Privacy Policy

Last updated: June 2026

This policy explains what data Tunly collects and how it is used. Tunly is a developer tool; we aim to collect the minimum needed to operate the service.

Account data

When you sign up we store your email address and a hashed password. Passwords are stored only as bcrypt hashes and are never logged.

Email verification

Email verification is temporarily optional while Tunly stabilizes production mail delivery. When enabled, verification codes are short-lived, single-use, and stored only as hashes. They are delivered by email and are never exposed to client-side JavaScript.

Operational data

To route traffic and show live/offline status we process request metadata (timestamps, paths, status codes, link identifiers). The Local Console runs on your machine; request inspection and replay happen locally and sensitive headers are redacted in "safe curl" output.

Analytics

Web analytics are optional and disabled by default. When enabled by the operator, a privacy-friendly, cookie-light analytics snippet may be loaded; no analytics secrets are embedded in client assets.

Your choices

You can revoke API keys at any time from the dashboard and request deletion of your account through your Tunly administrator.