What leaves your Mac

Only the services you add

On first launch subtank only looks. It checks a fixed list of paths on this Mac: whether files exist and when they changed, the signed-in account in ~/.claude.json, four identity rows in Cursor’s state database, the user: line of the GitHub CLI’s hosts.yml, and whether Claude Code’s or Codex’s Keychain item exists — never what is in it. It starts no vendor tool and makes no network request.

Nothing reaches a service until you add an account for it, and then only that service:

A browser sign-in — Claude Code’s, OpenAI’s, Kilo’s or OpenRouter’s — happens on that service’s own page, in your browser, and is covered by that service’s privacy policy.

The update check

Copies downloaded from this site or installed with Homebrew check for updates 30 seconds after they start and then about every 6 hours. They also check whenever you choose “Check for updates”, and right away when you switch the update channel in Settings. Each check is one HTTPS request to dl.subtank.dev for a small file, latest-mac.yml (or beta-mac.yml on the Beta channel), with a number from the clock added to the address so no cache answers instead. When there is an update, that same file carries its release notes, so showing them under “What’s new” takes no other request.

The request carries no account, and neither your version of subtank nor your version of macOS: its user agent is the generic electron-builder. Like every connection, it comes from your IP address.

subtank 0.0.1 and 0.0.2 also send a random installation number with every check. Their update library makes it once for each copy and adds it by default. Since 24 September 2026 the server deletes it from each request before anything is written. Versions after 0.0.2 send the same all-zero value from every copy instead.

When there is an update, the download names what it fetches: the new version for your Mac’s chip (subtank-0.2.0-arm64.zip, for example). The first update after installing fetches that whole file. Later ones first fetch small index files (.blockmap) of the new version and, when subtank has not kept one, of the version you have, and then only the parts of the file that changed.

Server logs

Caddy, the web server behind subtank.dev and dl.subtank.dev, writes every request to an access log: the time, the IP address, the address requested and the request headers, such as the user agent. Caddy leaves cookies and authorization headers out, and deletes the installation number described above. The public pages set no cookies. The only cookie on subtank.dev belongs to the owner’s admin page: it is set when the owner signs in, and for no one else.

The log is closed and a new one started every day at 00:00 UTC, and whenever it reaches 10 MiB. Closed logs are deleted 7 days (168 hours) after they were closed. So a line is on disk for at most about 8 days.

A program on the same server reads the log as it is written and turns it into counts: visits, downloads and update checks per hour and per day, by page, country, language, version and chip. It looks each address up in a country database stored on the server; it keeps the country, not the address. Counts are kept for 13 months, and download and install totals for as long as subtank exists. Beside the counts it keeps two things, on that server only: the last 48 hours of requests, in memory, with each address cut to its first two numbers (203.0.x.x); and, for requests that probe for weaknesses, the block of 256 addresses they came from, for 30 days. Nothing is shared, sold or sent anywhere else.

Country data: IPinfo Lite (CC BY-SA 4.0).

What there is none of

• No subtank account, and no sign-in to subtank itself.
• No analytics script or service, telemetry, crash reporter or advertising identifier, in the app or on this site. The counts under Server logs are made on this site’s own server, from its own log.
• No remote content in the app: its windows may not load anything from the network, and Chromium’s spell-check download and Translate are switched off.
• No scripts, cookies or third-party requests on this site’s public pages. Their fonts are served from subtank.dev itself. The owner’s admin page is not public, and its one cookie is set only for the owner.

What stays on your Mac

What subtank keeps is in ~/Library/Application Support/subtank:

• settings.json and accounts.json — your settings, the accounts you added and what you typed about them;
• subtank.db — the latest numbers for each account and 90 days of samples;
• statusline.txt and status.json — the one-line status the subtank command prints;
• .updaterId — the random installation number the update library made; versions after 0.0.2 never send it;
• update-install.json — for a moment during an update restart, the version it is installing, so the next start can say whether it did;
• for accounts added with ＋, the profile folders Claude Code and Codex signed in to.

Downloaded updates wait in ~/Library/Caches/subtank-updater: the last update’s zip, kept so the next update can fetch only what changed.

Secrets subtank holds itself — Kilo device-code sign-ins, OpenRouter’s key and the API keys you paste — are in your Keychain under the service subtank, never in a file.

Removing an account deletes only what subtank created for it. Nothing in ~/.claude, ~/.codex, Cursor or the GitHub CLI is ever deleted. “Hide personal info” in Settings replaces emails and nicknames with “Claude 1”, “Claude 2” on screen. Uninstalling explains how to remove everything.

Questions

subtank is made by Deokwon Song. Ask about this page, or report something it gets wrong, at github.com/subtank-dev/subtank/issues.