Who we are
APIDuck is a local-first mobile API client and debugger for iPhone and iPad, made by BDSoftware. This policy explains how the app handles your data.
Core principle
Where your data is stored
| Data | Location |
|---|---|
| Collections, requests, environments, history, mock rules | On-device database (SwiftData) |
| Secret variables, OAuth tokens | System Keychain (encrypted) |
| App settings (timeouts, toggles, lock state, etc.) | System preferences (UserDefaults) |
| The above (optional) | iCloud private database (CloudKit private zone, visible only to you) |
When iCloud sync is enabled (a Pro feature), collections and environments sync between your devices via Apple's CloudKit into your iCloud private database. We cannot access it — Apple does not expose private-database content to developers. Secret variables and OAuth tokens always stay in the on-device Keychain and never sync.
Sensitive data handling
- Request & response content: stored on your device and auto-purged according to your history-retention setting. If iCloud sync is enabled, it is encrypted and synchronized via Apple's CloudKit into your private database, which we cannot access.
- Credentials: authentication material (tokens, passwords, API keys) is stored in the system Keychain. Exports automatically redact common credential fields (such as
Authorization/Cookieheaders and auth configs), and Secret variables are always excluded from exports. Redaction is not exhaustive, however: tokens or api_keys in URL query parameters and sensitive fields in request/response bodies are not redacted — an export you share may still contain sensitive data, so review it before sharing. - OAuth sign-in: when you use OAuth 2.0 authentication, authorization opens in the system browser (Safari) and communicates directly between your device and the service provider. We never see your password, and tokens come back straight to the Keychain on your device.
- Clipboard: read only when you explicitly tap “Detect Clipboard” or similar buttons. The app never reads the clipboard in the background, and clipboard contents are never uploaded.
- Network requests: every request goes directly from your device to the destination address you entered in the app — no intermediate servers, no proxy of ours in the middle.
- App lock: optional Face ID / Touch ID unlocking uses on-device system authentication. Biometric data stays with the system and is never accessible to the app.
What leaves your device
The only network traffic the app generates is:
- API requests and WebSocket connections you explicitly send — directly to the addresses you entered;
- iCloud sync, if you enable it — between your device and Apple's CloudKit;
- in-app purchases — handled end-to-end by Apple StoreKit;
- OAuth authorization, if you use it — between your device and the third-party provider.
That's the complete list. There is no analytics beacon, no ad SDK, no crash reporter, no "diagnostic" ping.
Your rights
Because we hold none of your data, the strongest data-protection guarantee is architectural: deleting the app removes everything — the local database, settings, and Keychain entries go with it. iCloud-synced content can be removed at any time from your iCloud account, and it leaves your other devices when you delete it in the app.
If you have questions about your data, email support@bdsoftware.app. We will never ask you to send us request logs or exports that may contain credentials — and you should be suspicious of anyone who does.
Children
The app is not directed at children under 13 and collects no personal data from anyone.
This website
This page is a static website hosted on Cloudflare Pages. It sets no cookies, runs no analytics, and embeds no third-party content.
Changes & contact
Any updates to this policy will be posted here with a new effective date. Questions or concerns: support@bdsoftware.app, or via the App Store product page.