Privacy Policy

Effective 30 September 2026. This says what tungent collects, why, and for how long. Short version: what we need to route and bill your traffic, nothing for advertising.

What we collect

• Account: your email address and a password hash if you register; a confirmation is sent by email. Anonymous workspaces have no email until claimed.
• Devices and keys: the public halves of the device, ssh and WireGuard keys you register, the names you give them, and when they were last used. We never see private keys.
• Tunnels: the hostnames you create, the local port they forward to, when they connect and disconnect, and which node serves them.
• Traffic metering: per hostname and per minute, request counts, bytes, status codes and latency. This is what your dashboard and your allowance are computed from. We do not store the bodies of requests or responses.
• Access records: for requests to your hostnames, the caller's IP address, user agent, path and status, so you can see who is calling your endpoints (the Audit view). For visits to this site, the same fields, so we can see who reads it, including search engines and AI crawlers.
• Billing: handled by Stripe. We keep your Stripe customer and subscription identifiers and the plan you are on; card details are stored by Stripe, never by us.
• Email: confirmation and alert emails are sent through Mailgun, which records delivery.

Why

To run the service you asked for (route traffic, keep your hostnames, show you your own usage), to bill paid plans, to keep the service safe (rate limits, abuse handling), and to understand how the site is used. We do not sell or share personal data for advertising and we do not run third-party trackers.

Cookies

Two session cookies after you log in, and one that remembers your light/dark theme. Nothing else.

Where and how long

Data is stored on servers in the United States (DigitalOcean). Traffic metering is kept per minute for 7 days and per day for 13 months. Access records are kept for 90 days. Account, device and tunnel data is kept while the workspace exists; hostnames do not expire on their own. When you delete a workspace its tunnels, keys and tokens are deleted; billing records are kept as long as accounting rules require.

Your rights

You can see most of this data in your dashboard. To get a copy, correct it, or have your workspace and account deleted, write to support@tungent.ai from the account's address. If you are in a jurisdiction with data-protection rights (for example the EU or California) those rights apply and we will honour them within 30 days.

Sub-processors

DigitalOcean (hosting), Stripe (payments), Mailgun (email). Each processes only what it needs for its role.

Changes and contact

If this policy changes materially we announce it on the site and by email to account holders. Questions: support@tungent.ai.