Get started

Privacy Policy

Last updated October 12, 2026

1. Introduction

VoidPort ("Service"), operated by VoidMind ("we", "us", or "our"), is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data in compliance with the General Data Protection Regulation (GDPR).

This policy covers the website and dashboard at voidport.app, the API at api.voidport.app, downloads from dl.voidport.app, and the relay servers that serve tunnel addresses under voidport.net.

2. Data Controller

VoidMind
Christian Romeni
Holzwasen 11
73087 Bad Boll, Germany
Email: privacy@voidport.app

3. Data We Collect

Account Information

  • Email address (required for account creation)
  • Password (stored as a secure hash; only for accounts created with email and password)
  • Payment information (processed by Stripe, not stored by us). To prevent fraud and abuse, we store an identifier of your payment method provided by our payment provider (not your card number or bank details).

Sign-in with Google, Microsoft, Discord or GitHub

When you sign in or link a sign-in method, the provider tells us who you are. We only request your basic profile and email address and store:

  • Google: your Google account ID and your verified email address.
  • Microsoft: your account's tenant ID and object ID and, if Microsoft marks it as verified, your email address.
  • Discord: your Discord user ID and your verified email address.
  • GitHub: your GitHub user ID and your primary verified email address.

We also store when each sign-in method was linked and last used. We do not store the provider's access tokens, and we do not access your contacts, files, servers or repositories. You can unlink sign-in methods in the dashboard settings; deleting your account removes them.

Usage Data

  • Tunnel configurations (port, protocol, name, and optional settings such as IP allowlists and country rules)
  • Notification settings: Discord and webhook URLs you save, stored to deliver offline and online notifications for your tunnels
  • Bandwidth usage statistics
  • Connection counts and timestamps
  • IP addresses of relay connections

Country Rules

For tunnels with country rules, the relay server determines the visitor's country from their IP address locally. The IP address is not sent to anyone else for this.

IP geolocation by DB-IP, licensed under CC BY 4.0.

Technical Data

  • Browser type and version
  • Device information
  • Log data (errors, access times)

Website Reach Measurement

We measure the reach of our public website without cookies. Only daily totals per page, country, device type, browser, language and referring website are stored, plus clicks on a few links (such as sign-up or download). Unique visitors are counted with a hash of IP address and browser identifier that changes daily and cannot be reversed; it is deleted after 2 days. Nothing is stored on your device (no cookies, no local storage). Signed-in users are not counted. Nothing is shared with third parties; the data is processed on Cloudflare (see Data Sharing). Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding how our website is used.

4. How We Use Your Data

We use your data to:

  • Provide and maintain the Service
  • Process payments and manage subscriptions
  • Monitor usage against plan limits
  • Detect and prevent abuse or fraud
  • Send service-related communications
  • Send information emails about your account or the Service
  • Improve and optimize the Service
  • Comply with legal obligations

Information emails: we may occasionally email you information about your account or the Service. Each of these emails contains an unsubscribe link. If you unsubscribe, we store the time of your opt-out until your account is deleted; marking one of our emails as spam counts as unsubscribing. Service emails that belong to your contract or account (billing, security, account deletion notices) are still sent. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in informing our users about their account and the Service.

5. Legal Basis for Processing

We process your data based on:

  • Contract: To provide the Service you requested
  • Legitimate Interest: For security, fraud prevention, and service improvement
  • Legal Obligation: To comply with applicable laws
  • Consent: For optional communications (you may withdraw consent at any time)

6. Data Sharing

We may share your data with:

  • Stripe: For payment processing
  • Hetzner: For infrastructure hosting (servers in Germany)
  • Cloudflare: For web hosting and CDN services
  • Google, Microsoft, Discord, GitHub: Only if you choose to sign in with them. They learn that you signed in to VoidPort; we receive the data listed above

We do not sell your personal data to third parties. We may disclose data if required by law or to protect our rights.

7. Data Retention

  • Account data: Until you delete your account. Accounts without an active subscription that nobody has logged in to for 24 months are deleted automatically; 30 days before, we send you an email, and logging in keeps the account. Accounts without a subscription may also be deleted earlier if we announce it by email at least 30 days in advance; here too, logging in keeps the account.
  • Banned accounts: we keep the email address for 3 years after the ban, then replace it with a one-way hash.
  • Email address hash: of deleted accounts, and of banned accounts after those 3 years, we keep a one-way hash of the email address permanently to prevent abuse, such as signing up again after a ban.
  • Payment method identifier (fraud and abuse prevention): while you have a subscription and for 3 years after it ended; for banned accounts, 3 years after the ban
  • IP addresses and connection metadata (CLI client connections, timestamps, and packet metadata such as sizes, timing and addresses recorded during an abuse check, never contents): 14 days. Exception: for accounts banned for abuse and tunnels shut down for abuse, we keep this data for up to 12 months after the ban, to detect ban evasion and as evidence.
  • IP address at sign-up: 12 months (to detect self-referrals and ban evasion; for banned accounts as above)
  • Usage statistics (bandwidth, connections): daily figures 90 days, monthly totals until you delete your account
  • Emails you send us: 365 days. Contract-related and legal correspondence (cancellations, withdrawals, refunds, billing complaints, legal requests) is kept as business correspondence for 6 years from the end of the calendar year in which we received it (§ 257 German Commercial Code, HGB).
  • Invoices and tax records (including OSS records): kept by our payment provider Stripe, not by us, for the statutory periods (8 years for invoices and accounting records under § 147 German Fiscal Code, AO; 10 years for OSS records)
  • Cancellation records (submitted details, date and time, hashed IP address): 6 years from the end of the calendar year of the cancellation (§ 257 HGB)
  • Send log of information emails (which email was sent to which account, and when, and whether it was delivered, bounced or reported as spam): 12 months
  • Opt-out from information emails: until you delete your account
  • Server logs: 30 days

8. What We Do NOT Collect

As a transport provider, we explicitly do NOT:

  • Inspect or log the content/payload of your traffic
  • Perform deep packet inspection (DPI)
  • Analyze or profile your transmitted data
  • Store any content passing through tunnels
  • Sell or share data with advertisers

We only collect the minimum metadata necessary to operate the service and respond to abuse reports.

9. Your Rights (GDPR)

You have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate data
  • Erasure: Delete your account and data
  • Portability: Receive your data in a structured format
  • Object: Object to certain processing
  • Restrict: Limit how we use your data
  • Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at privacy@voidport.app.

You can download your data under Settings once per month; otherwise by email.

10. Data Security

We protect your data with:

  • TLS 1.3 encryption for all connections
  • Secure, industry-standard password hashing
  • Database encryption at rest
  • Regular security audits
  • Access controls and monitoring

11. International Transfers

Your data is primarily processed within the European Union (Germany). If data is transferred outside the EU, we ensure adequate safeguards are in place (e.g., Standard Contractual Clauses).

12. Cookies

We use essential cookies for authentication and session management. We do not use tracking or advertising cookies.

13. Children's Privacy

The Service is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us immediately.

14. Changes to This Policy

We may update this policy periodically. We will notify you of material changes via email or dashboard notice. Continued use of the Service after changes constitutes acceptance.

15. Contact & Complaints

For privacy inquiries: privacy@voidport.app

You have the right to lodge a complaint with your local data protection authority. In Baden-Württemberg, Germany, this is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg.