Privacy policy

Monkeytail

Last updated: October 4, 2026.

About the app

Monkeytail is an HTTP and cURL client provided by Kitta Ltd, trading as Kitta Co. It helps you create API requests and inspect responses on your iPhone, iPad, Mac, or Apple Vision Pro, with a compact Apple Watch companion.

Your device

Collections, request definitions, headers, bodies, environments, proxy settings, scripts, and request history are saved locally with platform file protection and the Mac app sandbox. Credentials are stored locally in workspace files or the device Keychain, depending on the app version and your settings. Version 1.4 makes Keychain storage optional and off by default. Response bodies stay in memory unless you save a snapshot or export them. Saved snapshots and uploaded attachments remain on your device and use iOS file protection. Device backups are managed by your Apple settings.

Optional iCloud sync

Sync is off by default. If enabled, collections, environments, and scripts are stored in your iCloud Drive and shared between your devices using your existing Apple session. No Monkeytail account is required. Kitta cannot access this data. Version 1.4 adds an Include credentials option for authentication and sensitive fields. New workspaces include credentials when sync is enabled; existing workspaces keep their earlier exclusion choice. Cookie jars, client identities, uploaded file bytes, snapshots, and history remain local. Request bodies and scripts are shared as entered. Turning sync off stops transfers but does not delete existing iCloud files. You can manage those through Apple’s iCloud storage settings.

Apple Watch companion

You can copy favourite requests from your paired iPhone to Apple Watch using Apple’s WatchConnectivity. Copies are stored locally on both devices, in files or optional Keychain storage in version 1.4. Include credentials & body controls what is copied. New workspaces include them; earlier workspaces keep their previous exclusion choice. The Watch sends requests directly to the servers you select; Kitta receives no copy. Responses remain in memory. Watch transfers do not use a Kitta account or backend.

Connections you choose

When you send a request, the app connects to the API server and any proxy you select. Those services receive the request information needed to handle it, including any headers, body, credentials, and network address. Their operators control their own data practices. Kitta does not receive a copy. No request is sent merely by importing a collection.

Authentication, cookies, and mocks

Cookie jars and PKCS#12 client identities use local files or optional Keychain storage and are never sent to Kitta or synced through iCloud. OAuth opens your selected provider in an ephemeral browser session; that provider may require its own sign-in. Tokens are stored locally. This does not create a Monkeytail account. WebSocket and SSE connections go to the servers you choose. Offline mocks run locally; the optional mock server binds only to the device loopback address and stops when the app enters the background.

Files and scripts

The app reads files or photos you select for import or upload and writes or shares files you explicitly export. Exports can contain saved credentials. JavaScript hooks execute locally in an isolated context with network access blocked. Imported and synced scripts are disabled on new devices until you choose to enable them.

Your choices

You can edit or delete local collections, requests, and environments, clear history, change proxies, or remove the app to remove its local data. Files you exported and device backups remain under your control. Data sent to an API server or proxy is managed by that service.

Support

If you voluntarily email [email protected], we receive the information you include and use it to respond. This is separate from app operation. Do not include passwords, tokens, or private request contents.

Changes

We will update this page if the app’s data practices change. The date above identifies the latest revision.