Privacy policy

Last updated 10 November 2026

The short version: the zhttp app doesn't send us anything, and the traffic it captures stays on your computer. This website sets no cookies of its own and has no analytics.

Who we are

zhttp is made by Yoghurt Digital Ltd ("Yoghurt Digital", "we", "us"), a software studio registered in England and Wales, company number 13295779, with its registered office at 86–90 Paul Street, London EC2A 4NE. We are the controller of the personal information described in this policy. You can contact us about it at hello@yoghurtdigital.co.uk.

What this policy covers

This website (zhttp.dev), the zhttp desktop app and its command-line engine, and emails you send us about them. Our other products and our client work have their own policies on yoghurtdigital.co.uk.

The zhttp app

zhttp runs on your computer. There are no accounts, and it doesn't send us analytics, crash reports or anything else. It never contacts our servers.

• Traffic you capture. zhttp decrypts the traffic of the devices you point at it, on your computer. While a session runs, it keeps what it captures in a temporary file that is deleted when zhttp closes. It writes traffic anywhere else only when you ask it to, for example when you save a recording, a body or a key log. We never see any of it.
• Your certificate authority. The first time it runs, zhttp creates its own certificate authority on your computer. Its private key stays in your user folder and never leaves your computer. Anyone with that key could read traffic from devices that trust the certificate, so keep it private, and remove the certificate from a device when you no longer need it.
• Replay and Composer. Requests you replay or compose go straight from your computer to the server you send them to, or through the upstream proxy you set.
• AI agents. zhttp's MCP server only listens on your own computer. If you connect an AI agent to it, the agent can read the traffic you've captured, cookies and tokens included, and may send it to the agent's provider. The provider's privacy policy covers what happens to it there.

When you visit this website

We don't ask for any personal information on this website, and we don't use cookies of our own, analytics, advertising or tracking. Its fonts are served from this website, so no other company is involved when they load.

• Hosting. The website is hosted by Cloudflare. To deliver pages and downloads and to protect the site from attacks, Cloudflare processes technical information such as your IP address, browser type and the pages you request. It may set a strictly necessary security cookie to tell people apart from automated bots. See Cloudflare's privacy policy. Our lawful basis is our legitimate interest in running a secure website.

When you contact us

If you email us, we receive your name, email address and anything you choose to include. We use it to reply and to help with your question. Our lawful basis is our legitimate interest in responding to enquiries. Our email is provided by Google Workspace.

Who we share information with

We share personal information only with the service providers we need: Cloudflare for website hosting and Google for email. We also share it with professional advisers, or with authorities where the law requires it. We never sell personal information or use it for advertising.

International transfers

Cloudflare and Google may process information outside the UK, including in the United States. Where they do, the transfer is protected by safeguards recognised under UK data protection law, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.

How long we keep it

• Emails: up to two years after our last contact.
• Website hosting logs: kept by Cloudflare for a limited time under its own policies.

Your rights

Under UK data protection law you can ask for a copy of the personal information we hold about you. You can also ask us to correct or delete it, to stop or restrict how we use it, and to send it to you or another organisation in a portable format. To do any of this, email hello@yoghurtdigital.co.uk. We'll respond within one month.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd be grateful for the chance to put things right first.

Children

zhttp is a tool for developers and isn't aimed at children. We don't knowingly collect information from children.

Changes to this policy

If we change this policy, we'll update this page and the date at the top.