Privacy Policy

1. Introduction

This Privacy Policy describes how Nocodo LTD (hereinafter "Company", "we", "us", or "our"), a company registered in the Republic of Cyprus, collects, uses, discloses, and safeguards information of users of the fxTunnel service (the "Service"), including the website at fxtun.dev, desktop applications, command-line tools, and all related APIs.

By using the Service, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1. Account Information

When you register and use the Service, we collect:

• Email address or phone number;
• Display name (optional);
• Password hash (we do not store passwords in plain text);
• Account settings and preferences.

2.2. Payment Information

We use third-party payment processors (Creem, YooKassa) to handle payments. We do not store your credit card numbers, CVVs, or full payment details. We only retain:

• Customer ID from the payment processor;
• Last four digits of your card and expiration status;
• Payment history and transaction statuses.

2.3. Connection Metadata

When you use tunnels, we collect:

• Client connection IP addresses;
• User agent strings;
• Tunnel session creation and termination timestamps;
• Tunnel type (HTTP, TCP, UDP) and assigned subdomains/ports.

2.4. Usage Data

• Number of active tunnels;
• Traffic statistics (volume, not content);
• Service feature usage.

2.5. Technical and Log Data

• IP addresses when accessing the web dashboard;
• Browser and operating system information;
• Error and performance logs.

3. How We Use Your Information

We use the collected data to:

• Provide and maintain the Service;
• Authenticate and manage user accounts;
• Process payments and manage subscriptions;
• Allocate and route subdomains and ports;
• Detect and prevent abuse;
• Send essential service notifications (pricing changes, maintenance);
• Improve service quality and performance.

4. Tunnel Traffic Content

We do not inspect, log, or store the content of traffic passing through your tunnels. Data is transmitted end-to-end between your local service and the end user.

The Traffic Inspector feature operates exclusively in your browser session and on your device — tunnel payload data is not transmitted to or stored on our servers.

5. Data Sharing and Third Parties

We may share data with the following categories of processors:

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We may disclose information to law enforcement when required by applicable law or court order.

6. Data Retention

• Account data: duration of your account plus 12 months after deletion;
• Connection metadata: up to 90 days, then automatically purged;
• Billing records: 7 years (regulatory requirement);
• Server logs: 90 days, then automatically purged.

You may request full data deletion by contacting support@fxtun.ru.

7. Data Security

We employ the following measures to protect your data:

• TLS/HTTPS encryption for all data in transit;
• Encryption at rest for sensitive data (passwords, TOTP secrets);
• Access controls and least-privilege principles;
• Regular security audits and dependency scanning;
• Two-factor authentication (TOTP) for account protection.

8. Your Rights

You have the right to:

• Access your personal data;
• Correct inaccurate or incomplete data;
• Delete your data (subject to legal retention obligations);
• Export your data in a machine-readable format;
• Object to data processing.

To exercise your rights, contact support@fxtun.ru.

9. EU-Specific Provisions (GDPR)

9.1. Legal Basis for Processing

• Contract performance: processing necessary to provide the Service;
• Legitimate interest: abuse prevention and service improvement;
• Legal obligation: retention of billing records as required by law.

9.2. Cross-Border Data Transfers

Tunnel data is processed on servers located in Europe. Payment data processed by Creem may be transferred outside the EU under a Data Processing Agreement and appropriate safeguards.

10. Cookies

We use minimal cookies strictly necessary for:

• Session management (authentication);
• Remembering user preferences (theme, language).

We do not use third-party tracking cookies, advertising pixels, or analytics trackers.

11. Children's Privacy

The Service is not intended for users under 16. If we learn that we have collected data from a child, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Service at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

13. Contact Information