tunnel.pizza

tunnel.pizza Privacy Policy

Effective: September 28, 2026

At tunnel.pizza we recognize that privacy is important. This Policy applies to the tunnel.pizza website, the tunnel service reachable at it, and the hostnames it issues (together, the "Service"), all offered by Scaffoldly LLC. If you have any questions about this Policy, please contact us at legal@scaffold.ly.

Information we collect and how we use it

The Service takes no payment and keeps no account of its own: signing in means asking a provider you already have an account with, GitHub today, who you are. What it records is what a request carries:

  • When you sign in: you are sent to GitHub, which asks your permission to tell us your login and the email addresses on your account, and nothing more. GitHub answers with a token that we use only to read those, and then discard. What we keep is your login, your primary verified email address, and the name of the provider that vouched for them, in the cookie described below, so that your own page and the tunnels you have requested, including those requested with a Claude token whose account has the same email address, are shown to you and to no one else. Signing in writes nothing anywhere else.
  • When you request a tunnel: your IP address and the country, region, metro, and postal codes Cloudflare's edge derives from it; your client's User-Agent; the time of the request; and, when you present a GitHub token, the GitHub login it resolves to, or when you present a Claude token, a short SHA-256 hash of the email address on the Claude account it resolves to, never the address itself, or that account's ID when the token does not let us read the address. The IP address and location codes, and the login, hash or account ID when there is one, are kept with the DNS record for your hostname in our Cloudflare account, so that the record itself says who last used it and where from. The public status page shows on a map how many tunnels come from each state, province, or country, with no hostname or address beside them.
  • Before a tunnel is issued: your IP address is looked up against the DroneBL and Barracuda blocklists, and its country is checked against a list of countries we do not serve. A listed address or country is refused. The lookups send your address to those blocklists' DNS servers.
  • Log information: our servers and Cloudflare's edge record the requests they handle: the URL, method and status, your IP address, User-Agent, and the time.
  • Cookies: the Service sets two, both its own, and neither tracks you. During sign-in, a cookie holds a random value that the provider must echo back, so that only a sign-in you started can complete, and the page to return you to; it lasts ten minutes. Once you are signed in, a cookie holds your login, your email address and the provider's name, signed so that it cannot be altered, until you sign out or thirty days pass. No third party sets cookies through the Service. The website keeps your light-or-dark theme choice in your browser's local storage, which never leaves your browser.
  • User communications: when you send an email or file a report with us, we may retain it in order to respond and to improve the Service.
  • Your tunnel's traffic is not collected. The Service is a control plane: it issues credentials and hostnames. Traffic to and from your tunnel passes between Cloudflare's network and your machine, and Cloudflare's handling of it is governed by their Privacy Policy. One exception: when your client cannot reach Cloudflare's edge directly on port 7844, it connects through a relay we run on Fly.io instead. The relay forwards the connection as is, still encrypted end to end between your machine and Cloudflare, and cannot read it; it logs the connection's source address and time, as any server does.

We use this information to:

  • issue, resume, and reclaim tunnels and hostnames;
  • refuse abusive requests and enforce rate limits;
  • investigate abuse reports and respond to legal requests;
  • keep the Service running and diagnose faults; and
  • understand how the Service is used, in aggregate.

tunnel.pizza processes this information on Amazon Web Services and Cloudflare servers in the United States of America. If you use the Service from elsewhere, your information is transferred to and processed in the United States.

Retention

A tunnel is reclaimed after about thirty minutes without a connection, and the hostname's record, with that information, is kept for about one day after that so the hostname can be resumed, then deleted. Server and edge logs are kept for a limited period for the purposes above and then discarded. Communications are kept as long as needed to resolve them.

Information sharing

tunnel.pizza only shares personal information with other companies or individuals outside of Scaffoldly LLC in the following limited circumstances:

  • With the providers that run the Service (Cloudflare, which holds the DNS records and carries your tunnel; Amazon Web Services, which hosts our servers; GitHub, which we ask to verify a token you present and, when you sign in, to tell us your login and email address; and Anthropic, which we ask to verify a Claude token you present and to tell us the account it belongs to and, when the token allows, that account's email address), each of which processes the information to provide their service to us.
  • With the DroneBL and Barracuda blocklists, which receive your IP address as part of the lookup described above.
  • When we have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, (b) enforce our Terms of Use, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address fraud, security or technical issues, or (d) protect against imminent harm to the rights, property or safety of tunnel.pizza, its users or the public as required or permitted by law.
  • If Scaffoldly LLC becomes involved in a merger, acquisition, or any form of sale of some or all of its assets, we will provide notice before personal information is transferred and becomes subject to a different privacy policy.

Information security

We take appropriate security measures to protect against unauthorized access to or unauthorized alteration, disclosure or destruction of data. Access to the accounts holding it is limited to the people who operate the Service, and the credentials that reach those accounts are never handed to a tunnel. Security reports are welcome at the addresses in security.txt.

Accessing and deleting personal information

We make good faith efforts to provide you with access to the personal information we hold about you and to delete it at your request if it is not otherwise required to be retained by law or for legitimate business purposes. Stopping your tunnel and letting its hostname be reclaimed deletes that information on its own. Signing out deletes the session cookie, and revoking tunnel.pizza in your GitHub settings ends its permission to name you. For anything else, write to legal@scaffold.ly; we may ask you to identify the request or hostname concerned, and we may decline requests that are unreasonably repetitive, require disproportionate technical effort, or jeopardize the privacy of others.

Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has used the Service, contact us and we will delete what we hold.

Enforcement

tunnel.pizza regularly reviews its compliance with this Policy. Please direct any questions or concerns regarding this Policy or tunnel.pizza's treatment of personal information to legal@scaffold.ly. When we receive formal written complaints at this address, it is our policy to contact the complaining user regarding his or her concerns. We will cooperate with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of personal data that cannot be resolved between tunnel.pizza and an individual.

Changes to this policy

This Privacy Policy may change from time to time. We will not reduce your rights under this Policy without your explicit consent, and we expect most such changes will be minor. We will post any changes on this page, and each version is identified at the top by its effective date.

Contact

Scaffoldly LLC
104 S Main Street, Goshen, IN 46526
legal@scaffold.ly