Privacy Policy · API Tester · Nax Technology



Privacy

Privacy Policy

API Tester is an offline-first HTTP client. Your requests, tokens, and saved endpoints stay on your device. This page explains what is collected, what isn’t, and your rights.

App API Tester
Package com.nax.apitester
Publisher Nax Technology
Effective 2026-05-12

The short version

  • Every HTTP request you compose is sent directly from your device to the server you typed. We never proxy, log, or transmit your URLs, headers, bodies, or tokens through our servers.
  • There is no account, no sign-in, no telemetry, no analytics.
  • Saved collections, environment variables, and history live in local app storage only.
  • If ads are shown to free-tier users, Google AdMob handles them and may collect advertising identifiers, as described below.
  • If you make a Pro purchase, Google Play Billing handles payment. Your card details never touch our code.

What stays on your device

The app uses local storage (shared_preferences) to remember:

  • Your saved request collections — method, URL, headers, body, auth.
  • Your environment variables — including any API keys or bearer tokens you choose to store as secret values.
  • Your request history — method, URL, status code, and timing only.
  • Your settings — accent colour, active environment, plan tier.
  • Whether you’ve completed onboarding.
  • Your Pro / ads-removed entitlement flag (revalidated against Google Play Billing on launch).

Nothing is transmitted off your device by us. Uninstalling, or Settings → Apps → API Tester → Storage → Clear data, deletes all of it.

The HTTP requests you send

API Tester is a network tool — its core feature is to send HTTP requests over the public internet to whatever URL you enter, with whatever headers and body you compose. Those requests go directly from your device to the server you’ve chosen, exactly as if you’d typed the URL into curl. We do not proxy or inspect them.

Be aware that any third-party server you call may receive and log the request you send it (URL path, headers, body, your IP). That behaviour is governed by that server’s privacy policy, not ours.

Cleartext (non-HTTPS) traffic

The app permits http:// URLs because developers routinely test against local servers (e.g. http://10.0.2.2:8000, http://localhost:3000). When you send a cleartext request, the contents are visible to any device on the network path. Prefer https:// for any traffic over public networks.

What is never collected

  • The contents or destinations of your HTTP requests. We do not see your URLs, headers, request bodies, response bodies, or tokens.
  • Your name, email, IMEI, advertising ID (other than what AdMob may use — see below), or any device identifier.
  • Contacts, photos, microphone, location, or other device sensors.
  • Crash logs or stack traces (no Firebase Crashlytics, no Sentry, no third-party SDK is bundled).

Advertising

The free tier may show a single banner on the Collections and Settings tabs, plus an occasional interstitial after a successful Send, served by Google AdMob. AdMob may collect, in line with its own Privacy Policy:

  • Your device’s advertising identifier (resettable by you in Android settings).
  • Approximate technical info: device model, OS version, network type, country.
  • Ad interaction events (impressions, clicks).

If you live in the EU/EEA, UK, or California, the app will show a consent dialog (via Google’s UMP) before any personalised ad request. Choosing “Reject” or “Limit ads” will serve non-personalised ads only. Buying Remove ads (or upgrading to Pro) stops AdMob from being initialised at all.

In-app purchases

Optional purchases (API Tester Pro, Remove ads) use Google Play Billing. Google handles your payment; we receive only an “owned / not owned” signal per product ID. We never see your card or billing address.

Children

API Tester is a developer tool intended for users 13+ (see Play Store age rating). It is not directed at younger children. We do not knowingly collect data from children, and the app has no field where a child could enter identifying information.

Your rights

Under GDPR (EU/EEA/UK) and CCPA/CPRA (California), you have the right to access, correct, port, and delete your personal data. Because API Tester doesn’t collect personal data on our servers, those rights are exercised by:

  • Access / portability: open the app — your collections, env vars, and history are what you see.
  • Deletion: clear app data or uninstall.
  • Advertising opt-out: limit ad tracking in Android settings, or buy Remove ads / Pro.

If you need to contact us about a privacy concern, email [email protected].

Changes to this policy

If we add new data uses (e.g., a new third-party SDK), we will update this page and bump the effective date above. Material changes will be reflected in the app’s release notes.