Privacy
Your traffic stays yours.
Proxy Manager routes only the traffic you choose — by hostname or by app — and passes TLS through untouched. There is no telemetry, no analytics, and no account.
The short version
Proxy Manager collects no data about you. It has no telemetry, no analytics, no account, and no server that sees your traffic. The app is open source under the MIT license, so you can verify every claim on this page in the code.
The app
Everything the app does happens locally on your Mac. It runs an HTTP proxy bound to 127.0.0.1 and routes only the hostnames on your allow-list — and, when you enable per-app routing, the apps you choose — through your SOCKS5 tunnel. Everything else connects directly.
- TLS is passed through.
CONNECTstreams are relayed byte-for-byte; the app never sees plaintext payloads. - Metadata only, on disk. Per-request records (host, method, route decision, status, byte counts, and timing) are written to a local SQLite file at
~/Library/Application Support/ProxyManager/telemetry.sqlite. When per-app routing is on, the originating app’s name and bundle identifier are recorded too. No request bodies and no headers are captured. Retention is 7 days by default and configurable in Settings. - Shell integration. If enabled, the app writes
~/.config/proxy-manager/env.shand adds a guardedsourceline to the shell rc files you approve, so new terminal sessions exportHTTP_PROXY/HTTPS_PROXY. - Secrets in the Keychain. If you use “Run the tunnel for me,” an SSH password is stored in the macOS Keychain and fed to
sshthrough a one-shot helper. It is never written to the config or a command line. Key-file auth stores nothing. - System proxy safety. Before changing the macOS proxy, the app saves your original settings locally so it can always restore them. A small watchdog does the same if the app crashes.
Nothing here is uploaded, logged remotely, or shared.
Automatic updates
Proxy Manager uses Sparkle, the open-source update framework, to check for new versions. An update check fetches a small static file (the appcast) from GitHub Releases. That request carries no personal information, no identifiers, and nothing about your traffic. Updates are EdDSA-signed and verified before installing. You can turn automatic checks off in Settings → General.
This website
The site uses Umami, a privacy-friendly, cookieless analytics tool, to count visits and see which pages are useful. It records aggregate page views, referrer, and coarse device/browser information. It sets no cookies, stores no cross-site identifiers, and does not track you across other sites. The site runs no advertising or third-party tracking scripts. It is served by GitHub Pages, which may keep standard technical logs (such as IP address and requested URL) for security and operations.
The page stores two small things in your browser: your theme choice in localStorage, and a short-lived cache of public GitHub data (the latest release and star count) in sessionStorage. Neither identifies you, and both stay in your browser.
Downloads
App downloads are served from GitHub Releases. When you download Proxy Manager, GitHub’s own privacy policy applies to that request, as it would for any file hosted on GitHub.
Changes to this policy
If this policy changes, the new version will be published on this page, and the change will be visible in the site’s open-source history like everything else.
Questions
If anything here is unclear, open an issue on GitHub or read the code at chaim-chv/proxy-manager.