TUNd

Privacy Policy

This policy explains which personal data TUNd at tund.io processes, why, and for how long. It covers people with an account and visitors of the tunnels it serves.

Who is responsible

Tillmann Hübner, In der Muld 63, 99090 Erfurt, is responsible for your data (the controller under the GDPR). Write to hi@tund.io with any question about your data; the imprint has all contact details.

Your account

  • Account details: your email address, your name, a hash of your password (never the password itself) and when you last used the account. If you connect GitHub, the account id and email address they report. With two-factor authentication, its secret (encrypted) and hashed recovery codes; with passkeys, their public keys. The teams you belong to. Kept while your account exists, to provide the service (Art. 6(1)(b) GDPR).
  • Team invitations: who sent an invitation, its role and the email address it was sent to, if it names one. Deleted 30 days after it expires; invitations are valid for 7 days (Art. 6(1)(b) and (f) GDPR).
  • Signed-in browsers: the IP address and browser of each dashboard session, so you can see and end them. Deleted when the session expires, 30 days after its last use (Art. 6(1)(b) and (f) GDPR: the security of your account).
  • Terminals: auth tokens are stored as hashes with the time they were last used; a token created by logging in a terminal is named after its machine. For each client connection, the client version, operating system, machine name and IP address, deleted 7 days after it disconnects. While a terminal login is pending, its machine name, operating system and IP address are kept until it's done or has expired (Art. 6(1)(b) GDPR).
  • Tunnels and usage: for each tunnel, its hostname, the local address it forwards to and when it ran, deleted with its client connection (7 days after it disconnects). Your reserved hostnames and domains, the access rules of protected tunnels (such as allowed email addresses and IP addresses) and how much data you transferred per day, for the limits of your plan, are kept while your account exists (Art. 6(1)(b) GDPR).
  • Email: confirmation links, password resets, team invitations and security notices are sent through TUNd's mail server. Links are stored as hashes with the address they were sent to, while your account exists, to know which addresses you confirmed (Art. 6(1)(b) GDPR).

Traffic through tunnels

Visitors of tunnels are affected too, without an account.

  • Recorded requests: requests to HTTP tunnels are recorded with their headers and up to 256 KB of each request and response body, so the tunnel's owner can inspect and replay them. That includes the visitor's IP address and whatever the request carries, such as cookies and form fields. Deleted after 7 days.
  • TCP and TLS tunnels: the visitor's IP address, the duration and the bytes of each connection, deleted after 7 days.
  • Protected tunnels: after a visitor enters a tunnel's password or signs in, a cookie on its hostname keeps them signed in for 7 days. With single sign-on, the identity that the owner's sign-in provider reports (such as email address and name) is passed on to the owner's service and recorded with each request.

TUNd does this for the account holder who runs the tunnel (Art. 6(1)(b) GDPR) and in its legitimate interest in running a tunnel service (Art. 6(1)(f) GDPR). What a tunnel's own service does with visitors' data is up to its owner; ask them.

Security and abuse prevention

To keep the service and its visitors safe (Art. 6(1)(f) GDPR):

  • Audit log: security-relevant events of accounts (sign-up, passkey sign-ins, sign-in methods, passwords, email address changes, two-factor authentication) and the actions of administrators, with the email address and IP address of whoever made them. Kept without a time limit.
  • Abuse reports: reports about tunnels, with the reporter's email address (if given) and IP address. Kept without a time limit.
  • Trust and flags: administrators can mark accounts as trusted, or flag them for review with a reason, also automatically, for example after a phishing match. Kept while the account exists.
  • Phishing checks: pages served by tunnels of accounts that aren't trusted are scanned for signs of phishing.

Deleting your account

You can delete your account at any time under Settings. This removes your tunnels, hostnames, domains, tokens and recorded traffic. Domains, sign-in providers and TCP ports you added to a team with other members stay with the team. Audit log entries and abuse reports are kept for the periods above, and billing records for those of tax law. A disabled account can't sign in and is kept with the reason it was disabled; to have it deleted, contact Tillmann Hübner (hi@tund.io).

Services of other companies

  • Stripe handles payments. When you subscribe, Stripe receives your email address and name and collects your billing address and payment details, which it processes under its own privacy policy. Invoices and billing records are kept for the retention periods of tax and commercial law (Art. 6(1)(c) GDPR).
  • GitHub: if you sign in with GitHub, you're sent to them, and they tell TUNd your account id, your verified email address and your name.
  • Cloudflare Turnstile checks the sign-up, password reset and abuse report forms. It loads from Cloudflare, which receives your IP address and information about your browser.
  • Google Safe Browsing: the addresses of online tunnels of accounts that aren't trusted, and of custom domains under review, are sent to Google to check them against its list of dangerous sites.
  • RDAP (rdap.org): when a custom domain is reviewed, its registration date is looked up there, which sends the domain name.

Cookies and storage

TUNd uses no analytics, advertising or tracking. It only stores what signing in and using the service need:

  • a cookie that keeps you signed in to the dashboard, for 30 days after your last visit;
  • short-lived cookies while you sign in (also with GitHub), confirm or set up a second factor or use a passkey, and while visitors sign in to a protected tunnel: at most 15 minutes;
  • on tunnel hostnames, the 7-day cookie of a protected tunnel, and a 7-day cookie that remembers a visitor saw the warning page before a tunnel;
  • your choice of light or dark theme, and of the language of code examples, in your browser's local storage.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format (Art. 15 to 21 GDPR). Where processing is based on your consent, you can withdraw it at any time. You can change your name and email address and delete your account under Settings; for anything else, contact Tillmann Hübner (hi@tund.io). You also have the right to complain to a data protection supervisory authority, for example the one where you live.

Changes

This policy changes when TUNd changes. The current version is always on this page.