Privacy
Envy is a local-first developer tool. Everything it does — discovering your Docker
containers, resolving *.envy names, issuing certificates, and routing
HTTPS — happens entirely on your machine. We do not run a server for
your data, we do not have an account system, and we cannot see your containers, domains,
or traffic.
TL;DR
- No account, no sign-in, no cloud sync.
- No analytics or usage telemetry.
- Your container list, domains, and settings live in files on your machine.
- Envy makes exactly one kind of outbound connection, described below — which you can see and control.
What stays on your machine
Envy stores its state in your user data directory and never uploads it:
- Configuration — your domains and per-container assignments (
config.json). - App settings — preferences like keep-running and start-at-login (
settings.json). - Local certificate authority — the private CA used to sign
.envycerts. Its key never leaves your machine.
Your container traffic is proxied locally between your browser and the Docker container. It is never sent to us or any third party.
The one outbound connection Envy makes
| When | Where | Why |
|---|---|---|
| Checking for updates | GitHub Releases (github.com) |
To see whether a newer version is available and download it. Sends only your current version + platform. |
It carries no container names, domains, or any request/response content. Everything else Envy does works fully offline.
Verifying nothing else is sent
- Read the source. Envy is open source — audit exactly what it does on GitHub.
- Network monitor. With Little Snitch / Wireshark /
tcpdump, confirm Envy makes no outbound connections beyond the update check. - Local DNS only.
*.envylookups are answered by Envy's own resolver and never leave your machine.
Change log
- 2026-07-26. Envy is now open source; license activation removed — the update check is the only outbound connection.
- 2026-06-18. Initial version.