Privacy Policy
Last updated August 1, 2026
Hollowport is a network debugging tool that runs entirely on your device. This page explains what that actually means for your data, in plain language, not legalese.
What we collect
Account information: none — there is no account, and nothing to sign in to.
Captured traffic: every request and response Hollowport decrypts and shows you — headers, bodies, all of it — is stored only in an on-device SQLite database inside the app's own storage. We never see it, because it's never uploaded anywhere.
Rules, Collections, and settings: standing rules, saved Collections, environments, variables, Watch rules, and linked findings are plain JSON files in the app's local storage on your device — the same way any iOS app stores its own local data. Secret variables and the MITM certificate's private key are kept in the device Keychain specifically excluded from iCloud Keychain sync and from unencrypted backups, so they stay on that one device.
Waitlist signups: if you join the pre-launch waitlist on this page, we store just your email address, to email you once when Hollowport is live — nothing else.
Device/technical data: none. There is no analytics or crash-reporting SDK anywhere in the app to collect it.
What we don't do
No advertising, no analytics or tracking scripts, no crash reporting, no data brokers, and no account — so there's nothing to profile and nothing to sell. There's nothing to opt out of, because none of it exists here.
About the certificate
Hollowport asks you to install and trust a certificate so it can decrypt HTTPS traffic — but only your own device's traffic, only for as long as you're capturing, and only locally. It works as an on-device Network Extension: nothing is routed through a remote proxy or a server we operate. The certificate's private key is generated on your device and stored in its Keychain, deliberately excluded from iCloud Keychain sync — it never leaves the device, and we never have access to it.
The one AI feature
"Explain with AI," available on a captured request's detail view, runs on Apple's on-device model only — never Apple's own cloud fallback (Private Cloud Compute), and never a third-party AI service. Credentials and personal data are stripped from a request before it's given to the model, the same redaction export uses. Nothing about your traffic is sent anywhere to generate an explanation.
When data leaves your device
- When you explicitly export a capture (HAR or generated client code) or share a request — redaction of credentials and personal data is on by default.
- When you replay a request or run a Collection, which sends that request to its own real destination through the tunnel. That's your own traffic reaching its own server, not Hollowport uploading your capture anywhere.
Who we share it with
Nobody. The app itself has no backend, so there's no third party processing your captured data on our behalf. This website (hollowport.hevexa.net) is separate from the app and uses one service, strictly to make the site function: Resend, to deliver the waitlist confirmation or contact-form message if you submit one through this site. It sees only the email address and content of that one message.
Deleting your data
Uninstalling Hollowport removes its on-device database, settings, and Keychain-stored certificate and secrets completely. There's no account to delete, because there isn't one — deleting the app is the whole thing.
Children
Hollowport isn't directed at children and isn't intended for anyone under 13.
Changes to this policy
If this changes in a meaningful way, we'll update the date at the top of this page.
Contact
Questions or concerns — email us at hollowport@hevexa.net. We read every message ourselves.