coffee-bar has no account, no sign-in, and no server. This page says what it reads on your Mac and what leaves it.
It reads agent session metadata, delivered by hooks you install yourself over a local socket. It reads up to three local configuration files — ~/.claude/settings.json, ~/.codex/hooks.json and ~/.cursor/hooks.json — to check your hooks are wired correctly. It reads nothing else.
It never reads the contents of your agent conversations. The fields that carry them are discarded where the event is decoded, before anything stores or displays it. A test in the suite fails if that ever changes.
One request, described in full below: at most once a day, when it starts, and whenever you press Check now, coffee-bar asks this site which release is current. There is no telemetry, no analytics and no crash reporting. The socket coffee-bar opens for agents is a unix domain socket, which lives in the filesystem and has no address, no port, and no route off this machine.
The check for updates named here ships in v0.3.0. This page named what it would send before that release went out, which is what the previous version of this paragraph promised.
It fetches one static file from this site, arangogutierrez.github.io/coffee-bar/latest.json, which says which version is current. There is no query string on that address and there is no identifier of any kind in the request: no install ID, no machine ID, no user name, no host name, no custom user agent, no cookie and no body.
What it does carry is the handful of headers macOS puts on every request any application makes, which coffee-bar neither chooses nor changes. Two of them say anything at all: the user agent, which names the application, its version and your OS build and is the same string for every copy of the same build; and Accept-Language, which carries the language you have set. That second one is the only line in the request that is about you rather than about the software, and it is named here because a promise to say what is sent has to cover all of it. SECURITY.md prints the whole request as measured.
It happens at most once a day, and only when coffee-bar starts, so a coffee-bar left in the menu bar all week makes one request rather than seven — the interval is kept against a stamp in your preferences, not by a timer running in the app. The panel says what the last check concluded and when it ran, and has a Check now button; the Preferences window says the same and states the interval beside it. The check tells you and installs nothing: no update is downloaded, and coffee-bar never replaces itself.
Any further outbound request will be opt-in, off by default, and named here first.
Getting coffee-bar is a normal web request. GitHub serves the download and counts it, as it does for every file it hosts. That is GitHub's logging, under GitHub's privacy policy, and it happens before coffee-bar ever runs. The app itself plays no part in that download.
This page describes v0.3.1.