tunnel.pizza Privacy Policy

Effective: September 25, 2026

At tunnel.pizza we recognize that privacy is important. This Policy applies to the tunnel.pizza website, the tunnel service reachable at it, and the hostnames it issues (together, the “Service”), all offered by Scaffoldly LLC. If you have any questions about this Policy, please contact us at legal@scaffold.ly.

Information we collect and how we use it

The Service has no accounts and takes no payment. What it records is what a request carries:

When you request a tunnel — your IP address and the region, metro, and postal codes Cloudflare’s edge derives from it; your client’s User-Agent; the time of the request; and, when you present a GitHub token, the GitHub login it resolves to. The address and location codes, and the login when there is one, are written into the comment of the DNS record for your hostname in our Cloudflare account, so that the record itself says who last used it and where from.
Before a tunnel is issued — your IP address is looked up against the DroneBL and Barracuda blocklists, and its country is checked against a list of countries we do not serve. A listed address or country is refused. The lookups send your address to those blocklists’ DNS servers.
Log information — our servers and Cloudflare’s edge record the requests they handle: the URL, method and status, your IP address, User-Agent, and the time. We also receive network error reports your client sends when a request to the Service fails.
Cookies — the Service sets none. The website keeps your light-or-dark theme choice in your browser’s local storage, which never leaves your browser.
User communications — when you send an email or file a report with us, we may retain it in order to respond and to improve the Service.
Your tunnel’s traffic — is not collected. The Service is a control plane: it issues credentials and hostnames. Traffic to and from your tunnel passes between Cloudflare’s network and your machine, never through servers we operate, and Cloudflare’s handling of it is governed by their Privacy Policy.

We use this information to:

issue, resume, and reclaim tunnels and hostnames;
refuse abusive requests and enforce rate limits;
investigate abuse reports and respond to legal requests;
keep the Service running and diagnose faults; and
understand how the Service is used, in aggregate.

tunnel.pizza processes this information on Amazon Web Services and Cloudflare servers in the United States of America. If you use the Service from elsewhere, your information is transferred to and processed in the United States.

Retention

The record comment for a hostname is kept for as long as the hostname is reserved for you and is deleted when the hostname is reclaimed. Server and edge logs are kept for a limited period for the purposes above and then discarded. Communications are kept as long as needed to resolve them.

Information sharing

tunnel.pizza only shares personal information with other companies or individuals outside of Scaffoldly LLC in the following limited circumstances:

With the providers that run the Service — Cloudflare, which holds the DNS records and carries your tunnel; Amazon Web Services, which hosts our servers; and GitHub, which we ask to verify a token you present — each of which processes the information to provide their service to us.
With the DroneBL and Barracuda blocklists, which receive your IP address as part of the lookup described above.
When we have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, (b) enforce our Terms of Use, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address fraud, security or technical issues, or (d) protect against imminent harm to the rights, property or safety of tunnel.pizza, its users or the public as required or permitted by law.
If Scaffoldly LLC becomes involved in a merger, acquisition, or any form of sale of some or all of its assets, we will provide notice before personal information is transferred and becomes subject to a different privacy policy.

Information security

We take appropriate security measures to protect against unauthorized access to or unauthorized alteration, disclosure or destruction of data. Access to the accounts holding it is limited to the people who operate the Service, and the credentials that reach those accounts are never handed to a tunnel. Security reports are welcome at the addresses in security.txt.

Accessing and deleting personal information

We make good faith efforts to provide you with access to the personal information we hold about you and to delete it at your request if it is not otherwise required to be retained by law or for legitimate business purposes. Stopping your tunnel and letting its hostname be reclaimed deletes the record comment on its own. For anything else, write to legal@scaffold.ly; we may ask you to identify the request or hostname concerned, and we may decline requests that are unreasonably repetitive, require disproportionate technical effort, or jeopardize the privacy of others.

Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has used the Service, contact us and we will delete what we hold.

Enforcement

tunnel.pizza regularly reviews its compliance with this Policy. Please direct any questions or concerns regarding this Policy or tunnel.pizza’s treatment of personal information to legal@scaffold.ly. When we receive formal written complaints at this address, it is our policy to contact the complaining user regarding his or her concerns. We will cooperate with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of personal data that cannot be resolved between tunnel.pizza and an individual.

Changes to this policy

This Privacy Policy may change from time to time. We will not reduce your rights under this Policy without your explicit consent, and we expect most such changes will be minor. We will post any changes on this page, and each version is identified at the top by its effective date.

Contact

Scaffoldly LLC
104 S Main Street, Goshen, IN 46526
legal@scaffold.ly