Privacy
Last updated 31 August 2026
A tunnel carries your traffic, so the question “what does devgate keep?” deserves a specific answer rather than a paragraph of reassurance. Here is the list.
What is stored
| Account | Name, username, email address, a hashed password, and your authtoken. Sign-in through GitHub or Google stores the same fields, not the provider password. |
| Endpoints | The slug, the local address the agent forwards to, the Host header setting, and which device an endpoint is pinned to. |
| Devices | A name and the public half of the SSH key each device generates on first run. The private key never leaves your machine. |
| Usage | Bytes in and out, request counts and endpoint hours, reported by the agent every few seconds and totalled for billing. |
| Request metadata | When the traffic inspector is on: time, method, path, status and duration. Request and response bodies are not stored. |
| Billing | Plan, invoices and a Stripe customer id. Card numbers are handled by Stripe and never reach devgate. |
What is not
- — Request and response bodies passing through your tunnel.
- — Card numbers, or any payment credential.
- — Analytics or advertising trackers on this site — there are none, on any page.
One thing worth knowing about free endpoints
On the Free plan, a generated hostname embeds the agent's public IPv4 address, and first-time visitors see an interstitial warning page before the site loads. Both go away on a paid plan or with a reserved endpoint. If the address of the machine running the agent is something you would rather not publish, do not use a free ephemeral endpoint for it.
Cookies
This marketing site sets none. The dashboard sets a session cookie, and a small non-sensitive cookie that only says “someone is signed in”, so these pages can show a Dashboard link instead of Sign up. No tracking or advertising cookies anywhere.
Who else sees it
Stripe, for payments. Email delivery, for the mail devgate sends you. Nothing is sold, and nothing is shared with advertisers or data brokers. Data may be disclosed if the law requires it.
How long it is kept
Account and endpoint data lives until you delete it. Usage records are kept for billing history. Request metadata is kept with its endpoint — automatic pruning of older entries is not in place yet, so treat the traffic log as retained until the endpoint or account is deleted. Deleting your account in account settings removes it and its endpoints; ask at dmitry@devgate.online for a copy or an early deletion of anything else.