Know where the requests go.

Entry data and network requests

KeeFetch reads entry URLs and, when configured, titles locally. Direct Site requests the resolved URL and can fetch linked icons and manifests from other hosts. Third-party favicon resolvers may receive the target domain. Android store lookup may query Google Play for an app package.

KeeFetch does not upload your database or send username/password fields as a database export. A URL can itself contain sensitive path or query data, and resolved references can put data into a URL: review entries and diagnostics accordingly. There is no telemetry or analytics.

What Privacy changes

The Privacy profile disables third-party favicon resolvers and Android store lookup. It still fetches the site itself and follows site-linked assets and redirects. It is not a same-origin firewall, an offline mode, or a diagnostics-redaction setting.

Private hosts and redirects

The lexical private-host classifier excludes recognized private addresses and internal names from resolver lookup. Resolver redirects are followed manually: each next destination is checked before contact. Direct Site explicitly permits private hosts.

The classifier does not inspect DNS answers, detect every internal DNS name or prevent DNS rebinding. Do not treat it as network isolation.

TLS and certificate settings

KeeFetch requests TLS 1.2/1.3 through its own HTTP handler without changing KeePass's process-wide settings. A runtime that rejects the handler setting falls back to host defaults.

The optional certificate-chain override applies only to hosts KeeFetch classifies as private/internal. Public hosts retain strict validation. Hostname mismatches and missing certificates remain rejected. Leave the override off unless you need a private server's self-signed or private-CA certificate.

Local diagnostics

Routine plaintext log and CSV files can include entry titles, resolved URLs, outcomes and provider details. They are written beside the database when possible, otherwise in a temporary directory. The completion summary identifies the actual paths.

Inspect and redact files before sharing them. The Privacy profile does not redact them. Treat CSV contents as untrusted when opening them in spreadsheet software.

Report a security concern

Follow the repository's security policy. Do not attach a real vault, credentials or unredacted diagnostics to a public issue.