address, the collections and environments you choose to share with secret values removed, and an activity record of changes	The Supabase project your team set up and controls
You use the chat or terminal assistant (optional)	Your messages and what the agent reads through Postie's tools, such as requests and responses (secret values are masked)	Anthropic (Claude Code) or OpenAI (Codex), through the CLI installed on your Mac and signed in with your own account

We are not a party to any of these exchanges. Each of those services handles data under its own privacy policy.

3. What we do not collect

No analytics, usage statistics or telemetry.
No crash reports sent automatically.
No advertising or tracking SDKs.
No account with us. Team sync accounts live in your team's own Supabase project.

4. The local assistant server

To let coding agents use your collections, Postie runs an MCP server that listens only on 127.0.0.1 (your Mac), on a random port, with a token that changes every launch. Postie writes a small config file with that address and token to its data folder so the claude CLI can connect. Agents never see secret values and cannot send requests to environments marked Protected.

5. Team sync

Team sync is off unless you set it up. It uses a Supabase project that you or your team create and control; we have no access to it. Secret values and auth credentials are removed before anything is uploaded, and your session token is kept in the macOS keychain. Variables that scripts create in a shared environment stay on your Mac. Who can read or change shared data is decided by the roles in your project.

6. This website

postie.obalabs.app is a static site hosted on Vercel. It sets no cookies and runs no analytics. Fonts are served from this site, not from Google. Vercel keeps standard server logs (such as IP address and browser) under its privacy policy. If you switch the theme, the choice is saved in your browser's local storage and never sent anywhere.

7. Email

If you write to us, we use your email address and message only to reply, and delete them when they are no longer needed. Issues you open on GitHub are public and governed by GitHub's terms.

8. Your rights

Because the app sends us nothing, we hold no personal data about you from using Postie. If you have written to us, you can ask what we hold, ask for a correction or ask us to delete it, under the GDPR or the Turkish Personal Data Protection Law (KVKK), by writing to the address below.

9. Children

Postie is a developer tool and is not directed at children under 13.

10. Changes

If what Postie sends or stores changes, this page changes with it and the date at the top moves. Material changes are also mentioned in the release notes.

11. Contact

Questions about this policy: info@obalabs.app

This policy is published in English and Turkish. If they differ, the English text applies.