Privacy
Homeport runs on your Mac. This page lists every case where the app, the bundled command-line tool or this website sends something over the internet, what is sent, and where it goes.
What Homeport sends online
Homeport connects to the internet to check for updates, to activate and check your license, to send an assistant request you approved, and when you ask it to check a project's dependencies, which runs that project's own package tools. Health checks go to the addresses in your own config, normally your own Mac. Local domains work only on this Mac. The table lists every case where the app or the command-line tool contacts the internet.
| What | When | What is sent |
|---|---|---|
| Update check | Automatically (you can turn this off in Settings), and when you choose Check for Updates… | A request for the update feed at downloads.gethomeport.app, which includes the release notes. If you accept an update, Homeport also downloads it from the same host. No system profile is sent. |
| License | When you activate Pro; afterwards, when Homeport checks at launch and daily and finds its last successful check is more than 7 days old; once per app version if the license was found invalid; and when you deactivate | To Lemon Squeezy (api.lemonsqueezy.com): your license key, the activation ID, and on activation your Mac's computer name, so you can tell your Macs apart. |
| Dependency check | Only when you choose Check Dependencies… for a project. Homeport shows the exact commands first and asks, unless you approved those same commands for that project before | Nothing is sent by Homeport itself. It runs your project's own package tools (such as npm audit and npm outdated, their pnpm, Yarn and Bun equivalents, pip list --outdated, pip-audit, bundle outdated and bundle-audit check --update), which contact their package registries and advisory databases under their own rules. Some of them, such as npm audit, upload your dependency tree. Your project's package names and versions can therefore reach those services. |
| Command-line tool | Only when you run homeport fetch in a terminal | It runs git fetch on your projects, which talks to each project's git remote with the credentials you already have configured. The app itself doesn't fetch. |
| Assistant | Only when you click Send, Retry or Test Key | To Anthropic (api.anthropic.com) with your own API key. Details below. |
Checked 2026-10-11 against: Config/Homeport-Info.plist, Homeport/Updates/Updater.swift, Homeport/Licensing/LemonSqueezy.swift, Packages/HomeportCore/Sources/HomeportAssistant/API/MessagesClient.swift, Homeport/Environment/DependencyCheckModel.swift, Packages/HomeportCore/Sources/HomeportCore/EnvHealth/DependencyAudit.swift, Packages/HomeportCore/Sources/homeport/Fetch.swift.
No analytics in the app
The app contains no analytics or telemetry code. Homeport doesn't count launches, clicks or features you use.
No account
There is nothing to sign up for. Pro is a license key you enter in Settings.
Runs only what you approved
Homeport runs a project's commands only after you review and approve its config, and asks again when the config changes.
The assistant sends only what you review
Before every send you see exactly what goes to Anthropic, with your own key. Environment values in your config are always hidden, and likely secrets in logs are masked.
What is sent
- Your question, exactly as you typed it.
- The context sections ticked in Review what will be sent, shown before every send exactly as they will be sent. You can untick any of them: status, config, health results, ports and metrics, the environment check summary, and recent logs per service. Asked from the Overview rather than from one app, the assistant gets a single Apps section instead: each trusted app's name and its services' status, with no logs or config, and only a count of apps left out because their config isn't trusted.
- Follow-up questions tick only the sections that changed since you last sent them. For an app whose config you haven't approved, nothing is ticked.
- Limits: up to 200 log lines (16 KB) per service, and config up to 32 KB.
How secrets are kept out
- Config: every value under
env:is replaced by‹redacted›before it is shown or sent. The keys stay, so the assistant knows a variable exists. You can't turn this off. - .env files: their paths are sent, never their contents.
- Environment check summary: tool versions and the names of missing keys, never values.
- Logs: values from your config's
env:and your .env files are replaced by‹redacted:NAME›when the name looks secret (likeAPI_TOKENorDB_PASSWORD) and the value has at least 4 characters, or when the value has at least 8 characters and isn't a plain word. With Mask likely secrets in logs and config (Settings ▸ Assistant, on by default), Homeport also masks private keys, well-known token formats, Bearer and Basic credentials, passwords in URLs, secret-named query parameters, and assignments likepassword = ….
Limits of masking
- Short or plain-word values of variables with ordinary names (for example
LOG_LEVEL=infoor a port) can appear in logs as they are. - Pattern masking can miss secrets in unusual formats.
- A value you removed from your config before the assistant read it isn't known to the masking.
- Anything you type in your question is sent as you typed it.
Requests go to Anthropic's API under the terms of your own Anthropic account.
Checked 2026-10-09 against: Homeport/Assistant/SendPreview.swift, Packages/HomeportCore/Sources/HomeportAssistant/Context/AssistantContextBuilder.swift, Packages/HomeportCore/Sources/HomeportAssistant/Redaction/SecretRedactor.swift.
This website
We count visits with Cloudflare Web Analytics. It sets no cookies and stores nothing in your browser. It records which page you viewed, the site that linked you here, your country, browser, operating system and device type, and how fast the page loaded. Like any website, the pages are served by a host (Cloudflare) that receives your IP address to deliver them.
The site stores one thing in your browser, and only if you use the appearance switch in the footer: your choice of System, Light or Dark (localStorage key theme).
Buying Pro happens on Lemon Squeezy's checkout, under their privacy policy.
Checked 2026-10-09 against: https://www.cloudflare.com/web-analytics/, https://developers.cloudflare.com/web-analytics/data-metrics/data-origin-and-collection/, https://developers.cloudflare.com/web-analytics/data-metrics/dimensions/.