Privacy

What stays in your browser

HAR files are read, parsed, and analyzed entirely by JavaScript running on your device. The file contents are never uploaded to our servers, and there is no upload endpoint that could receive them.

Workspaces are stored in your browser using IndexedDB. They are tied to that browser profile on that device. Clearing your site data deletes them permanently and we cannot recover them because we never had a copy.

• HAR parsing and endpoint grouping
• Schema inference and value flow analysis
• Auth detection, flow detection, and passive security observations
• OpenAPI, YAML, and Postman generation and download

What reaches the server

Three features need a server because a browser cannot perform them. Each one is described below.

• URL discovery: when you paste a website address, the server fetches that site's public HTML, JavaScript bundles, robots.txt, sitemap.xml, and any published OpenAPI document, then returns the extracted references. The fetched content is processed in memory and is not written to disk or retained after the response.
• Playground send: when you press Send, the request you composed is relayed through the server so it is not blocked by browser CORS rules. The request and its response pass through memory and are returned to you. They are not stored.
• Assistant: when you ask a question, a redacted description of your workspace is sent to NVIDIA NIM. See the next section.

Redaction before anything reaches the model

The assistant is the only feature that shares anything with a third party. Before a workspace description is built, and again on the server before the request is forwarded, the payload passes through a redaction pass that replaces credential shaped values with placeholders.

Redaction is applied twice on purpose. The client redacts, and the server never trusts that the client did so.

• Authorization and Proxy-Authorization headers
• Cookies and Set-Cookie values
• JSON Web Tokens anywhere they appear, including inside URLs and bodies
• API keys, including recognizable vendor prefixes
• Fields named like password, secret, token, session, csrf, or private key
• Long opaque high entropy strings that match no known pattern

NVIDIA NIM

AI features are served by NVIDIA NIM through its OpenAI compatible endpoint. Requests carry the redacted workspace description and your question. Your NVIDIA NIM API key is read from a server side environment variable and is never exposed to the browser or included in any response.

NVIDIA's handling of the requests it receives is governed by NVIDIA's own terms and privacy policy. If you self host a NIM container and point OakParse at it, nothing leaves your infrastructure at all.

If no API key is configured, the assistant is disabled and every other feature in OakParse continues to work.

Analytics and tracking

The reference deployment ships with no analytics, no advertising, no third party trackers, no session recording, and no cookies used for tracking. There is no account system, so there is nothing to sign up for and no profile to build.

If you deploy your own instance and add analytics, that is your decision and your disclosure to make.

Server logs

The hosting platform records standard request metadata such as timestamps, response codes, and IP addresses. OakParse itself never writes credential values, request bodies, or response bodies to logs.

Your control

• Delete any workspace from the landing page and it is removed from IndexedDB immediately
• Clear your browser site data to remove everything at once
• Never use the assistant and no data leaves your device beyond URL discovery and sends you initiate
• Self host the whole application, including the model, and it becomes fully private

Changes

If this policy changes in a way that affects how data is handled, the date at the top of this page changes with it, and the change is visible in the project's public commit history.