Summary
FlowProxy collects no data. It has no account system, no analytics, no telemetry, and no server component. Everything it captures stays on your Mac.
What FlowProxy does
FlowProxy is a debugging proxy. You configure a browser or app to send its network traffic through FlowProxy, and FlowProxy displays that traffic so you can inspect it: request and response headers, cookies, bodies and timing.
To show the contents of HTTPS connections it generates a certificate authority on your Mac and issues per-host certificates signed by it. This happens entirely on your machine. The certificate authority and its private key are never transmitted anywhere.
Data we collect
None. We operate no servers that receive data from the app.
FlowProxy makes no network connections of its own. It does not check for updates, report crashes, or contact FlowStations. The only connections it opens are to the destinations that the traffic you route through it is addressed to — the same connections your browser or app would have made on its own.
Data FlowProxy handles on your device
Captured traffic. Requests and responses you route through the proxy, including headers, cookies and bodies, are held in memory and, for larger payloads, in a temporary directory inside the app's own container. They are discarded when you quit the app. They are never uploaded.
Certificates. The certificate authority and the per-host certificates FlowProxy issues are stored in your macOS keychain. The per-host certificates are deleted when you quit, and any left behind by an unexpected termination are removed the next time the app starts. The certificate authority is kept so that you do not have to trust a new one each time.
Settings. Your listen port and preferences are stored locally by macOS.
Exported files. If you use Export Sessions, the file is written where you choose and is yours alone.
The optional local API
FlowProxy can expose captured traffic to tools running on your Mac, including AI coding assistants that connect over the Model Context Protocol. This feature is off unless you turn it on.
When enabled, it listens only on 127.0.0.1, which is reachable from your
own machine and not from the network. Every request must present a bearer token
generated on your Mac. Turning the switch off stops it immediately.
If you connect an AI assistant to it, captured traffic you ask about is sent to that assistant, and that assistant's own privacy policy then applies to it. That transfer happens because you configured it, not because FlowProxy initiates it.
Network exposure
By default FlowProxy accepts connections only from your own Mac. There is an optional setting to accept connections from other devices, useful for capturing traffic from a phone or virtual machine. It is off by default, and while it is on, any device that can reach your Mac on the network can route traffic through the proxy.
Children
FlowProxy is a developer tool and is not directed at children.
Your rights
Because we hold no data about you, there is nothing for us to disclose, correct or delete. Removing the app and deleting the FlowProxy CA from Keychain Access removes everything it created.
Verification
FlowProxy runs entirely on your Mac. You do not have to take that on trust: the app makes no outbound connections of its own, which you can confirm with any network monitor — including FlowProxy itself.
The source is also published for inspection: https://github.com/corleylun/flowproxy
Changes
Material changes to this policy will be posted on this page with a new date.
Contact
FlowStations — support@flowstations.net