Privacy Policy

Last updated: June 2, 2026

Molls and Hersh, LLC ("Work Tunnel", "we", "us", "our") operates worktunnel.mollsandhersh.com and the Work Tunnel software. This Privacy Policy explains what personal data we collect, why, how we use and protect it, and the rights you have over it. Read it together with our Terms of Service and Cookie Policy.

The short version. Work Tunnel is a privacy-first developer tool. Your project files never leave your own machine — the relay passes a terminal stream between your browser and your paired device and keeps only a small, temporary in-memory buffer of recent terminal output so you can reconnect without losing your place. We do not sell your personal data, and we do not use it for third-party advertising.

Who we are

Work Tunnel is a service of Molls and Hersh, LLC. For any privacy question or request, contact us at support@mollsandhersh.com.

What we collect

Information you give us

Account: your email address, a display name, and (optionally) a phone number and its country, provided at sign-up or on your profile. A phone number, if you provide one, is stored on your profile only — we do not currently send SMS of any kind.
Authentication: a securely hashed password and, if you enable them, two-factor authentication secrets, recovery codes, and passkey (WebAuthn) credentials.
Preferences: your theme, language, page-background choice, idle-timeout setting, and your marketing-communications choice.
Communications: messages you send us (for example, support or privacy requests).

Information created as you use the service

Workspace and tunnel metadata: the names you give workspaces and tunnels, the working-directory path and the identifier of the device a tunnel connects to, and related timestamps. We do not store your project files, and terminal output is never written to disk. So that you can close a tab and pick a session up where you left it, the relay holds each tunnel's most recent terminal output — at most 1 MB per tunnel — in server memory only. Anything your terminal displayed can appear in that buffer. It is discarded when the service restarts and when you delete the tunnel.
Consent records: an append-only log of the policies and communications you have accepted or declined, with the version, timestamp, and IP address at the time — kept as proof of consent.
Audit log: a tamper-evident (hash-chained) record of security-relevant account and administrative actions.

Technical information

Your IP address and basic request information, used for security, abuse prevention, and to keep the service running.

How we use your data

We use your personal data to: provide, operate, and secure the service and your account; authenticate you and prevent fraud and abuse; send you transactional messages (verification, security alerts, account notices) by email; send marketing communications only if you have opted in (and honor your opt-out at any time); and comply with our legal obligations.

We rely on performance of a contract (to provide the service you signed up for), your consent (for marketing communications, which you may withdraw at any time), legitimate interests (to keep the service secure and prevent abuse), and legal obligation (to meet tax, accounting, and other legal requirements).

We do not sell your personal data, and we do not share it for third-party advertising. We share data only with service providers that help us run Work Tunnel, under contracts that limit their use of it:

Resend — transactional and opt-in marketing email.
Cloudflare — encrypted off-site backups.

We may also disclose data where required by law, or to protect the rights, safety, and security of our users and our service.

International transfers

We operate from the United States and may process data there and in other countries. Where required, we use appropriate safeguards for international transfers.

How long we keep it

Active accounts: we keep your personal data for as long as your account exists.
Account deletion: when you delete your account, your personal data enters a 30-day grace period and is then permanently erased.
Limited exceptions: transaction/financial metadata and the security audit log are kept for as long as the law requires (for example, tax and fraud-prevention obligations), then deleted.

Your rights

Depending on where you live, you may have the right to access, correct, export (port), and delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time. You can exercise the access, export, correction, and deletion rights yourself at any time at Data & Privacy Requests; for anything else, contact support@mollsandhersh.com. You will never be treated unfairly for exercising your rights.

Cookies

We use only strictly-necessary and functional cookies. See our Cookie Policy for details.

Security

We protect your data with encryption in transit, hashed passwords, optional two-factor authentication and passkeys, a tamper-evident audit log, and least-privilege access. No system is perfectly secure, but we work hard to protect your information and will notify you and the relevant authorities of a breach as required by law.

Children

Work Tunnel is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will communicate material changes as described in our Terms of Service, and the "Last updated" date above will change.

Contact

Questions or requests about your privacy? Email support@mollsandhersh.com or use our Data & Privacy Requests page.