Privacy Policy

Last updated: 24 August 2026

This Privacy Policy explains how Charlotte ("the app", "we", "us") handles information. It covers Charlotte for macOS and Charlotte.Pro for Windows. Charlotte is a network traffic analyzer and HTTPS debugging proxy that runs entirely on your own computer. Our guiding principle is simple: your data stays on your machine.

1. Summary

• Charlotte does not collect, transmit, or sell your personal data.
• Captured network traffic is stored and processed locally on your device.
• The app contains no third-party analytics, advertising, or tracking SDKs.
• There is no Charlotte server, and no account to create.
• On-device AI features run locally — traffic is never sent to a cloud model.
• The Model Context Protocol (MCP) server is loopback-only (127.0.0.1) and off by default.

2. Data the app processes

As a debugging proxy, Charlotte decrypts and displays the network requests and responses you choose to route through it. This may include URLs, headers, cookies, authentication tokens, request and response bodies, and WebSocket frames — material that is often highly sensitive. This content:

• is captured only for traffic you explicitly direct to Charlotte;
• is held locally in memory, and written to disk only in session files you choose to save;
• is never uploaded to us or to any external server by the app;
• remains under your control — you can delete captures and saved sessions at any time.

Charlotte can only decrypt traffic from applications that trust its certificate authority and that you have pointed at it. Exported sessions and HAR files are created only by an explicit action from you, are stored wherever you choose, and are your responsibility from that point on — treat them as sensitive, because they generally are.

3. What Charlotte stores on your device

Nothing below leaves your computer.

• Root CA private key. On macOS, stored in the Keychain. On Windows, encrypted with DPAPI and scoped to your user account. Never written to plaintext files, and never exported by the app.
• Root CA certificate. Installed into your current user's trust store — the macOS Keychain, or the Windows CurrentUser Trusted Root store — and only when you ask for it. Removable from within the app at any time.
• Proxy settings. Your per-user system proxy configuration. On Windows this lives under HKEY_CURRENT_USER, and is reverted when you disable the proxy.
• Licence state. A cached yes/no answer about whether your account owns Charlotte, plus your trial start date, protected by the Keychain or DPAPI. This exists so that starting up without an internet connection does not lock out someone who has paid.
• Captured traffic. In memory during the session, and on disk only if you export or save it yourself.

4. On-device AI

Charlotte's AI features (flow explanations and anomaly / security checks) are computed locally: on macOS using Apple's Foundation Models, and on Windows using Phi Silica on Copilot+ PCs or a locally stored ONNX model on other hardware. Sensitive headers are redacted before analysis. No captured traffic is transmitted off your machine for these features, and there is no cloud fallback.

5. MCP server & live event stream

When you enable the optional MCP server, it binds to the loopback interface (127.0.0.1) so that only clients on your own machine can connect. It is disabled by default.

Being on loopback keeps the server off the network, but it does not by itself keep other programs on your own PC away from it. So every client must also present an access token, which Charlotte generates on first use and shows in Settings. You copy it into the client you want connected; anything else is refused. The token is stored encrypted under your operating system account, and you can issue a new one at any time to disconnect every client using the old one.

Passwords, tokens and cookies are hidden from agents by default. Authorization and Cookie headers, credential-named fields in JSON and form bodies, and JSON Web Tokens are masked everywhere an agent can read them — the live event stream and the tools that list, search and fetch requests alike. You can turn this off when the credential itself is what you are debugging; it is your traffic. Nothing is exposed unredacted unless you choose it.

Any agent action that modifies rules or replays requests is opt-in, off by default, and recorded to the local debug log. Note that an AI agent you connect over MCP can read captured data; what that agent then does with it is governed by its own privacy policy, not this one. Connect only agents you trust.

6. Certificates & system settings

Charlotte generates or imports a root Certificate Authority used to decrypt HTTPS, and can configure your system proxy so that traffic reaches it. Both are per-user operations that you trigger explicitly, both are plainly shown in the app, and both are reversible.

Charlotte does not install certificates. On Windows it saves its root certificate to its own folder and opens Windows' certificate window on it; you click Install Certificate…, choose the store in Windows' own Certificate Import Wizard, and answer Windows' security warning. The app has no code path that writes to a certificate store. Your operating system's prompt is not suppressed or bypassed — it is your last clear checkpoint before trusting an interception certificate, and nothing is trusted unless you complete that wizard yourself.

Removing it again. Windows does not allow an application to run any code while it is being uninstalled, so removing Charlotte cannot by itself undo the two things it changes outside its own folder: your per-user proxy setting and your trusted root certificates. Charlotte turns the proxy back off every time you quit, and Settings ▸ Before you uninstall removes its root certificate and restores the proxy in one action. If Charlotte is already gone, you can do the same by hand: Settings ▸ Network & internet ▸ Proxy, and certmgr.msc ▸ Trusted Root Certification Authorities. Everything else Charlotte stores lives in its own application data folder and is removed with the app.

7. Operations that require administrator rights (Windows)

Charlotte.Pro runs as a normal user and never requests administrator rights to start, or to do any of its everyday work. One optional feature changes machine-wide state and therefore asks for administrator approval at the moment you press its button, and never otherwise:

• Routing Windows services through Charlotte, which sets the machine-wide WinHTTP proxy that Windows services and background agents read. Charlotte does not write this itself: it shows you the netsh winhttp set proxy command and you run it.

It is not required to use the app, it is reversible from the same screen, and declining simply cancels the operation and changes nothing. Because it affects every user of the computer, use it only on machines you control.

An earlier version of Charlotte also offered to trust its certificate for every account on the PC. That feature was removed in version 1.0.9 and no longer exists. Charlotte only ever affects the trusted roots of the account running it, and only through Windows' own wizard.

8. Purchases & licensing

Charlotte.Pro for Windows is free to use for a 14-day trial, after which a one-time purchase unlocks it permanently. The transaction is handled entirely by the Microsoft Store under Microsoft's Privacy Statement. Charlotte asks the Store only whether your account owns the licence, and receives a yes or no. We never see your payment details, and we receive only the aggregate sales reporting that Microsoft provides to publishers.

9. Diagnostics

Charlotte does not automatically send crash reports or diagnostics to us. If you contact support and choose to share logs or a session file, that information is used only to help resolve your issue.

10. This website

This website is hosted on GitHub Pages. Like most web hosts, GitHub may automatically log technical data such as IP addresses and browser user-agents for security and operational purposes, as described in the GitHub Privacy Statement. We do not add analytics or advertising trackers to this site.

11. Contact form

If you use the contact form on our Support page, the details you submit (such as your email address and message) are used solely to respond to your inquiry. Form delivery may be handled by a third-party form provider, which processes the submission to forward it to us by email.

12. Your responsibilities

Charlotte is a tool for inspecting traffic you are authorised to inspect — your own applications, your own devices, or systems you have permission to test. Installing a root certificate authority and intercepting traffic on machines or accounts you do not control may be unlawful. You are responsible for how you use the tool.

13. Your rights

Because we hold no data about you on any server, there is nothing for us to retrieve, correct, or erase on your behalf. All Charlotte data lives on your device and is removed when you uninstall the app and remove its root certificate — both of which you can do at any time without our involvement.

14. Children's privacy

Charlotte is a developer tool and is not directed to children under 13.

15. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

16. Contact

Questions about this policy? Reach us through the contact form on our Support page.