Privacy Policy
Last updated: July 2026
This explains what tropa collects, why, and what we do with it. We keep it minimal on purpose.
What we collect
- Account: your email and a hashed password (bcrypt — we never store the plaintext), your workspace name, and your plan.
- Usage: per-account traffic totals (bytes per month) to enforce limits and show you your usage, plus per-tunnel request counts and status for your dashboard.
- Security log: an audit trail of sensitive actions in your workspace (logins, key creation, access changes) with the originating IP.
- Traffic inspector: if you use it, recent requests to your tunnels are held briefly in memory (bounded, not persisted to disk) so you can inspect and replay them. They are scoped to your account and are dropped as the buffer rolls over.
We do not sell your data, and we do not read or mine the content flowing through your tunnels for any purpose beyond delivering it and the inspector feature you explicitly use.
API keys & passwords
API keys are shown once at creation and stored only as a SHA-256 hash — a leaked database never yields a usable key. Passwords are bcrypt-hashed.
Cookies
We use a single first-party session cookie to keep you logged in (host-only, HttpOnly, Secure, SameSite=Strict). No third-party or advertising cookies.
Retention & deletion
Account and usage data persist while your workspace exists. Inspector buffers are ephemeral. To delete your workspace and associated data, contact privacy@tropa.doshka.me.
Contact
Questions about privacy: privacy@tropa.doshka.me. Abuse reports: abuse@tropa.doshka.me.