Nothing leaves your computer.
Here is everything that changes on it.

Your computer

Most of what Wharf writes stays in one folder. Outside it, Wharf changes only the places below, and says so in the app when it does.

Wharf writes here Wharf never writes here

• The Wharf folder On first start

  ~/Wharf — PHP and webservers it installed, your settings, generated configs, certificates and logs.

  To undo: quit Wharf and delete the folder.

• Your shell's startup files On first start

  So that php in a terminal is the PHP Wharf uses, it adds one marked block to ~/.zshrc, ~/.bashrc, ~/.profile and fish's config — whichever exist. On Windows, it adds one folder to your user PATH instead. Every other line stays as it was, and no password is needed.

  To undo: turn off Settings → PHP → Use in terminal. Wharf removes its block and nothing else.

• Your computer's trusted certificates When you turn on HTTPS

  For HTTPS without browser warnings, Wharf uses mkcert to make a certificate authority of your own, and adds it to your system's trusted certificates and to Firefox's. Your computer asks for your password first. Say no, and HTTPS still works, with a browser warning.

  The authority's key stays on your computer, in mkcert's folder. Anyone with that key could make certificates your browser trusts, so never share it.

  To undo: run mkcert -uninstall.

• Ports 80 and 443, on Linux When the first project starts

  Linux lets only administrators use ports below 1024, and projects answer on 80 and 443. Wharf asks for your password once, then lowers that limit to 80 — now, and in /etc/sysctl.d/60-wharf.conf for every start after. Any program on this computer may then use ports from 80 up. Say no, and the project stays stopped.

  To undo: delete that file and run sudo sysctl -w net.ipv4.ip_unprivileged_port_start=1024.

• Your distribution's Apache, on Linux When you install Apache

  Wharf installs your distribution's Apache package with its package manager — apt, dnf, zypper or pacman — after asking for your password. Where the package starts an Apache service of its own, Wharf switches that service off, so it does not hold port 80.

  To undo: remove the package, e.g. sudo apt remove apache2.

• Homebrew, on a Mac When you install nginx

  On macOS, nginx comes from Homebrew: Wharf runs brew install nginx for you.

  To undo: brew uninstall nginx.

• Your project folders

  Wharf reads them, and writes nothing into them. Removing a project leaves its folder alone. The one exception is up to you: when you reset Wharf, you can tick Also delete the projects in www/.

• The hosts file

  Projects answer at name.localhost, which your computer knows by itself. Adding a project never asks for a password.

• PHP and webservers you already had

  Wharf uses them where they are. Removing a PHP version it did not download only hides it in Wharf.

• Anything running after you quit

  Quit Wharf, and everything it started stops. Nothing starts at login. Your projects answer your computer only — nobody else on the network can reach them.

Downloads

Wharf downloads nothing on its own. It connects to the places below only when you choose Download or Install, or turn on HTTPS — and to see which PHP release it would download when you open the PHP settings. Like any download, the server sees your IP address. Wharf sends nothing else: no ID, no usage data.

Wharf does not check for its own updates. Copy debug information in Settings copies to your clipboard only; you decide where to paste it.

This website

• No cookies, no fonts from elsewhere

  This site sets no cookies and loads no fonts or images from other servers. Its one script is the visit counter below. The Wharf app contains none of it.

• Visits counted by Pirsch Analytics

  To see which pages are found and read, this site loads Pirsch Analytics, a cookie-free counter. From your IP address, browser, the date and a salt it computes a hash as a visitor ID; your IP address is never stored, and you cannot be recognised after 24 hours or across other websites. It also records the page, where you came from, and a rough location (country, city) looked up locally.

  The provider is Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany; the data stays on servers in Germany. The legal basis is our legitimate interest in knowing which content is read (Art. 6(1)(f) GDPR). No cookies are set and nothing beyond what is technically necessary is read from your device, so no consent under § 25 TDDDG is needed. More: privacy at Pirsch.

• Paying what you want, through Stripe

  The Support Wharf button takes you to a payment page run by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Nothing is sent to Stripe until you click it; this site embeds no Stripe script. Payment details such as card numbers go to Stripe only and never reach us. Stripe's privacy policy applies. The legal basis is carrying out the payment you started (Art. 6(1)(b) GDPR).

  The Wharf app knows nothing of payments.

• Hosted by GitHub Pages

  GitHub, Inc. serves this site. To deliver it and keep it secure, GitHub logs your IP address and the page you asked for, and keeps these logs under its privacy statement. GitHub may process this data in the USA; it is certified under the EU–U.S. Data Privacy Framework. The legal basis is our legitimate interest in running this site reliably (Art. 6(1)(f) GDPR).

• Links to GitHub

  Wharf's source code is on GitHub. Following a link there means GitHub's privacy statement applies.

Your rights

Responsible for this website is Manuel Steinberg — see the imprint for the address. Ask about your data at any time through the contact form.

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable form. You may also complain to a data protection authority — for us, the Bavarian State Office for Data Protection Supervision (BayLDA).

Last updated: 21 September 2026.