Privacy Policy

Last updated: May 9, 2026

This Privacy Policy explains what data Portless collects, how it is used, and how long it is retained when you use the service operated by CRBL Technologies, LLC.

1. Data We Collect

• Email address — provided at sign-in, stored in our database, used to identify your account and to send magic-link verification emails.
• Subdomain — chosen at first sign-in, stored in our database, retained until your account is deleted.
• Daemon token — a generated secret shown once and stored in our database only as a hash. Used to authenticate the local Portless daemon. Retained until rotated, revoked, or the account is deleted.
• Device certificates — certificate records used for daemon mTLS, including certificate PEM, trust-chain PEM, serial number, validity window, revocation status, and related metadata. Active and revoked certificate records are stored so relays can reject revoked daemon credentials.
• Bandwidth and activity metadata — bytes transferred per account, request counts, transfer status, route categories, and timing fields used for quota enforcement, diagnostics, and the admin activity view.
• Billing metadata — Stripe customer ID, subscription ID, price ID, subscription status, billing period, quota reset dates, and webhook event IDs used to manage paid entitlement and billing state.
• Session cookie — an HTTP-only cookie (portless_session) set after magic-link verification to maintain your signed-in state. The cookie contains a random session token; our database stores only a hash of that token, plus session expiry and last-use timestamps.
• IP address and user agent — stored for magic-link requests and browser sessions for rate limiting, security, and abuse prevention. Edge, relay, and control-plane logs may also process IP address, host, request path, method, status, duration, byte counts, and redacted query metadata for operational troubleshooting and abuse response.

2. Data We Do Not Collect

• No third-party analytics, advertising telemetry, or behavioral tracking on the Portless join and dashboard pages
• No advertising or tracking cookies
• No payment card data is collected or stored by Portless; Stripe processes payment details, invoices, tax calculation, and subscription billing
• No request-body or response-body inspection — Portless forwards tunneled bytes and counts transfer volume, but does not log, store, parse, classify, or inspect request or response bodies for content

3. Data Storage

Account, tunnel, daemon-token hash, session hash, magic-link, certificate, usage, quota, billing-state, subdomain-event, provider-event, and audit-event records are stored in a PostgreSQL database operated by CRBL Technologies, LLC. Aggregate operational metrics and redacted service logs may be retained separately for capacity planning, diagnostics, security, and abuse response.

4. Data Retention

• Account-owned records such as your account, tunnel, active daemon-token hashes, active browser sessions, certificates, quota counters, and usage deltas are deleted with your account where the database schema links them to the account.
• Magic-link delivery records, audit events, redacted service logs, and aggregate operational metrics may be retained after account deletion where needed for security, abuse prevention, delivery troubleshooting, legal compliance, or service integrity. These records may include email address, IP address, user agent, event metadata, or delivery-provider status.
• Bandwidth counters reset according to the active subscription quota period.
• Browser sessions expire on logout, account deletion, or after the configured session lifetime, whichever is earlier.
• Magic-link codes expire within 15 minutes of issuance and are marked used after a single verification.
• Service-log retention depends on the deployed logging and hosting configuration. We retain logs only as long as reasonably needed for operations, security, abuse response, and legal compliance.

5. Legal Basis for Processing

We process your data on the following legal bases under GDPR Article 6:

• Email, subdomain, daemon-token hash, device certificates, and browser sessions — necessary for the performance of the service contract between you and CRBL Technologies, LLC.
• Bandwidth tracking and route/activity metadata — legitimate interest in operating the tunnel service, enforcing fair-use quotas, debugging performance, and preventing abuse.
• Billing metadata and Stripe webhook records — necessary for the performance of the paid subscription contract, tax calculation, fraud prevention, and accounting.
• IP address, user agent, audit events, and service logs — legitimate interest in rate limiting, security, fraud prevention, abuse response, diagnostics, and legal compliance.
• Session cookie — strictly necessary for authentication; no consent required under ePrivacy rules.

6. Third-Party Services

• Cloudflare — used for DNS, edge proxying, Cloudflare Tunnel, and Cloudflare Access depending on the route. Cloudflare may process IP address, hostname, headers, and request metadata for traffic routed through their network. Cloudflare's own privacy policy applies.
• Resend — used to deliver magic-link verification emails. Your email address is transmitted to Resend solely for delivery. Resend's privacy policy applies.
• Stripe — used for Checkout, payment processing, subscription billing, invoices, billing portal, and tax calculation. Stripe may process billing address, tax ID, payment method, invoice, and transaction data. Stripe's own privacy policy applies.

Portless does not sell personal data. Cloudflare, Resend, and Stripe maintain Standard Contractual Clauses (SCCs) for data transfers outside the EEA. We do not independently transfer personal data outside the European Economic Area except through these processors and the infrastructure needed to operate the service.

7. Your Rights

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar privacy rights, you may request access to your data, correction of inaccurate data, or deletion of your data.

You can delete your account from the dashboard, or request deletion by contacting [email protected]. Account deletion removes account-owned service state, while some audit, delivery, security, aggregate, or legal-compliance records may be retained as described above.

8. Data Controller

The data controller for this service is CRBL Technologies, LLC. For privacy questions, data-rights requests, or to contact our privacy contact, email [email protected].

← Back to Portless