Hexbuffer

Privacy Policy

Last updated: September 13, 2026

This Privacy Policy explains how hexbuffer ("the app", "we", "us", or "our") handles information when you use the desktop application. Hexbuffer is a local-first desktop application and developer tooling for HTTP traffic inspection, request interception, payload testing, and security analysis.

Summary

hexbuffer is designed as a local-first desktop application. The app does not require an account, does not operate a multi-tenant cloud service, and does not send captured traffic to our servers. It includes no analytics, telemetry, or crash reporting.

The only connections the app makes on its own are update checks against our update host. All other external connections — AI providers, your own cloud storage, wordlist and template downloads, and the traffic you inspect — happen only when you configure or trigger them.

Because the app is built for HTTP traffic inspection, request interception, payload testing, and security analysis, the information you choose to capture or inspect may be highly sensitive. You are responsible for using the app only on systems, networks, applications, and accounts that you own or are authorized to test.

Information the App May Process

Depending on the features you use, the app may process and store the following information on your device:

  • HTTP and HTTPS traffic metadata, including URLs, methods, headers, status codes, timestamps, client addresses, server addresses, and timing information.
  • HTTP request and response bodies, which may include credentials, tokens, cookies, personal information, files, form submissions, API payloads, or other sensitive content.
  • WebSocket connection details and message payloads.
  • Browser automation data, including target URLs, crawled pages, page titles, discovered links, forms, logs, generated insights, screenshots, and rendered HTML artifacts.
  • Security testing inputs and results, such as repeater requests, intruder configurations, port scan results and banners, vulnerability scan results and templates, SQL injection detection data, out-of-band interaction payloads, regression test cases and results, and AI chat sessions.
  • Documents, notes, stashes, mock server configurations, override rules, and reports that you create or save through the app.
  • Exported files that you generate through the app, such as scan reports (SARIF, JSONL, CSV, or Markdown), CSV exports, screenshots, and rendered HTML artifacts.
  • Local settings, such as proxy ports, selected AI provider and model, theme and interface preferences, and feature configuration.
  • Certificate material generated by the app, including the local CA certificate and its private key used for HTTPS interception.

Local Storage

The app stores operational data locally on your device. Data is kept in a per-user application directory (for example, `~/Library/Application Support/com.hexbuffer` on macOS, `%APPDATA%/Hexbuffer` on Windows, and `~/.local/share/hexbuffer` on Linux). This may include:

  • `hexbuffer.db` — a local SQLite database (with `hexbuffer.db-wal` and `hexbuffer.db-shm` companions) holding traffic history, WebSocket records, documents, AI chat sessions, regression and test-suite data, stashes, contexts, and mock server configurations.
  • `ai-browser-artifacts/` — screenshots and rendered HTML produced by browser automation.
  • `regression-artifacts/` — artifacts produced by regression test runs.
  • `sessions/` — stored payload and session data.
  • `intercept-browser-profile/` — the browser profile used by the intercept browser.
  • `.hexbuffer/` — the local CA certificate (`ca.pem`) and its private key (`ca-key.pem`).
  • `hexbuffer-ca.pem` — the exported CA certificate copy used for installation.
  • `ai-settings.json` — AI provider and model settings (the API key is not stored in this file).
  • `r2-settings.json` — non-secret cloud storage connection settings (the secret access key is not stored in this file).
  • `/tmp/hexbuffer.log` — a local diagnostic log file on Unix-like systems, which may contain request URLs processed by some features.

Local files remain on your device unless you delete them, export them elsewhere, share them, synchronize them with another service, or use a feature that sends selected data to a third party.

Traffic Interception and Certificates

When HTTPS interception is enabled, the app generates a local certificate authority (CA) certificate, named "Hexbuffer Proxy CA", so it can decrypt, inspect, and re-encrypt HTTPS traffic routed through the proxy.

Installing or trusting this certificate allows the app to inspect encrypted traffic that passes through the configured proxy. Traffic outside the configured proxy is not intentionally intercepted by the app.

Captured traffic may include secrets or personal information. You should remove the app's CA certificate from your operating system or browser trust store when you no longer need HTTPS interception.

Optional AI Features

The app includes optional AI-assisted features powered by DeepSeek through its official API (`https://api.deepseek.com`). DeepSeek is currently the only supported AI provider.

Third-party AI sharing is disabled by default. AI features will not send data to DeepSeek until you enable third-party AI sharing in Settings and provide your own DeepSeek API key.

When you use AI features, the app may send selected prompts, chat messages, workspace and repeater context, HTTP request text, page summaries, logs, insights, URLs, and other analysis context to DeepSeek so it can generate a response. The specific data sent depends on the feature and your inputs.

API keys are stored in your operating system's credential store (keychain) and are not written to the app's local settings files. AI provider, model, and sharing preference are stored locally in `ai-settings.json`. Your use of DeepSeek is also governed by DeepSeek's own terms and privacy policy.

Do not use AI features with sensitive traffic, credentials, proprietary information, personal data, or regulated data unless you are authorized to send that data to DeepSeek.

Optional Cloud Storage (File Explorer)

The File Explorer feature lets you browse and manage object storage buckets using an S3-compatible service such as Cloudflare R2. This feature is entirely optional and disabled until you supply your own credentials.

When configured, the app connects directly to your storage endpoint using your access key. Transfers happen between your device and your bucket; we never have access to your bucket or its contents.

Your secret access key is stored in your operating system's credential store (keychain). Non-secret connection details, such as the account ID, access key ID, and any custom endpoint URL, are stored locally in `r2-settings.json`. Your use of Cloudflare R2 or any other storage provider is also governed by that provider's own terms and privacy policies.

Downloaded Content

Certain features download publicly available content from third-party hosts when you use them:

  • The Wordlists Hub fetches a manifest from `raw.githubusercontent.com` and downloads wordlist files that you select, hosted in the project's public GitHub repository.
  • The vulnerability scanner can download scan templates from the public `projectdiscovery/nuclei-templates` GitHub repository.

These requests are made to GitHub and may disclose standard network information, such as your IP address, request time, and user agent. The content downloaded is public data and no captured traffic or personal information is included in these requests.

Automatic Updates

The app checks for software updates automatically when it starts and when you manually check for updates in Settings. Update checks use the configured update endpoint:

`https://dist.0xbuffer.com/latest.json`

Update checks may disclose standard network information to the update host, such as your IP address, request time, app version, operating system, and user agent or similar client metadata. Update downloads are signed and may also be requested from the update host when an update is available.

Information We Do Not Intentionally Collect

Unless a feature is explicitly configured to contact a third-party service, the app does not intentionally collect captured traffic, browser automation results, documents, certificates, API keys, cloud storage credentials, or local database content on our servers.

The app does not require a user account for local use. The app does not include product analytics, behavioral tracking, or crash reporting in the local desktop application.

Third-Party Services

The app may interact with third-party services when you choose to use features that require external network access, including:

  • Websites, APIs, and network services that you configure as testing targets.
  • DeepSeek, if you enable AI features and third-party AI sharing in Settings.
  • Cloudflare R2 or another S3-compatible storage provider, if you configure the File Explorer with your own credentials.
  • GitHub, for wordlist and scan template downloads.
  • The update host used to check for and download updates.
  • Operating system services such as certificate stores, keychains, file dialogs, and network interfaces.

Third-party services process information according to their own policies. You should review those policies before sending data to them.

Data Export and Sharing

The app may allow you to export scan reports (SARIF, JSONL, CSV, or Markdown), CSV result files, screenshots, rendered HTML artifacts, notes, and documents. Exported files may contain sensitive information, including authentication tokens, cookies, request bodies, response bodies, personal data, and internal network details.

You are responsible for protecting exported files and sharing them only with authorized recipients.

Data Deletion

You can delete local artifacts by using available app controls, such as clearing browser automation artifacts, regression artifacts, or resetting local data. You may also manually delete exported files and the application data directory from your device.

Resetting local data may remove browser automation artifacts, regression artifacts, the intercept browser profile, and local CA certificate files managed by the app. Removing an API key or storage credential in Settings deletes it from the operating system keychain. Deleting local data may not remove files that you exported to other locations, files synchronized by your operating system or third-party services, or certificates that you manually installed into browser or operating system trust stores.

Security

The app is a security testing tool and may intentionally access, decrypt, store, and replay sensitive traffic at your direction. You should:

  • Use the app only on authorized targets.
  • Avoid capturing unrelated personal or third-party traffic.
  • Protect your device account, local database, exported files, API keys, storage credentials, and generated certificates.
  • Remove trusted CA certificates when testing is complete.
  • Review captured data before sharing reports or exports.

No software can guarantee perfect security. Local files may be accessible to users, processes, backups, or malware that have sufficient access to your device.

Retention

Local data remains on your device until you delete it, reset local data, uninstall the app and remove its application data, or overwrite it through normal app usage. Exported files remain wherever you saved or shared them until deleted from those locations.

Third-party providers may retain data according to their own policies when you use features that send data to them.

Children's Privacy

The app is intended for security testing, development, and professional use. It is not directed to children.

International Use

Because the app is distributed as local desktop software, data is generally processed on your own device. If you use third-party services, update endpoints, cloud storage, file synchronization, or AI providers, your data may be processed in other regions according to those services' policies.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above. Material changes should be reviewed before continued use or distribution of the app.

Contact

For privacy questions, contact:

`arhamymr@gmail.com`