Privacy Policy

Last updated: January 18, 2026

We don't want your data. We built tunn to be a simple tunnel service, not a data collection operation. This policy explains what we do and don't collect.

What We Collect

• Account and authentication info: We use verified email addresses and identity information for authentication and access control. The relay offers the sign-in methods configured by its operator; email links, when offered, are sent through the configured email provider.
• Connection Metadata: We log IP addresses, connection times, and bandwidth usage. This is standard server logging for abuse prevention and rate limiting.
• Bandwidth Counts: We track bytes transferred per account to enforce quotas.
• Request inspection metadata: see Tunnel traffic and inspection below.

Tunnel traffic and inspection

In the default HTTP proxy mode, tunn terminates TLS to route requests and check access. The account inspector keeps recent, sanitized request metadata in relay memory, including methods, paths, selected headers, status codes and timing. Its history does not retain request or response bodies.

The local inspector runs on your machine. With --inspect, it records request metadata; adding --inspect-body enables limited request-body capture locally. When webhook verification is enabled, the relay reads the request body to check its signature before forwarding it.

See the Quickstart inspection step and webhook verification guide for details. You can self-host tunn to operate the relay yourself.

Law Enforcement

If we receive a valid subpoena or court order, we will comply with the law. Any disclosure is limited to data we hold, as described above.

Data Retention

We retain account and authentication records, connection and access records, usage, billing and audit records, and abuse reports for service operation. Monthly bandwidth counters reset; this does not delete retained usage records. You can request account deletion by emailing us. Retention periods and deletion across active stores and backups are under review.

Stripe processes payments when billing is enabled. Authentication providers process information when their methods are configured and used; the configured email provider delivers email links when offered.

No Tracking

We don't use analytics services, tracking pixels, or third-party cookies. The only cookie we set is for authentication.

Open Source

tunn is open source. You can read the code to verify everything in this policy. You can also self-host if you want complete control.

Changes

We may update this policy. Changes will be posted here with an updated date.

Contact

Questions? Email privacy@tunn.to. Abuse reports? abuse@tunn.to.