Privacy

What leaves your machine, and what does not.

Soquel is a desktop application. There is no account to create, nothing to sign in to, and no copy of your data on anyone's server. This page is the exhaustive list of the exceptions, because for a tool that holds database passwords and SSH keys, a vague answer is not an answer.

What the app sends

One thing, and only when it checks for an update: a request to releases.soquel.dev. That request necessarily carries your IP address, your operating system and processor architecture, and the version you are running, because those are what the app asks the server about. It carries no identifier, no account and no machine fingerprint, and nothing about your connections or your data. It happens once at startup and whenever you ask, and you can read it in the app's own log.

Nothing else. No analytics, no usage statistics, no remote fonts or scripts: everything the window draws is bundled in the application, behind a strict content security policy. Crash reporting does not exist yet; if it is added it will be opt-in, and it will show you the contents before anything is sent.

What the app runs on your behalf

A connection can take its password from a command you configure, which is how RDS IAM tokens, Vault and 1Password are handled. The app executes the program you named and reads its output; what that program does is between you and it. A command that arrives inside an imported connections file stays inert until you have read its exact arguments and approved them.

What stays on your machine

Passwords and passphrases live in your operating system's keychain, or only in memory when you choose to be asked each time, or in the command you configured. They never cross into the application's web view, and an exported connections file leaves them out unless you explicitly include them, in which case the file is encrypted with a passphrase only you know.

The MCP server that lends databases to coding agents binds the loopback interface and requires a bearer token that never leaves the machine. Its audit log is local. The diagnostic summary the app can produce is assembled locally and copied by you: it carries no connection names, no hostnames and no log contents, and nothing sends it anywhere.

This website

soquel.dev counts page views with Umami, running on our own server rather than a third party's. It sets no cookies, follows you across no other site, and records a page address, a referrer and an approximate country. Nothing is sold or shared.

Contact

Questions about any of the above: hi@soquel.dev, or open an issue on GitHub. The application is source available, so every claim on this page can be checked against the code rather than taken on trust.

Last updated 2 August 2026.