Privacy Policy
This Privacy Policy explains how LocalToLink (“we”, “us”) collects, uses, and protects information when you use our tunneling service and website. This notice is provided in accordance with GDPR Article 13.
1. Data Controller
LocalToLink is the data controller for personal data processed through this service. Contact: privacy@localtolink.com
2. What We Collect
- IP addresses — collected when you create tunnels, connect to tunnels, or visit our website. IP addresses are personal data under GDPR.
- Tunnel metadata — session IDs, timestamps, subdomain, request/response sizes, and connection status.
- CLI installation identifier (operators only) — when you use our command-line tool, it may send a random installation ID stored locally on your machine. We store only a one-way hash of that ID to enforce abuse limits and show operators their session history. We do not use this to fingerprint website visitors or tunnel viewers. Delete
~/.config/localtolink/installation.json(or%APPDATA%/localtolink/installation.jsonon Windows) to reset your installation ID. - Abuse reports — URLs, categories, details, and optional contact information you submit through our abuse form.
3. What We Do Not Collect
We do not store the contents of traffic forwarded through tunnels by default. We do not require an account to use the free tunnel service. If you contact us or submit an abuse report, we process only what you provide.
4. Legal Basis (GDPR)
- Legitimate interest (Art. 6(1)(f)) — security logging, abuse prevention, and service operation.
- Contract performance (Art. 6(1)(b)) — providing the tunneling service you request.
- Legal obligation (Art. 6(1)(c)) — compliance with applicable laws including CSAM reporting requirements.
5. Data Retention
| Data type | Retention period |
|---|---|
| Tunnel metadata | Up to several months |
| Security and access logs (including IP addresses) | Up to one year |
| Abuse reports and evidence | Resolution + 1 year |
| CSAM evidence (upon actual knowledge) | ≥ 1 year (legal requirement) |
6. Your Rights
If you are in the European Economic Area, you have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing. Erasure requests are honored except where legal retention duties apply. Contact privacy@localtolink.com.
7. Security
We implement technical and organizational measures to protect data, including encrypted connections and access controls.
8. Website Analytics
We use Simple Analytics on our public website (not in the admin area) to understand how visitors use our pages — for example, which guides are popular.
- Cookies: We do not use cookies for this analytics service.
- Do Not Track: We honor browser Do Not Track when collecting analytics.
- What we measure: Page path/URL and basic interactions (such as copying our install command or clicking primary links). We do not send tunnel IDs or session tokens to analytics.
- Legal basis (EEA): Legitimate interests in improving our public site (GDPR Art. 6(1)(f)), balanced against your privacy via a cookieless, minimal provider.
- Retention: As configured in our Simple Analytics account (see their documentation).
- Third party: Simple Analytics — Privacy Policy
- Opt out: Enable Do Not Track in your browser, or use a content blocker that blocks
scripts.simpleanalyticscdn.com.
9. Changes
We may update this Privacy Policy. Material changes will be reflected in the “Last updated” date above.