Legal
Privacy Policy
Last updated: July 21, 2026
1. Overview
RockTunnel ("we", "our", or "us") operates the RockTunnel platform — a developer tool for localhost tunneling, API playgrounds, webhook inspection, and mock API servers. This Privacy Policy explains exactly what information we collect, how we store and protect it, and your rights over it. By creating an account or using the Service, you agree to these practices.2. Account and Authentication
RockTunnel uses Google OAuth for sign-in. When you authenticate, Google shares your name, email address, and profile picture with us via Supabase Auth. We do not receive or store your Google account password. We do not support email/password sign-up. Your account is tied to the email address on your Google account.3. What Data We Store
Workspaces and members
When you create a workspace we store its name, plan tier, and creation time. When you invite team members, we store the invited email address, their role (Owner, Admin, or Member), a one-time invitation token that expires in 7 days, and timestamps for when the invitation was sent and accepted.
API Playgrounds
Playgrounds store the collection name, individual endpoint definitions (HTTP method, path, headers, body, and description), and request run history. Environment variables you create inside a playground — such as API keys or tokens — are encrypted with AES-256-GCM before being written to the database. The raw value is never stored in plain text.
Tunnels
When you create a tunnel we store its display name, subdomain slug, and status. Tunnel authentication tokens are hashed with SHA-256 before storage — we store only the hash and a 10-character preview for display purposes. The raw token is shown once at creation and cannot be recovered afterward.
Webhook inboxes
Each webhook inbox has a public URL that receives HTTP requests from external services. We store the full incoming request payload — method, headers, body, and timestamp — as webhook events so you can inspect them in the dashboard. Webhook event data is scoped to your workspace and is only accessible to members of that workspace.
Mock API servers
Mock server configurations include the server name, defined routes (HTTP method, path, and response body), and incoming request logs so you can verify that your frontend is hitting the correct endpoints.
4. What We Do Not Log
We do not read or inspect payloads passing through your tunnels. We do not log request or response bodies of API Playground runs beyond what you explicitly save. We do not sell your data to third parties. We do not use your data for advertising.
5. How We Protect Your Data
- Encryption at rest: Sensitive values such as environment variables are encrypted using AES-256-GCM with a per-value random IV before being written to the database.
- Hashed credentials: Tunnel tokens are stored as SHA-256 hashes. Raw values are never stored or logged after the initial creation response.
- Row Level Security: The database enforces RLS on every table — users can only read and write rows that belong to their own workspace.
- Admin access: A service-role key with RLS bypass is used only for trusted server-side operations (such as accepting workspace invitations). It is never exposed to the client.
- Transport security: All communication between your browser and RockTunnel is encrypted over HTTPS/TLS.
6. Transactional Email
We send email only for workspace invitations. Invitation emails are sent from hellorocktunnel@gmail.com and contain a single-use acceptance link that expires in 7 days. We do not send marketing email. You cannot opt out of transactional emails because they are required for workspace collaboration to function.7. Workspaces and Team Visibility
Within a workspace, all members can see other members' names, email addresses, and roles. Owners and Admins can see and manage pending invitations. Members cannot manage other members or view invitation details. All workspace resources — playgrounds, tunnels, webhooks, and mock servers — are accessible to all active members of that workspace.8. Plan Tiers
The Free plan limits each workspace to 2 playgrounds, 10 endpoints per playground, 2 webhook inboxes, and 2 mock servers. These limits are enforced at the API level. We store your current plan tier to enforce these limits and for billing purposes.9. Third-Party Infrastructure
- Supabase:Our database and authentication provider. Data is stored in Supabase-managed PostgreSQL with RLS enabled. Supabase's privacy policy governs their infrastructure-level handling of data.
- Google OAuth:Used for sign-in. Google's privacy policy governs the data shared during authentication.
- Hosting provider: The application is deployed on a cloud host. Server logs (IP address, request path, response status) may be retained by the provider for operational purposes.
10. Cookies
RockTunnel uses session cookies set by Supabase Auth to keep you signed in. These are strictly necessary — no consent banner is required because no tracking or advertising cookies are used. Clearing your cookies will sign you out. We do not use localStorage to persist sensitive data.11. Data Retention
Your account data, workspaces, playgrounds, tunnels, webhooks, and mock servers are retained for as long as your account exists. Deleting a resource from the dashboard removes it from the database. When you delete your account, all associated data is permanently removed within 30 days.12. Your Rights
You can:- Delete individual resources (playgrounds, tunnels, webhooks, mock servers) from the dashboard
- Leave a workspace at any time from workspace settings
- Request a full account deletion and data removal by emailing us