Privacy Policy
Effective date: May 27, 2026
Last updated: October 30, 2026
This Privacy Policy describes how Loris Tunnel (the "App") and its official website (the "Site") collect, use, and protect information when you use our desktop application on macOS or Windows, or visit our website.
If you have questions about this policy, contact us at admin@lorisdev.cc.
1. Summary
- Loris Tunnel is a desktop tunnel manager. SSH connections go directly between your device and your servers. If you select Dev Tunnel, Cloudflare or FRP, published traffic passes through the corresponding provider or your configured FRP server.
- Configuration is stored locally by default. If you use optional cloud backup, the complete configuration file, including any passwords and license code in it, is uploaded as described in section 3.6. Private key files are not included.
- When you use certain optional or built-in features, limited technical data may be sent to our servers or third-party services, as described below.
2. Information Stored Locally on Your Device
The App stores configuration data on your computer, including:
- SSH jumper and tunnel settings (hostnames, ports, usernames, authentication method)
- SSH passwords or key passphrases (if you choose password or key-based authentication)
- Paths to SSH private key files
- UI preferences (such as language)
- Application logs related to tunnel status and errors
On packaged builds, configuration is typically stored at:
- Windows:
%USERPROFILE%\.loris-tunnel\config.toml - macOS:
~/.loris-tunnel/config.toml
This data is not included in routine usage events. Optional cloud backup separately uploads the complete configuration file. The paths above are defaults; settings can redirect the effective configuration directory. You can remove local data by deleting the relevant files; uninstalling the App may leave configuration files behind. Deleting local files does not delete existing cloud backups.
3. Information Collected by the App
3.1 Device identifier
To support license activation and usage reporting, the App generates or reads a machine identifier derived from your operating system (for example, Windows MachineGuid). This identifier is not your name or email address. It is used to:
- Check and redeem license codes
- Record anonymous usage events (startup and periodic heartbeat)
3.2 Usage events (our backend)
When the App runs, it may send the following to our backend API (https://loris-tunnel-prod.flyml.net):
| Data | Purpose |
|---|---|
| Machine identifier | Link events to your device for license and analytics |
Event type (startup or heartbeat) | Understand active usage |
| App version | Compatibility and support |
Platform (e.g. windows, darwin) | Platform-specific improvements |
| Client timestamp | Event ordering |
We do not include your SSH credentials, tunnel contents, or personal files in these events.
3.3 License redemption
If you enter a license code, the App sends the license code and machine identifier to our backend to validate and activate your license. We store activation records associated with your machine identifier.
3.4 Analytics (Google Analytics)
The App uses Google Analytics 4 (measurement ID: G-D5TZJ5BHHX) to collect anonymous usage statistics, such as:
- App start events
- Page or screen views within the App
- Button clicks and feature interactions (e.g. creating a tunnel, opening settings)
- App version and platform
These events help us understand which features are used and improve the product. They do not include SSH credentials or the contents of your tunnels.
Google's processing of this data is governed by Google's Privacy Policy.
3.5 Update checks (GitHub)
When you check for updates in the GitHub distribution, the App queries the public GitHub Releases API for the latest release information. This request is made directly to GitHub and is subject to GitHub's Privacy Statement. The Microsoft Store distribution does not query GitHub; updates are managed by Microsoft Store.
3.6 Optional cloud backup and restore
Cloud Sync requires an active Pro license. Connecting checks the cloud immediately and uploads the current configuration if the space is empty. Automatic backup is off by default; when enabled, local file changes can be uploaded automatically. Replacing local configuration with a cloud revision requires confirmation.
The backup is the complete effective config.toml, including comments, tunnel settings, SSH passwords or key passphrases stored in it, private key paths and the license code. Routine usage and analytics events described above do not contain this configuration; cloud backup is a separate operation.
Private key files, SSH agent state, Dev Tunnel login credentials, Cloudflare credential files, FRP server settings and tokens in frp-local.json, logs and config.root are not included. Cloud connection settings use sync.dev.json or sync.prod.json; the cloud-space Token stays in the system credential store. Keep the Token private: another device using the same Token can access the same backup space.
Restoring replaces the whole local TOML, including password and license fields, after confirmation. The App stops tunnels, saves a local config.toml.before-restore copy and restarts eligible tunnels under the restored settings. See cloud backup and restore for the workflow and cross-device requirements.
3.7 Optional tunnel providers
Selecting Dev Tunnel or Cloudflare invokes its CLI and account authorization. These services process connection information and published traffic under their own policies; FRP uses the server you configure. Their login or server credentials remain outside the TOML cloud backup. Published service access and authentication must be configured for the intended visitors.
4. Information Collected by the Website
When you visit our official website, we use Google Analytics 4 (measurement ID: G-776FG9SDVQ) to collect standard web analytics, such as pages visited, approximate location (derived from IP), browser type, and referral source.
You can limit analytics collection through your browser settings or ad/analytics opt-out tools provided by Google.
5. How We Use Information
We use collected information to:
- Operate and maintain the App and website
- Activate and manage licenses
- Monitor aggregate usage and improve reliability and features
- Respond to support requests you send us
We do not sell your personal information.
6. Data Sharing
We may share limited data with:
| Recipient | Purpose |
|---|---|
| Our backend hosting provider | Store license and usage records, and encrypted configuration backups when you use cloud backup |
| Selected tunnel provider or your FRP server | Authenticate provider connections and carry published service traffic |
| Google (Analytics) | Anonymous usage analytics for the App and website |
| GitHub | Public release metadata when checking for updates |
We may also disclose information if required by law or to protect our rights and users' safety.
7. Data Retention
- Local configuration remains until you delete the relevant files; uninstalling may leave those files behind.
- Cloud backups are subject to the service retention policy: backups can be deleted after all linked devices have been inactive for seven days. Local files are unaffected. Disconnecting Cloud Sync removes the saved local Token but does not itself delete the cloud configuration.
- Usage events and license records on our servers are retained for as long as needed to operate the service, enforce license terms, and improve the product, after which they may be deleted or anonymized.
- Google Analytics data retention follows Google's default settings and our account configuration.
8. Security
We use HTTPS for communication with our backend. Optional cloud backups are encrypted at rest by the server; this is not client-side end-to-end encryption. Backup contents can include passwords and license fields present in TOML. Cloud Sync Tokens are stored in macOS Keychain or Windows Credential Manager rather than plaintext connection settings. Protect your device, exported configurations and Tokens. No method of transmission or storage is 100% secure.
9. Your Choices and Rights
Depending on your location, you may have rights to access, correct, or delete personal data we hold about you. You can delete local configuration files, disable automatic backup, or disable/disconnect Cloud Sync. These local actions do not delete existing cloud backups; contact us for server-side data requests.
To request deletion of server-side records associated with your machine identifier, or for any privacy-related inquiry, email admin@lorisdev.cc.
10. Children's Privacy
Loris Tunnel is not directed at children under 13 (or the applicable age in your jurisdiction). We do not knowingly collect personal information from children.
11. International Users
Our services may be operated from jurisdictions outside your country. By using the App or Site, you understand that information may be processed in those locations.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the latest version. Continued use of the App or Site after changes constitutes acceptance of the updated policy.
13. Contact
Loris Tunnel
Email: admin@lorisdev.cc