Privacy Policy
Tunlo is a VPN service. We built it to collect as little about you as possible. The app requires no sign-up, name, email, or phone number. Below, in plain language, is what we do and do not process.
What we do NOT collect
We keep no log of your activity: the sites you open, your DNS queries, and the content of traffic inside the tunnel are not recorded or stored.
The app contains no ads, analytics, trackers, or crash-reporting (no Firebase, Google Analytics, Crashlytics, or ad SDKs).
We do not request or store your name, email, phone number, contacts, or payment-card details.
We do not sell or share your data with third parties for advertising.
What is stored on your device
Your access token — a random order code you enter once. It is stored locally so the app can fetch and refresh its configuration. It is not an identity identifier.
Connection settings and tunnel state. All of this stays on the device and is removed when you uninstall the app.
Where the app connects
Public DoH resolvers (Cloudflare, Google) — the app makes encrypted DNS queries through them to covertly retrieve its configuration. These providers handle the queries under their own privacy policies.
The VPN node — your traffic to the internet passes through it. Sites you visit see the node's IP address, not yours. The node keeps no log of your activity.
api.tunlo.net/v1/echo-ip — an optional check that, on your action, returns the IP you are seen under so you can confirm the tunnel works. The request carries a one-time nonce and stores no personal data.
Payment
Payment is made in cryptocurrency on the website or Telegram bot via the provider Heleket — outside the app. We never receive or store payment-card data. Heleket processes the payment under its own privacy policy.
App permissions
VPN access is needed to route traffic through the secure tunnel. Network and notification access keep the connection alive and show its status. These permissions are used only to operate the VPN.
Children
The service is not directed to children under 13 and does not knowingly collect their data.
Changes
If this policy changes, we will update this page and the date at the top. Material changes take effect when published.