Privacy policy

Last updated: October 4, 2026

1. Data controller

The data controller is the publisher of Portlatch, identified in the legal notice. For any question about your data, write to privacy@portlatch.eu .

2. The principle

We process what you do on your account, and nothing that belongs to the content or to your visitors.

Portlatch relays traffic without ever terminating encryption: HTTPS or SSH traffic stays encrypted end to end between the visitor and your machine. We cannot read it, and that is a technical property of the service, not just a promise.

3. The data we process

Your account

Name, email address, password (stored hashed, never in clear text), date you accepted the terms, IP address and date of sign-up, and, if you turn it on, the two-factor authentication secret (encrypted). Purpose: providing the service and knowing who is behind each route. Legal basis: performance of the contract.

The activity log

The actions taken on the account, with their date and the IP address they came from: sign-up, logins and failed logins, creating and deleting agents, routes and names, changes of plan, password or email address. For each route, its public address or name and its target on your network. Purpose: the security of the account, and being able to answer an abuse complaint by pointing to the right account. Legal basis: our legitimate interest, and our obligations as a technical intermediary.

Your agents

The name and icon you give them, their version and the platform they were built for (for instance linux/amd64), their WireGuard public key, their last sign of life, and the public IP address they connect from. Purpose: setting up the tunnel, and linking a complaint to an agent. Legal basis: performance of the contract.

Traffic volume

Bytes in and out, per agent and per route, grouped in slices of a few minutes. Purpose: quotas, billing and your charts. Legal basis: performance of the contract.

Payment

Payments are processed by Stripe, which collects your card and billing address: we never see the card number. Stripe sends us the status of your subscription, your invoices and the country of your billing address, which we use for our statistics. Legal basis: performance of the contract, and our accounting obligations.

4. What we don't collect

  • The content of your traffic: we don't read it, and cannot when it is encrypted.
  • Your visitors' IP addresses: our servers log nothing connection by connection. The agent writes them to its own logs, on your machine, which remain yours.
  • No analytics, no advertising, no trackers. We don't sell or share your data.

5. How long we keep it

  • An account never verified is deleted after 7 days.
  • An active account: its data is kept as long as it exists.
  • The activity log: the IP address of each action is erased after 12 months; the history of actions is kept as long as the account exists.
  • When the account is closed, it is anonymized at once. Its identity (name, email address) and its IP address are kept for 12 months, to answer a possible complaint, then erased for good.
  • Traffic volume is kept with no time limit, as accounting data; once the account is anonymized, it is no longer linked to anyone.
  • Invoices are kept for 10 years, as French commercial law requires.

6. Processors

Your data is hosted in the European Union. Our providers:

  • OVHcloud (France) hosts the website, the API and the database.
  • Scaleway (France) hosts the servers that relay the traffic, and sends our emails.
  • netcup (Germany) hosts our DNS zones; it only receives the names of routes, no account data.
  • Stripe (Ireland) processes payments. Stripe may transfer data to the United States, covered by the Data Privacy Framework and the European Commission's standard contractual clauses.

7. Cookies

The website only sets the cookies it needs to work, which require no consent:

  • the session cookie, which keeps you signed in;
  • the token that protects against cross-site request forgery (CSRF).

Your choice of light or dark theme is kept in your browser's local storage, and never reaches us. During a payment, Stripe's page sets its own cookies, governed by its own policy.

8. Security

Passwords are hashed, secrets encrypted, and every connection to the website goes over HTTPS. Two-factor authentication is available on every account. The private key of the tunnel never leaves your machine.

9. Your rights

You have the right to access, correct, erase, restrict and port your data, and to object to its processing. Most of them you exercise directly from My account: changing your name or email address, closing your account. For the rest, write to privacy@portlatch.eu .

Erasure is limited by what we must keep to answer a complaint or for our accounting, for the periods given above.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).