Privacy Policy

Last updated: June 2, 2026

Molls and Hersh, LLC ("Work Tunnel", "we", "us", "our") operates worktunnel.mollsandhersh.com and the Work Tunnel software. This Privacy Policy explains what personal data we collect, why, how we use and protect it, and the rights you have over it. Read it together with our Terms of Service and Cookie Policy.

The short version. Work Tunnel is a privacy-first developer tool. Your project files never leave your own machine — the relay only passes a terminal stream between your browser and your paired device and stores none of your project content. We do not sell your personal data, and we do not use it for third-party advertising.

Who we are

Work Tunnel is a service of Molls and Hersh, LLC. For any privacy question or request, contact us at support@mollsandhersh.com.

What we collect

Information you give us

Account: your email address, a display name, and (optionally) a phone number and its country, provided at sign-up or on your profile.
Authentication: a securely hashed password and, if you enable them, two-factor authentication secrets, recovery codes, and passkey (WebAuthn) credentials.
Preferences: your theme, language, page-background choice, idle-timeout setting, and your marketing-communications choice.
Communications: messages you send us (for example, support or privacy requests).

Information created as you use the service

Workspace and tunnel metadata: the names you give workspaces and tunnels, the working-directory path and the identifier of the device a tunnel connects to, and related timestamps. We do not store the contents of your projects, terminals, or commands — that data streams between your browser and your own device and is never persisted on our servers.
Consent records: an append-only log of the policies and communications you have accepted or declined, with the version, timestamp, and IP address at the time — kept as proof of consent.
Audit log: a tamper-evident (hash-chained) record of security-relevant account and administrative actions.

Information from third parties

Sign-in providers: if you sign in with GitHub or Google, we receive basic profile information (such as your email) to create or match your account.
Payment metadata: if you buy a paid plan, our Merchant of Record (Polar) sends us limited subscription metadata — plan, status, billing country, and the brand and last four digits of your card. We never receive or store your full card number.

Technical information

Your IP address and basic request information, used for security, abuse prevention, and to keep the service running. We measure service health with server-side telemetry that sets no tracking cookies in your browser.

How we use your data

We use your personal data to: provide, operate, and secure the service and your account; authenticate you and prevent fraud and abuse; process payments and manage subscriptions (through Polar); send you transactional messages (verification, security alerts, account notices) by email and, where applicable, SMS; send marketing communications only if you have opted in (and honor your opt-out at any time); and comply with our legal obligations.

We rely on performance of a contract (to provide the service you signed up for), your consent (for marketing communications, which you may withdraw at any time), legitimate interests (to keep the service secure and prevent abuse), and legal obligation (to meet tax, accounting, and other legal requirements).

We do not sell your personal data, and we do not share it for third-party advertising. We share data only with service providers that help us run Work Tunnel, under contracts that limit their use of it:

SendGrid — transactional and opt-in marketing email.
Twilio — SMS for phone verification, security codes, and opt-in SMS marketing.
Polar — payment processing as our Merchant of Record.
Cloudflare — bot protection (Turnstile) and encrypted off-site backups.
Microsoft Azure — server-side application telemetry.

We may also disclose data where required by law, or to protect the rights, safety, and security of our users and our service.

International transfers

We operate from the United States and may process data there and in other countries. Where required, we use appropriate safeguards for international transfers.

How long we keep it

Active accounts: we keep your personal data for as long as your account exists.
Account deletion: when you delete your account, your personal data enters a 30-day grace period and is then permanently erased.
Unverified sign-ups: if you never verify your email, the pending account is removed after 30 days.
Limited exceptions: transaction/financial metadata and the security audit log are kept for as long as the law requires (for example, tax and fraud-prevention obligations), then deleted.

Your rights

Depending on where you live, you may have the right to access, correct, export (port), and delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time. You can exercise the access, export, correction, and deletion rights yourself at any time at Data & Privacy Requests; for anything else, contact support@mollsandhersh.com. We honor the Global Privacy Control (GPC) signal. You will never be treated unfairly for exercising your rights.

Cookies

We use only strictly-necessary and functional cookies. See our Cookie Policy for details.

Security

We protect your data with encryption in transit, hashed passwords, optional two-factor authentication and passkeys, a tamper-evident audit log, and least-privilege access. No system is perfectly secure, but we work hard to protect your information and will notify you and the relevant authorities of a breach as required by law.

Children

Work Tunnel is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will communicate material changes as described in our Terms of Service, and the "Last updated" date above will change.

Contact

Questions or requests about your privacy? Email support@mollsandhersh.com or use our Data & Privacy Requests page.