Security and Privacy

Yaak is a local-first desktop app that treats API requests and responses as sensitive. As a result, Yaak is often chosen over cloud-based alternatives for security and privacy reasons. This page covers the desktop app. The web app sends requests through a proxy; see How the Web Proxy Works for what it can see, encryption in transit, and logging.

In short, for the desktop app:

• All data stored locally, no account required
• Optional secret encryption, with keys protected by the OS keychain
• No built-in AI
• MIT-licensed open source

Where your data lives

Yaak stores requests, environments, response history, and settings on your device in a local SQLite database. There is no cloud component, and no account is required to use the app.

Directory sync can also be enabled to sync workspace data to plain text files for use with Yaak’s built-in Git functionality, or file-sync services like Dropbox.

When data leaves your machine

Desktop API requests go to the servers you choose, without a Yaak-hosted relay. System or custom proxies can be used when configured. Yaak also makes a small number of network requests for:

• Checking for app updates (can disable)
• Checking for notifications (can disable)
• Fetching the plugin directory when you browse or install plugins
• Validating a license key if one is in use

The Privacy Policy describes the limited metadata sent with update and notification checks.

There are no analytics and no tracking in the app.

Secrets encryption

Yaak also offers the ability to encrypt specific values in the app on a per-workspace basis using the secure(...) template function.

These values are encrypted with XChaCha20-Poly1305 using a workspace key. A master key in the OS keychain protects the workspace key, which is stored encrypted in Yaak’s local database. The encrypted values are stored with your workspace data, not in the keychain.

Fields known to contain sensitive data (authorization headers, passwords, environment values) are encrypted by default once encryption is enabled. This protects selected values, not the entire database or response history. Encrypted values can also be shared through directory sync; recipients need the workspace key to decrypt them.

See Secrets Encryption for setup and details.

AI and agents

Yaak ships without built-in AI. No AI features run in the app and no request data is sent to AI providers.

Connecting AI is your choice, made externally: the CLI lets terminal agents like Claude Code create and send requests, and the MCP Server plugin exposes workspaces to any MCP-compatible assistant. Neither is active unless you set it up.

Open source

Yaak is MIT-licensed. The source can be audited, modified, and built from scratch.

Compliance notes

Because Yaak does not store, sync, or transmit your data, there is no vendor data processing to assess: your data never reaches Yaak’s servers. For HIPAA specifically, Yaak does not process PHI on behalf of users and therefore does not meet the definition of a Business Associate, so BAAs are not signed.

Questions? Email help@yaak.app.