Privacy

What Drakar claims

Drakar listens on one network socket, on 127.0.0.1, which answers only a client holding this launch's token, and its session host on one Unix socket, which only your own Drakar can reach. The only connections Drakar opens of its own are Sparkle's, to check for and fetch updates, and only once you said yes to update checks. Everything else that reaches the network is the claude or codex you installed.

There is no analytics, no telemetry, no crash reporter and no first-run ping. SECURITY.md lists each part of that claim and how scripts/audit-network.sh checks it, against the source, the app you downloaded, and the copy running on your Mac.

The update check

It is off until you answer yes on Home or in Settings › Updates, or press Check Now there. Before that, Drakar never builds the updater, so it opens no connection at all.

A check reads one file, drakar.mgcrea.io/appcast.xml, which redirects to the latest release on GitHub. With automatic checks on, that happens about once a day.

The only thing Sparkle adds that says anything about you or your Mac is its default User-Agent header, which names the app, its version and Sparkle's version, for example Drakar/1.0.0 Sparkle/2.9.6. It adds no licence key and no machine id. Sparkle can also add a system profile with your macOS version, Mac model, processor, memory and language, but Drakar ships with that turned off.

Like any request your Mac makes, the check also carries your IP address and the standard headers macOS sends with every web request, such as your language settings.

If a newer release exists and you choose to install it, Sparkle downloads that release's Drakar.zip from GitHub the same way, and installs it only if it carries Drakar's own signature. It always asks before installing: Drakar turns off Sparkle's option to download and install updates automatically, so nothing is ever installed in the background.

The programs it runs

A session runs the claude or codex you installed, unmodified, on your own sign-in. Those programs talk to Anthropic or OpenAI, and to whatever your MCP servers and tools reach, under those companies' terms. What they send is between you and them.

Your licence

A licence key is checked on your Mac, against a public key built into the app, and the trial is counted on your Mac too. Drakar never calls a licence server. Nothing is on sale yet, so this site holds no purchase records.

This site

Static files on Cloudflare, with no cookies, no forms and no third-party embeds. It loads no fonts or images from anywhere else, and its content security policy refuses requests to origins it does not name. Cloudflare keeps its own request logs, as any host does.

It counts page views with Cloudflare Web Analytics, which Cloudflare adds to every site on mgcrea.io. That sets no cookie and stores nothing on your device. It records the page address, the referring page, your browser and operating system, your screen size, how long the page took to load, and the country the request came from. It never receives your IP address, and no identifier links one visit to another or to you. Any content blocker stops it, and the page works the same without it.

The download links redirect to Drakar's releases on GitHub, and GitHub's own privacy terms cover what happens there.

Asking

Questions go to support@mgcrea.io. If you find Drakar doing something this page says it does not, that is a security report: write to security@mgcrea.io.

If this page changes, the date at the top moves. The canonical copy lives at https://drakar.mgcrea.io/privacy/.