Privacy Policy

This policy covers the Beacon desktop app and this website. It is written in plain English because the honest version is short. “We” means Quizuncle, the indie studio behind Beacon.

In short

This website

beacon.quizuncle.com is a set of static files served by Firebase Hosting, which is Google. There are no analytics and no tracking of any kind. The only thing this site keeps in your browser is your light or dark theme preference.

That preference is stored in one cookie, qu_theme, whose entire value is the word dark or light. It is scoped to .quizuncle.com so that choosing a theme here also applies on quizuncle.com and the other Quizuncle sites — that sharing is the only reason it is a cookie rather than localStorage, which browsers keep separate per subdomain. It contains no identifier, it is not used to recognise you, and nothing reads it but the page you are on. Because it is scoped to the domain it is sent with requests to those sites, which is how cookies work; the server does nothing with it. Clearing your cookies removes it, and the site then follows your operating system's light or dark setting.

There is exactly one third-party request, and it is not automatic: the Check for a newer version button on the download page calls the GitHub API once, when you click it. Nothing on this site calls out on its own.

Google, as our hosting provider, processes standard web server logs — your IP address and user agent — in order to serve the pages to you. That happens under Google’s own privacy policy, and we do not add anything of our own on top of it.

The app: where your data lives

Everything Beacon stores — collections, requests and their saved examples, environments, globals, history, scripts, cookies, flows, monitors, load-test results and settings — lives in a single SQLite database on your Mac, and unless you turn on Cloud Sync that file is the only copy anywhere:

~/Library/Application Support/beacon/postman-desktop.db

Turning sync on adds a second copy in our Firestore project — that section sets out exactly what goes into it.

Variable values you flag as secret are encrypted at rest using the operating system keychain, through Electron’s safeStorage. That flag is the whole of the local encryption: the auth credentials saved on a request, folder or collection, the cookie jar, and your request history are all stored in that database as ordinary text. Anyone who can read the file can read them.

When you sign out, Beacon first snapshots your data into an encrypted local backup and then wipes the working copy; those backups stay on your machine and are never uploaded anywhere.

The update check

Once an hour, the app asks GitHub whether a newer release exists:

GET https://api.github.com/repos/quizuncle/beacon-releases/releases/latest

It is sent with the User-Agent beacon-api-client. There is no version string in it, no machine identifier, and nothing about you. GitHub — like any HTTPS server receiving any request — necessarily sees the IP address it came from. That is the whole of it.

If an update exists and you choose to install it, Beacon then downloads the DMG from github.com. That download happens only when you ask for it.

That check is not the only call Beacon makes on its own. Unless you turn it off, it also uploads anonymous usage data in the background, and looks up the country code that goes with it. With Cloud Sync on it uploads changed items by itself too, within a few seconds of your changing them, and a signed-in app refreshes its sign-in token against Google in the background.

Anonymous usage data

Beacon reports anonymous usage data so we know which features matter and which ones are breaking. It is on by default. The switch is at Settings → Privacy → Share anonymous usage data; it is the one setting in that window that applies the moment you flip it rather than waiting for Save, and an install that opted out stays opted out, including across signing in and out. Reporting runs whether or not Cloud Sync is on, and the two are unrelated: sync uploads your work, this uploads counts about the app, and turning either one off does nothing to the other.

What is reported is tied to a random ID generated for this install — not to your hardware, and not to your name unless you sign in. If Beacon ever has to replace that ID it keeps the previous ones alongside the new one, and that history is what links those IDs to each other.

What is sent

• Usage. Which features you use and how often, as daily totals — plus how many times you launched the app, roughly how long it stayed open, and which hours of the day you used it. Alongside the totals a few labels are counted for the day, from a fixed list the app ships: the HTTP method, whether a request succeeded or failed and the kind of failure, the body type, the authentication type, a size bucket, and where in the app you started from. Each is a count per day — never a value, and never attached to an individual request. Beacon can tell that 31 GET requests were sent today, not which ones or to where.
• This install. App version, operating system, CPU architecture, language and time-zone offset, when this install was first and last seen, and how many times it has launched.
• Roughly where. Three things, and this is all of them: your country as a two-letter code; the Cloudflare edge code that answered the lookup — a three-letter code for the nearest data centre on your network path, not your city and not your address, since whole regions share one edge and a VPN shows wherever your VPN comes out; and your device’s time-zone name, such as Asia/Kolkata, which Beacon reads from your own system settings without asking anyone. The first two come from one lookup against cloudflare.com, falling back to api.country.is. Those services see your IP address the way any site you connect to does, but Beacon reads only the two codes out of the reply and never stores or sends the IP itself.
• Errors. The error type, a one-line message, which part of Beacon it came from, how many times it happened that day, when it first and last happened, and a fingerprint that groups repeats of the same error together. The type and the message are the only free-form text Beacon uploads on its own, so both are scrubbed on your machine before they are queued: URLs, email addresses, tokens, IP addresses, home folder paths, {{variables}}, long quoted strings and long runs of digits are all replaced, and a report that still looks like it holds a secret is thrown away rather than sent. Scrubbing is not perfect — a short credential with no recognisable prefix can still read as ordinary text. Two kinds of failure are reported with no message at all: an error thrown by your own pre-request or test script, and a request that failed to send.
• If you sign in. Your account email, account ID and sign-in provider, along with the other accounts that have signed in on this install, so a support request or a piece of feedback can be linked to it. Signing out stops the recording but does not erase what was already recorded.

What it never contains

Request URLs, headers, bodies or responses. Environment variables, globals, secrets, tokens, API keys or passwords. Collection, folder, request or workspace names. Your pre-request and test scripts. None of it is collected. The only fields Beacon fills in by itself that could physically hold any of it are the error type and error message above, which is why both are scrubbed and then thrown away outright if they still look like they hold a secret.

Turning it off

The switch stops the upload, not the recording. Beacon carries on counting usage and capturing errors on your machine, exactly as described above — it just sends none of it: no usage totals, no record of this install and no error reports leave your machine while the switch is off, and it stops looking your country up as well. Nothing that was already sent is removed by switching off — there is no delete path for it in the app, which is why the switch is worth flipping before rather than after. Turn it back on and Beacon uploads what it recorded meanwhile, picking up where it left off rather than starting over, as far back as retention allows: only today plus the seven most recent days are kept on your machine, and the queue holds the 500 most recent error reports and feedback messages.

Feedback is separate, and deliberate

The one thing you type that Beacon uploads is feedback you choose to send — Send feedback in the app, from the command palette, the toolbar or Settings → Privacy. Your rating, the message you write and the reply address you choose to include go with it, alongside this install’s ID, your account ID if you are signed in, the app version, the platform and the country code. Leave the email out and the feedback stays anonymous.

Feedback is exempt from the switch above: a piece of feedback you send still goes out with usage reporting turned off, because you asked for it. Nothing else is.

Your requests go direct

The requests you send from Beacon travel from your machine to whatever API you pointed them at — through your configured proxy, if you set one. Nothing about the requests you send passes through a server we operate: not the request going out, not the response coming back, not the credentials used to authenticate it. We cannot see any of it, because none of it is ever sent to us.

That is a claim about sending requests, and it holds whatever else you have turned on. It is not a claim about storage. If you enable Cloud Sync, the saved copies of your requests — their names, URLs, non-credential headers, bodies and scripts — are uploaded to our Firestore project as plaintext, and we could read them. Responses and request history are never uploaded either way. Please read that section before switching sync on.

Optional account

Beacon has no account by default and works completely without one. If you choose to sign in, we use Firebase Authentication in our Firebase project beacon-quizuncle. You can sign in with GitHub, with Google, or with an email address and password (Google Identity Toolkit).

We store the profile Firebase gives us and nothing else: your uid, email address, display name, avatar URL, and which provider you used.

Optional Cloud Sync

Cloud Sync is opt-in and gated behind a passphrase you choose. Your passphrase never leaves your device. Keys are derived from it with PBKDF2-SHA256 at 600,000 iterations, and data is encrypted with AES-256-GCM.

Encrypted on your device before upload

• values of variables you flagged as secret
• auth credentials — bearer tokens, basic passwords, API keys, OAuth2 secrets and tokens
• credential headers such as Authorization and Cookie
• URL userinfo — the user:pass@host part of a URL
• a header row or query parameter whose name matches the API key your auth settings send, and an API key carried in the URL’s own query string
• the same credential fields inside a Flow’s inline request nodes, and the Flow’s secret input defaults

Uploaded as plaintext

• names
• URLs
• headers that are not credential headers
• request bodies
• scripts

The consequence is worth stating directly: a secret you paste into a request body or into a script is uploaded in the clear. Beacon can only encrypt the fields it knows are credentials. If a value is somewhere the app cannot recognise as a credential, treat it as readable by anyone with access to the database.

What sync does not do

• Request and response history never syncs. Neither does load-test data.
• Manual syncs are rate-limited to five in any 24-hour period.
• If you forget your passphrase, it cannot be recovered — not by you and not by us, because we never had it. The only way forward is to reset and re-encrypt.
• Turning sync off offers to delete your data from the cloud at the same time.
• Deleting or overwriting a synced document does not reach Firestore’s own server-side revision history, which the app cannot scrub from your machine. If a credential was ever uploaded in the clear, rotate it — do not rely on deleting it.

Public sharing

Publishing a share is optional. When you do, it creates a world-readable, unencrypted snapshot stored under an unguessable 22-character link id. Anyone holding that link can read the snapshot.

Before publishing, Beacon strips secrets on your device: secret variable values, auth credentials, credential headers, API-key rows, URL userinfo and local file paths. What it cannot do is detect a credential you hardcoded into a URL, a header value or a body — it has no way to tell that string apart from ordinary content. That is why the share dialog warns you before publishing. Revoking a share deletes the document.

Third-party services

Beacon touches these services, and each one processes data under its own privacy policy:

• Google Firebase Authentication — sign-in, if you create an account, and the anonymous identity that anonymous usage data is uploaded under.
• Google Cloud Firestore — storage for Cloud Sync, for published shares, and for anonymous usage data and feedback.
• Cloudflare and api.country.is — the country lookup described above, the second only as a fallback for the first. Both see your IP address; Beacon keeps only the country and edge codes.
• GitHub OAuth and Google OAuth — the sign-in providers, if you pick one of them.
• GitHub — the hourly update check, release hosting and the downloads themselves.
• Homebrew — distribution, if you install with brew.

We do not control those policies and cannot make promises on their behalf.

Deleting your data

On your machine

If you installed with Homebrew:

brew uninstall --cask beacon

Add --zap to remove the local data along with the app. Otherwise, delete /Applications/Beacon.app and these three paths:

~/Library/Application Support/beacon
~/Library/Preferences/com.vivek.beacon.plist
~/Library/Saved Application State/com.vivek.beacon.savedState

In the cloud

• Disable Cloud Sync and accept the offer to delete your cloud data.
• Revoke any shares you published.
• Turn off anonymous usage data to stop any more of it being uploaded. What was already sent is not removed by that switch, and the app has no button that removes it.
• To delete the account itself, email support@quizuncle.com from the address you signed up with. There is no button for this in the app yet: disabling sync deletes your synced documents, but not the sign-in record behind them.

Signing out wipes the local working copy after taking an encrypted local backup first.

Children

Beacon is a developer tool and is not directed at children under 13. We knowingly collect nothing from them.

Changes to this policy

When this policy changes, we update the effective date shown at the top and bottom of this page. If a change alters what leaves your machine, we will say so here in words rather than only moving the date.

Contact

Questions about any of this go to support@quizuncle.com. A real person reads it.

Effective 11 August 2026. See also the terms of use.