Privacy Policy

Last updated: 2026-11-09

This notice explains what personal data t.etun.uk processes, why, and the rights you have. It covers the tunnel service, the account portal and the payment flow.

1. What we collect, and why

• Account email - from your sign-in provider (Google, GitLab, GitHub, Apple) or from the address you enter at checkout. Used to identify your account, deliver the API key, and contact you about the Service. Lawful basis: performance of a contract.
• Sign-in identifier - the provider's stable user id plus your display name, so a later sign-in resolves to the same account.
• API key - a random token that authenticates your client. It is the credential for your tunnels.
• Plan and subscription state - which tier is active and when it expires.
• Custom subdomains - the names you register on your account.
• Technical data - the IP address and User-Agent of connecting clients, request metadata for tunnels, and aggregate byte counts, kept to operate the service, rate-limit abuse and diagnose faults. Lawful basis: legitimate interest in running a secure service.
• Session cookie - one HttpOnly cookie (et_session) holding a signed value of your email, so you stay logged in. It is strictly necessary; we use no analytics, advertising or third-party tracking cookies.

We do not ask for and do not store card numbers, bank details or wallet keys. Payment credentials are entered on the payment provider's own pages.

2. Who else processes it

• Your sign-in provider (Google, GitLab, GitHub or Apple) authenticates you and shares your email and display name with us.
• Payment providers (PayPal, NOWPayments) process the payment and tell us that it succeeded, together with the email and plan that were attached to the order.
• DNS and CDN providers (for example Cloudflare) resolve the domain and may see visitor IP addresses as any authoritative DNS or edge provider does.
• We do not sell personal data, and we do not share it with advertisers or data brokers.

3. How long we keep it

• Account and plan data: while the account exists, and afterwards only as long as needed for accounting and legal obligations. An account that has never paid and has been inactive may be removed.
• An account that has ever paid is retained after it lapses so that support, refund requests and re-subscription remain possible.
• Session cookies expire after 30 days or when you sign out.
• Request logs are short-lived operational data and are rotated.

4. Your rights

Depending on where you live you have some or all of the following rights: access, correction, deletion, restriction, portability, objection, and the right to lodge a complaint with your supervisory authority (GDPR); the right to know, delete, correct and to opt out of "sharing" or "selling" (CCPA/CPRA - we do neither), and not to be discriminated against for exercising them.

• Access and correction: your account page shows the email, plan, expiry and custom subdomains we hold.
• Deletion: "Close account" on the account page deletes the account, its API key and its subdomains immediately.
• Anything else: write to info@t.etun.uk and we will respond within 30 days.

5. International transfers and security

The service runs on servers in the region chosen by its operator; your data may therefore be processed outside your country. Transfers rely on the safeguards offered by our processors (standard contractual clauses where applicable). We use TLS for all traffic, hash-free random API keys (never derived from your email) and restrict access to the server to its operator.

6. Children

The Service is not directed at children and we do not knowingly collect data from anyone below the age of digital consent in their country.

7. Changes

If this notice changes materially we will note the new date at the top and, for significant changes, mention it in the account page.

8. Contact

Operator of this instance: t.etun.uk. Privacy questions and requests: info@t.etun.uk.