Privacy Policy

Last updated: October 23, 2026

This policy covers the Bifurc desktop app, its engine and command-line tool (version 0.4.0 and later), the Bifurc Companion browser extension, and this website. Bifurc is free to use, with no accounts, organizations or payments. It is developed by Harshal Kudale ("we", "us").

The short version#

• Your workspaces, requests, mocks, captured traffic, certificates and secrets stay on your computer.
• Bifurc sends anonymous usage analytics: what kind of thing you did, never its content. They are on by default once you accept the Terms of Use and this policy, and you can turn them off at any time in Settings → Usage analytics. They are identified only by a random install ID, never by your GitHub account or any organization.
• Each event done inside a workspace also carries that workspace's random ID, so we can count how many workspaces exist. Collaborators who import the same repository share that ID. It is never a name, a URL or a path.
• From version 0.5.0, Bifurc looks once a day for a newer version. That request carries its version number and nothing else, and you can switch it off.
• Signing in to GitHub is optional. It is only needed to sync a workspace with a repository you own or to import one shared with you, and your GitHub token never leaves your device except to talk to GitHub.
• Bifurc runs no server that holds your data. Workspaces stay on your device and in your own GitHub repositories.
• We do not sell your data, show ads, or build a profile of you.

Data that stays on your device#

Bifurc is a local-first application. Everything you create or capture with it is stored in files on your device, including:

• Application settings and preferences
• Workspaces: requests, mocks, mappings, proxy rules, environments and health checks
• Vaults, encrypted with a passphrase only you know
• Captured network traffic, including request and response headers and bodies
• Certificates and private keys generated for HTTPS interception
• Git history of your workspaces

We do not operate servers that receive, store or back up any of this. Network traffic you route through Bifurc's proxies is processed on your device and is not sent to us.

Checking for updates#

From version 0.5.0, once you have accepted the Terms of Use and this policy, the engine looks once a day for a newer version of Bifurc. It downloads a small public file that lists the released versions, from bifurc.app or, if that does not answer, from GitHub.

• The request carries the Bifurc version and nothing else: no install ID, no account, nothing about your workspaces. As with any request over the internet, the servers necessarily see the IP address it arrives from.
• Bifurc only tells you that a newer version exists and how to get it. It does not download or install anything on its own.
• To switch it off, open Settings → About → Updates and turn off Check for updates automatically, or set the environment variable BIFURC_UPDATE_CHECK=0 before starting Bifurc. Check now still works when you ask.

Anonymous usage analytics#

To understand which parts of Bifurc are used and where it fails, the engine sends anonymous usage events to PostHog, an analytics provider that processes them on our behalf on servers in the United States.

When analytics are on#

Nothing is sent before you accept the Terms of Use and this Privacy Policy on first run. After you accept, analytics are on by default and stay on until you turn them off.

What is sent#

• What kind of thing you did, as an event name from a fixed list, such as request sent, mock created, workspace synced or engine started.
• Properties that describe its shape, each one a yes/no, a count, or a word from a fixed list. For example: the request type (rest, graphql, grpc, soap, websocket), the HTTP method, whether a script or test is present, how many headers there are, or the class of the response status (2xx, 4xx).
• How often each command ran, with the interface it came from (desktop app, command-line tool or browser extension) and whether it succeeded or which error code it returned.
• About the install: the Bifurc version, your operating system family (for example windows) and processor architecture (for example x86_64).
• A random install ID, generated on your device the first time analytics run. It is not derived from your hardware, your account or anything else about you, and it only tells us that two events came from the same installation.
• A workspace ID, only on events done inside a workspace: a random identifier belonging to the workspace and kept with it. It lets us count workspaces. It is not derived from the workspace's name, path, repository or your account. Because it travels with the workspace, everyone who imports the same repository, as its owner or as a collaborator, reports the same workspace ID.

Any kind of workspace (on your device only, with local git, synced with GitHub, or imported from a repository you own or were added to) is treated the same way. No GitHub account ID and no organization ID is ever sent.

What is never sent#

• Names of your workspaces, requests, mocks, environments, folders or files
• URLs, hostnames, ports, paths or patterns
• Headers, bodies, scripts, variables, secrets or anything else you typed
• Captured or proxied traffic
• Your GitHub username, token, repositories or their contents
• Your name, email address or precise location

Bifurc asks PostHog not to create a person profile for the install ID and not to look up a location from the request. As with any request over the internet, PostHog's servers necessarily see the IP address the request arrives from; we do not use it to identify you.

Turning analytics off#

Open Settings → Usage analytics and switch it off, at any time. From then on nothing you do is reported. Two things to know:

• With the switch off, a single app installed event (version, operating system, architecture and the random install ID) is still sent once per installation, if it has not been sent already, so that we can count installs.
• To send nothing at all, including that one event, set the environment variable BIFURC_TELEMETRY=0 or DO_NOT_TRACK=1 before starting Bifurc.

The switch and the two environment variables apply to the whole app, whichever workspace you have open.

Legal basis and your choices#

We rely on your acceptance of the Terms of Use and this policy, and on our legitimate interest in understanding how the product is used, to collect these anonymous events. You can withdraw at any time with the switch above; withdrawing does not affect anything in the app.

Your install ID is stored in analytics.json in Bifurc's data directory. If you want the events tied to it deleted, send that ID to the contact address below and we will remove them.

<!-- Console shelved (free app): removed section ## Usage analytics in an organization's workspace A workspace belongs to an organization when its repository was added to that organization in the Bifurc Console and the organization gave it to your GitHub account, or when you are the organization's owner and the repository is yours. A workspace that exists only on your device, and one in a repository of your own that no organization has, are yours: the section above applies to them, and this one does not. ### Who decides The organization's owner turns usage analytics for the organization's workspaces on or off in the Bifurc Console. They are off until the owner turns them on. - **When the owner has them on**, what you do in that workspace is reported, whatever the **Anonymous usage analytics** switch on your device says and whether or not `BIFURC_TELEMETRY=0` or `DO_NOT_TRACK=1` is set. You cannot turn this off for an organization's workspace. If you do not want it, do not use that workspace, or ask the organization's owner. - **When the owner has them off**, nothing you do in that workspace is reported at all, not even anonymously. Bifurc shows you which of your workspaces are an organization's and whether their analytics are on, under **Settings → About → Privacy**, and the Bifurc Console shows the same under the organization's **Settings**. Bifurc asks the console about each synced workspace when it starts and about every half hour after, so a change the owner makes reaches your device within that time. ### What is sent The same events as the anonymous analytics, and only for things done in that workspace: an event name from a fixed list (`request sent`, `mock created`, `export created`, `workspace synced` and so on), properties that describe its shape, the interface it came from, the Bifurc version, and your operating system family and processor architecture. In addition, each event carries: - **The organization's public ID**, a random identifier the console made for the organization - **The console's ID of the workspace** - **The numeric GitHub user ID** of the account you use that workspace with It does not carry your install ID, so these events are not tied to the anonymous ones your device may also send. Things that do not belong to a workspace, such as starting Bifurc or signing in, are never reported to an organization. The list under **What is never sent** above holds here too, with one exception: the numeric GitHub user ID. Your GitHub username, name, email address and token are not sent; the console already holds the username of each member the owner added, and matches the number to it. ### Who sees it The events go to PostHog, as the anonymous ones do. The organization's owner sees them in the Bifurc Console, counted by day, by member, by workspace and by kind of action. The console asks PostHog only for the events that carry that organization's public ID. Other members of the organization do not see them. We can see them as the operator of the service. ### Legal basis and your choices The organization that owns the workspace decides whether these analytics are collected, to know how its own workspaces are used and by whom; we process them on its behalf, and rely on your acceptance of the Terms of Use and this policy. To have events tied to your GitHub user ID deleted, ask the organization's owner or write to the contact address below with your GitHub username and the organization's name. -->

GitHub sign-in and workspace sync#

Signing in is optional. Workspaces work fully offline as plain files with local git history.

If you choose to sign in to GitHub to sync a workspace:

• Sign-in uses GitHub's device flow: Bifurc shows a code, you enter it on github.com, and GitHub issues an access token to the app on your device. We never see your GitHub password.
• Bifurc requests the repo permission, which it uses to list repositories you own, create a repository for a workspace, and push and pull workspace files.
• Bifurc stores the token together with your GitHub user ID, username, display name and avatar URL in a file on your device. On Windows the token is encrypted to your Windows user account; on other platforms the file is readable only by your user.
• The token is sent only to GitHub. It is never sent to us or to PostHog, and it is never written into a workspace repository.
• When you publish or sync, your workspace files are sent to the GitHub repository you chose. What happens to them there is governed by GitHub's privacy statement and by who you give access to the repository. Vaults are synced only in their encrypted form.
• Signing out in Settings → Accounts removes the token and the account from your device. You can also revoke Bifurc's access from your GitHub settings at any time.

Importing a workspace#

You can import any Bifurc workspace repository that your GitHub account owns or was added to as a collaborator, with the access GitHub gives you (write or read-only). Bifurc talks only to GitHub for this, using your token. Nothing about it is sent to us.

Git operations run on your device using the git you have installed.

<!-- Console shelved (free app): removed section ### Importing a workspace someone shared with you When you import a workspace from a repository that is not your own, the app asks `console.bifurc.app` whether your GitHub account was given that workspace. It sends two numbers, your GitHub user ID and the repository's ID. It sends no token, no repository contents and no names. The token is still used only to talk to GitHub. The app sends the same two numbers, and nothing else, to ask whether a workspace you sync belongs to an organization and whether that organization has usage analytics on. It asks this about every workspace that syncs with a repository, your own included, when it starts and about every half hour after. Git operations run on your device using the git you have installed. ## Bifurc Console The Bifurc Console at `console.bifurc.app` is a separate web service that lets a team owner create an organization, create workspaces and give people access to them. It is optional: the desktop app works without it, and nothing in this section applies unless you sign in to the console. It changes nothing above about the desktop app. ### What the console stores - **Your profile** from the sign-in provider (GitHub, or Google): your name, email address and avatar. - **Your GitHub identity**: your GitHub user ID and username. A GitHub connection is always required to use the console. - **A GitHub access token** with repository access, stored encrypted. It is used only to create workspace repositories on your GitHub account and to manage their collaborators. - **What you create**: organizations; workspaces, as a repository name and ID (never repository contents); and members, meaning the GitHub username, ID and avatar of the people an owner adds. - **An activity log** of changes to an organization. - **Session cookies**, which keep you signed in. They are strictly necessary, and the console sets no tracking cookies. ### Payments Seats beyond those included are paid for in the console. Payments are handled by RevenueCat and Stripe. We do not see or store your card details. RevenueCat receives the organization's ID and the billing email address given at checkout. ### Hosting The console runs on Cloudflare (Workers and D1). ### Revoking access To stop the console using your GitHub account, revoke it in GitHub under **Settings → Applications → Authorized OAuth Apps**. To have your console data deleted, email the contact address below. -->

HTTPS certificates#

When you enable HTTPS interception, Bifurc generates a root certificate and private key on your device, or uses ones you import. They are used only by the local proxy. They are never sent to us.

Browser extension#

The Bifurc Companion extension talks to the Bifurc app running on your own device. Traffic it captures is handed to the local app and is not sent to us.

Updates#

The desktop app does not check for updates on its own. If you installed Bifurc from the Microsoft Store, updates are delivered by the Store under Microsoft's terms.

This website#

• If you use the contact form, the name, email address and message you enter are delivered to us by email through FormSubmit. We use them only to reply.
• Our hosting provider may keep standard request logs (such as IP address and user agent) to operate and protect the service.
• The website uses PostHog to understand how visitors use it: the pages you view, where you came from, what you click and scroll, and recordings of your session on the site with text you type masked. PostHog stores a random visitor ID in a cookie and local storage so it can tell visits from the same browser apart, and approximates your location from your IP address. This is separate from the desktop app's analytics and is never linked to its install ID.
• The website does not set advertising cookies.

Third parties#

Each operates under its own privacy policy.

Data sharing#

We do not sell, rent or trade your data. The anonymous analytics events are shared only with PostHog as our processor, and otherwise disclosed only if required by law.

Security#

Because your data lives on your device, its security depends on the security of that device. You are responsible for protecting your computer, your vault passphrases, and the repositories you sync to.

Children#

Bifurc is a developer tool and is not directed at children. We do not knowingly collect personal information from anyone under 13 (or under 16 in the European Economic Area and the United Kingdom). The desktop app has no accounts or sign-up, so the only personal information we could receive is what someone chooses to type into the contact form. If you believe a child has sent us personal information, email us and we will delete it.

Changes to this policy#

We may update this policy. The date at the top shows the latest revision. If a change affects what leaves your device, we will say so prominently on this page and in the release notes.

Contact#

Harshal Kudale

Email: contact@bifurc.app

Website: bifurc.app