Skip to content

Legal

Privacy Policy

We collect what we need to run Localport and keep it no longer than we need it. Tunnel traffic stays in the region you choose, and account data is stored in the European Union.

Last updated: October 2, 2026

1. Who We Are

Localport is a product operated by Masteren Labs, a sole proprietary concern based in India ("Masteren Labs," "Localport," "we," "us"). When you use Localport, we act as the controller of the account, billing, and operational data described below. Two kinds of data are different: the records a team accumulates for its own use, described in Section 5, which we process on the team's behalf, and whatever you choose to route through a tunnel, which stays your responsibility. When you expose your own application through Localport, that application and its users remain yours. We do not act as a controller for the content of your traffic.

2. Scope

This policy covers https://localport.io, the Localport dashboard, our APIs, the Localport agent, our network, tunnel domains, billing flows, and support channels. It does not cover third-party sites or services you connect to or link from Localport. Those are governed by their own notices.

3. What We Collect

Account

Your email, name, the login method you chose, and session state. If you verify your email, we record that. If you sign in through a third-party identity provider such as Google, we receive your email address and name from that provider and nothing more than the sign-in requires. If a team admin invites you, we receive your email address from them in order to deliver the invitation.

Teams and members

Team names, member roles, invitations, ownership, and account status.

Tunnel configuration

The names, identifiers, kinds, regions, subdomains, reserved ports, custom domains, IP allowlists, access grants, and access tokens you create. Access tokens are stored encrypted.

Operational records

Connection counts, bytes transferred, request counts, session start and end times, region, the version of the agent that opened a tunnel, disconnect reasons, source IP addresses, and other connection metadata needed to run the service, enforce plan limits, and respond to abuse. We do not record the contents of your requests or responses.

Remote access credentials

Remote access uses client certificates. We store what is needed to issue and verify them: the certificate authorities your team trusts, the details of each certificate (issuer, subject, serial, expiry, status), revocations, and setup keys. The private key of a certificate is created on your own device and never reaches us. Where we operate a certificate authority for your team, its signing key is stored encrypted and used only to issue your team's certificates. If you register your own certificate authority, we store its public certificate and the address of its revocation list. A certificate issued to a person names a random account identifier, never an email address.

Billing

Your plan, subscription status, renewal date, the customer and subscription identifiers given to us by the payment provider, invoice references, bandwidth and usage totals, and billing contact details. Card numbers and CVV codes never reach our servers. They go directly to the payment provider.

Website and product events

When you visit our website or dashboard, our servers see the standard metadata any web request carries. Website page views are measured server side against a pseudonymous identifier; no analytics script runs in your browser and no tracking cookie is set. Inside the dashboard we record how you move through the product and events tied to your account, such as signing in, creating a tunnel, changing a plan, and errors you hit, so we can tell whether the product works and where it breaks. This measurement exists to operate Localport. We do not run advertising trackers and we do not profile you for ads.

Support and reports

If you write to us, we keep your message, our reply, and anything you attached. If you send an abuse report, we keep the report, your name, your email address and your IP address.

4. Tunnel Traffic

Tunnel traffic is what flows through Localport between a visitor and your service. We treat it as transit. We do not log its content, store it, sell it, hand it to advertisers, or use it to train models.

What we are able to see depends on the kind of tunnel:

  • TLS tunnels. Traffic stays encrypted between the visitor and your service. We do not hold the keys and cannot decrypt it.
  • TCP tunnels. Bytes are forwarded as they arrive and are not stored.
  • HTTP tunnels and remote access. We provide the HTTPS or verify the client certificate, so a request is decrypted in memory to route it and apply the rules you set, then sent to your agent over an encrypted connection. It is never written to disk.

The connection between the Localport agent and our network is always encrypted. We record only the operational metadata listed in Section 3: counts, sizes, timestamps, and addresses.

Localport does not provide malware scanning, content filtering, web application firewall services, or moderation of what you send through your tunnel. You are responsible for what runs behind your tunnel.

If you visit a service running behind a tunnel

Someone else's application served through a Localport address belongs to the person or team operating it, and they decide what it does with your data. On our side, your visit appears only as the connection metadata described above and, where the service uses remote access, as an entry in the operating team's access log. For anything the application itself collects, contact its operator.

5. Your Team's Records

Some of what we store exists for your team rather than for us. We hold these records on the team's behalf, for as long as the team's plan provides.

Audit log

Teams on plans that include it get an audit log of the administrative actions their own members take: who invited a member, who rotated a token, who changed an access grant, and when. An entry names the member who acted, the change they made, the outcome, and the IP address and browser the request came from. It carries nothing from your traffic. Only your admins can read it, your plan sets how far back it reaches, and it is deleted with the team. The IP address on an entry is removed after 90 days; the rest of the entry stays.

Access log

Teams using remote access get an access log: who reached which device, from where, and whether the connection was allowed or refused. An entry records the identity presented, the certificate used, the device reached, the source IP address, and the time. No entry records what was sent. Your admins can read it for the window your plan provides.

Our role

For the records in this section, your team decides who may read them and how they are used; we process them to store them, serve them back, and enforce the retention your plan sets. We do not read them to profile your members and we do not use them for advertising. Teams that need a signed Data Processing Addendum for their own compliance can request one at privacy@localport.io.

6. How We Use Data

  • Run the service. Sign you in, create tunnels, route traffic, charge subscriptions, and send service email.
  • Keep the platform healthy. Measure load, diagnose outages, investigate abuse, and defend the network.
  • Enforce plans. Count bandwidth and tunnels, and apply limits.
  • Give your team visibility. Store the audit log and access log described in Section 5 and serve them back to your admins.
  • Talk to you. Answer support requests and send security and billing notices.
  • Comply with law. Respond to lawful requests, defend ourselves in disputes, and preserve records we are required to keep.

We may occasionally send product news. Every such email carries a one-click unsubscribe, and opting out never affects security, billing, or account email. We do not use your account data, your tunnel metadata, or your traffic for advertising. We do not sell personal data. We do not feed your traffic into machine learning systems.

7. Cookies and Local Storage

The marketing website sets no cookies. The dashboard uses strictly necessary cookies to keep you signed in; interface preferences such as your theme live in your browser's local storage and stay on your device. Neither site sets advertising or cross-site tracking cookies, so there is no cookie banner because there is nothing to consent to. The abuse report form loads a challenge from Cloudflare Turnstile to keep automated submissions out.

8. Who We Share With

We share personal data only where it is needed to run Localport or where the law requires it. The categories are short:

  • Infrastructure providers that host our servers, databases, and network.
  • Our payment provider, which acts as the merchant of record for checkout, subscriptions, tax, and invoices, and receives your payment details directly.
  • Email delivery for one-time codes, account, billing, security, and support email.
  • Professional advisers such as accountants, lawyers, and auditors, where their work requires it, bound by confidentiality.
  • Law enforcement and authorities when required by valid legal process, or to protect rights, users, and the public.
  • An acquirer in the event of a merger, financing, restructuring, or sale of the business.

If you sign in with an identity provider such as Google, you authenticate with them directly. They learn that you use Localport because you chose them for sign-in; we send them nothing else about you.

We do not share data with advertising networks. We do not enrich your profile from third-party data brokers.

9. Retention

  • Account and team data is kept while your account is open.
  • Tunnel configuration is kept while it is in use and removed after deletion, subject to backup rotation.
  • Your team's audit log and access log are readable for the window your plan provides and are permanently deleted after 400 days at the latest. The IP address on an audit log entry is removed after 90 days. Both logs are deleted with the team.
  • Security and abuse records, meaning connection and session records and a record of account and administrative actions, are kept for as long as we need them to secure the service, investigate abuse and fraud, resolve billing disputes, and meet legal obligations. They can remain after an account or team is deleted. The IP addresses in them are removed within twelve months, and per-session usage detail is deleted within six months.
  • Counters of failed connection attempts are deleted within 30 days.
  • Abuse reports, including the reporter's name, email address and IP address, are kept for two years and then deleted, unless a report is needed for a legal proceeding.
  • Billing and tax records are kept for as long as tax law requires, typically up to seven years.
  • Support correspondence is kept while it is useful and then removed.
  • Backups are overwritten on their normal rotation.

If your account or team is suspended for suspected abuse, fraud, security risk, or breach of the Terms, we will hold the account, its data, and related records while we investigate, while a dispute or chargeback is open, and for as long as we may need them to defend ourselves, cooperate with law enforcement, or respond to a regulator. Suspension does not, on its own, trigger deletion.

10. Security

We use encryption in transit, hashed or encrypted credentials at rest, and limited access to production systems. Where applicable law requires us to notify affected users of a security incident, we will do so on the timeline that law sets. The security overview describes the controls in more detail.

No service over the internet is perfect, and the controls described in this section are not a representation that the service or any data within it cannot be compromised. You are responsible for the security of anything you choose to expose, including patching, authentication, monitoring, and incident response. If you believe you have found a vulnerability in Localport itself, write to security@localport.io and give us a fair opportunity to respond before disclosing it elsewhere.

11. Data Residency and International Transfers

While a tunnel is active, its traffic stays in the region you selected. Each tunnel runs in the region chosen for it, and its traffic passes through that region only. We do not relay or mirror it through another region, and we do not copy it into the systems that run the dashboard, billing, or backups.

The personal data we hold to run Localport is stored in the European Union. This includes your account, your teams, your billing records, your tunnel configuration, and the operational records described in Section 3, including the records relating to tunnels you choose to run in any region. Where we store this data does not change with the region a tunnel uses. Backups are stored in the European Union as well.

A limited number of the service providers we rely on, such as our payment processor, our email provider, and any identity provider you use to sign in, may process the data they need outside the European Union. Localport is operated from India, and our personnel may access data held in the European Union in order to operate and support the service. Where personal data is transferred across a border, we rely on the legal mechanisms recognised under applicable law, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum where they apply. We do not transfer personal data to a jurisdiction that lacks an adequate level of protection unless one of those mechanisms is in place or the transfer is otherwise lawful under the law that protects you.

12. Your Rights Under Privacy Law

We honour the rights given to you by the data protection law that applies where you live. If your processing falls under the GDPR or the UK GDPR, that includes the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where consent is the legal basis. Our lawful bases include contract performance, legitimate interests in operating and securing the service, compliance with legal obligations, and your consent where consent is required.

If you are a California resident covered by the CCPA, you have the rights to know, delete, correct, and limit the use of sensitive personal information, and the right to non discrimination for exercising those rights. Localport does not sell personal information, does not share it for cross context behavioural advertising, and does not process sensitive personal information for inferring characteristics about you. Because we do not sell or share personal information, a Global Privacy Control signal asks for a protection you already have; we honour it by default.

To exercise any of these rights, email privacy@localport.io from the address on your account. We may ask you to verify your identity before we act. We will respond within the timelines that the applicable law requires. You also have the right to complain to the data protection authority in your country, although we would prefer that you write to us first so we can put the issue right.

We are required to keep some records, including those related to billing, fraud, security, and legal matters. Those will remain on file as set out in Section 9, even after the rest of your data is removed.

13. Children

Localport is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a child has signed up, write to privacy@localport.io and we will remove the account.

14. Account Deletion

You can schedule account deletion from the dashboard. There is a short grace period, currently 24 hours, during which you can change your mind and cancel the deletion. After that, the account, its teams (where you are the sole owner), tunnels, and tokens are removed.

  • Cancel any active paid subscription before deleting. Deletion does not refund a paid period that is already running.
  • Billing, tax, fraud, security, legal, and backup records may be retained as described in Section 9.
  • Deletion is final once the grace period closes.

15. Changes

We will update this policy when the service or the law changes. Material changes will be announced by email, by dashboard notice, or on this page. The "Last updated" date at the top is the authoritative version.

16. Contact

Masteren Labs (sole proprietary concern, India)
Privacy: privacy@localport.io
Security: security@localport.io
Grievance: grievance@localport.io
Support: support@localport.io
Website: https://localport.io
Company: masterenlabs.com