It depends on what you mean by "privacy."There are at least three separate concerns: Does the client send telemetry? Does it sync your collections or API definitions to a cloud service? Do your API requests transit through a third-party server, or are they sent directly from your machine?

Those matter much more than whether the client is Postman, Thunder Client, or something else.