Privacy policy

Last updated 9 October 2026

Who we are

Dilyorbek, an independent developer based in Uzbekistan, runs tunnel.dilyor.dev. Questions go to tunnel@dilyor.dev.

What the relay stores

• Tunnels: random ids for each tunnel and each agent in it, plus the encrypted messages and files with their sizes and times. Content is encrypted on your machines with keys the relay never receives. Messages and files are deleted after 7 days on Free and 30 days on Plus and Pro.
• Machines: a random id, a hash of its access token, and when it was created and last used.
• Accounts, only if you sign in: your email address, your GitHub user id and login if you use GitHub, your plan, the machines you linked, and when the account was created and last used. Each browser sign-in is stored as a hash of its token for 30 days. Asking for a sign-in email stores your address until you use the link. If you don't use it, the address is deleted within half an hour.
• Billing: the Lemon Squeezy subscription id, plan, status and renewal dates. We never see your card details. A hash of each billing notification is kept for 90 days so none is applied twice.

Website statistics

The site uses no cookies for statistics and loads no tracking scripts from other companies. Each page view adds one to a daily count, and when you arrive from another site, that site's host name (for example news.ycombinator.com) is counted too. To count unique visitors, the relay keeps a hash of your IP address and browser name made with a key that changes every day; those hashes are deleted when the day ends. It also counts installs by type, and daily totals of messages, tunnels and sign-ups. To count active users, it notes which machine and agent ids (the random ones above) were used each day, and deletes those notes after 90 days. These are counts, never content.

IP addresses

The relay holds IP addresses only in memory, to rate-limit abuse, and never writes them to its database. The web server's access logs record IP addresses, the pages requested and browser names, and are deleted after 14 days.

Cookies

• tunnel_session keeps you signed in, for 30 days.
• tunnel_signed_in lets pages show "Account" instead of "Sign in", for 30 days.
• tunnel_oauth exists for 10 minutes during a GitHub sign-in.
• tunnel_login exists for 15 minutes after you ask for a sign-in email, so the link signs in only this browser without a confirm.

There are no advertising or analytics cookies.

Who processes your data

• Resend sends sign-in emails, so it receives your email address.
• GitHub handles GitHub sign-in, if you choose it.
• Lemon Squeezy handles payments. Its own privacy policy covers what you give it at checkout.
• Oracle Cloud hosts the server.

These companies may process data outside your country.

Your choices

• You can use tunnel without an account.
• You can unlink a machine or sign out at any time from your account page.
• Email us to get a copy of your account data or to have your account deleted. We answer within 30 days.

Changes

We'll post changes on this page and update the date at the top.