Privacy

Last updated 30 October 2026

A tunnel carries your traffic, so the question “what does devgate keep?” deserves a specific answer rather than a paragraph of reassurance. Here is the list.

What is stored

Account	Name, username, email address, a hashed password, and your authtoken. Sign-in through GitHub or Google stores the same fields, not the provider password.
Endpoints	The slug, the local address the agent forwards to, the Host header setting, and which device an endpoint is pinned to.
Devices	A name and the public half of the SSH key each device generates on first run. The private key never leaves your machine.
Usage	Bytes in and out, request counts and endpoint hours, reported by the agent every few seconds and totalled for billing.
Request metadata	For every request through a tunnel: time, client IP, method, path, status and duration.
Captured requests	Only if you turn on full capture in account settings (off by default): request and response headers and the first 10 KB of each body, so Traffic Inspector can show and replay them. Deleted after 24 hours on the Free plan and 72 hours on paid plans.
Sign-up source	How you found devgate, saved once with a new account: the site that linked here (its name, not the full address), the campaign tags on that link and the first page you opened. Until then it waits in this browser tab’s session storage — not a cookie, cleared when the tab closes — and in the dashboard session once you open its sign-up page.
Billing	Plan, invoices and a Stripe customer id. Card numbers are handled by Stripe and never reach devgate.

What is not

— Request and response bodies passing through your tunnel, unless you turn on full capture for your account.
— Card numbers, or any payment credential.
— Advertising trackers on this site — there are none. Google Analytics is the only analytics, and it loads only if you allow it.

One thing worth knowing about generated hostnames

A hostname generated for an endpoint that was not reserved embeds the agent's public IPv4 address. A reserved endpoint does not. If the address of the machine running the agent is something you would rather not publish, reserve an endpoint for it instead of using a generated one.

Cookies

This marketing site sets cookies only if you allow Google Analytics in the banner: _ga and _ga_*, which tell one visit from the next and expire after 13 months. Advertising features and Google signals are off. Declining loads nothing from Google at all; the choice is remembered in this browser and can be changed from the “cookies” link at the bottom of every page. The dashboard sets a session cookie, and a small non-sensitive cookie that only says “someone is signed in”, so these pages can show a Dashboard link instead of Sign up. No advertising cookies anywhere.

Who else sees it

Stripe, for payments. Email delivery, for the mail devgate sends you. Google, for visit statistics on this site, if you allow them. Nothing is sold, and nothing is shared with advertisers or data brokers. Data may be disclosed if the law requires it.

How long it is kept

Account and endpoint data lives until you delete it. Usage records are kept for billing history. Captured headers and bodies are deleted when their retention window ends: 24 hours on Free, 72 hours on paid plans. Request metadata is kept with its endpoint — automatic pruning of older entries is not in place yet, so treat the traffic log as retained until the endpoint or account is deleted. Deleting your account in account settings removes it and its endpoints; ask at dmitry@devgate.online for a copy or an early deletion of anything else.