Version legal-2026-11-05 · Effective 5 November 2026
Who we are
Controller: arin b, a sole proprietor trading as Sunray Agency, Naktala, Kolkata 700047, West Bengal, India. Privacy and grievance contact: arin b, support@instawormhole.com.
What we collect
Account identity: your provider's stable account identifier and the minimum verified identity details needed to run your account (such as email address and display name) when you sign in with GitHub, Google, or email. We do not keep provider access tokens after the required exchange, and we do not support passwords.
Passkeys: the public-key credential data for a passkey. We do not receive biometric or device-unlock data.
Session and security data: sign-in sessions, security notifications, rate-limiting and abuse-control records, and audit events needed to protect accounts.
Email: sign-in and security emails sent through our email provider, and any message you send to support.
Tunnel metadata: the connection and routing metadata needed to operate and secure tunnels, and counts of the requests and bytes your tunnels carry, which we use to apply your plan's limits and show your usage.
Abuse prevention records: the IP address of each computer that connects a tunnel and of each device you use while signed in, with the time and your account; which account used each tunnel address and when; and how many requests and bytes each tunnel address carried each hour. We use these records only to investigate abuse, security incidents and lawful requests. They are not shown to other users or used for marketing. We do not record the IP addresses of people who visit your tunnels.
Billing: Polar, our payment provider and merchant of record, collects your payment details, billing name, address and any tax ID. We receive your plan, subscription status, billing period and Polar's customer and subscription identifiers, never your card details. We keep these while the workspace exists.
Custom domains: the domain names you connect, the results of our DNS checks and which tunnel each domain serves. Certificates we obtain for your domains are published in public Certificate Transparency logs, as they are for every HTTPS site. We keep a domain's record while it is connected, and include it in the record of which account used each address (kept for 13 months).
Team invitations: when a workspace owner or admin invites someone, we store that person's email address, the role offered and the invitation's status, and send them an invitation email through our email provider. We keep invitations and workspace memberships while the workspace exists.
Request inspector: for each named tunnel, details of requests that reach it: method, path with query values removed, status, timing, sizes, headers with cookies, authorization and other credentials removed, and the visitor's network prefix (never the full address). Request and response bodies, up to 64 KiB each, are kept only if you turn body capture on for that tunnel; they are not redacted. You control these records on behalf of your visitors and can delete them at any time.
Webhook inbox (optional, from Starter): if you turn on the webhook inbox for a tunnel and name webhook paths, then while that tunnel is offline we keep the requests that other services send to those paths, so we can deliver them when your tunnel is back. For each held request we store the whole request as it arrived: the request method and address (including any query string), all of its headers (which can include credentials or cookies the sender included), its body (up to 64 KiB), the sender's internet address and the time. We store this unencrypted in our database, as we do for request bodies you choose to capture in the request inspector. We use it only to deliver the request to your tunnel. We delete the headers and body as soon as the request has been delivered, has failed three times, or has been held for the holding time of your plan (24 hours on Starter and Pro, 72 hours on Team and Business). We then keep only a short record (time, method, path without query string, delivery status) for 24 hours so you can see what happened. The inbox holds at most 100 requests per tunnel. Deleting a tunnel deletes what it holds. We do not look at held requests. You are responsible for the content that others send to your tunnel, including personal data in it; do not turn the inbox on for a tunnel if you do not want it kept this way. Because the inbox stores requests you have not yet seen, a service's signature on a request may have expired by the time it is delivered.
Cookies: one strictly necessary, host-only session cookie. We use no third-party analytics or advertising cookies.
Why we use it
To provide and secure the Service, authenticate you, send required notices, prevent abuse, comply with law, and answer support requests.
Retention
Short-lived sign-in records are removed after 30 days (WebAuthn ceremony records after 24 hours); expired sessions after 30 days; delivery and receipt records after 90 days; minimized security and audit records after 13 months; account export files after 24 hours; request inspector records, including any kept bodies, after 24 hours; abuse prevention IP address records and hourly tunnel traffic counts after 90 days; and the record of which account used each tunnel address 13 months after the address stopped being used. Abuse prevention records are kept for these periods even after an account is deleted, so that abuse can still be investigated. Account deletion begins after a seven-day cancellation period. Records may be kept longer for an active security, abuse, dispute or legal matter. These are the periods set by our maintenance process, and they do not apply to data held by third-party providers.
Who receives data
Service providers: hosting (HostUp AB, Sweden), email delivery (Resend, United States), sign-in providers you choose (GitHub, Google), domain registration and DNS (Namecheap, Cloudflare), payments for paid plans (Polar, as merchant of record) and support mail (SpaceMail, Spaceship). We do not sell personal data. We may disclose data when required by law or to protect rights and safety.
International transfers
Data may be processed in Sweden or the EU, the United States, and other places our providers use. We make no guarantee of a single storage country.
Your rights
You can ask for access, correction, export or deletion of your data, and withdraw consent where we rely on it, by emailing support@instawormhole.com. The rights available to you depend on where you live and on applicable law, including Indian law. You may also complain to the relevant data-protection authority.
Children
We do not set a minimum age for the Service. A parent or guardian who believes a child has an account can ask us to delete it by emailing support@instawormhole.com.
Security
We use technical and organizational measures appropriate to the risk. No system is perfectly secure, and we cannot guarantee absolute security.
Changes
We will publish updated versions with a new effective date and tell you about material changes.