1. Overview

Hermez is a developer tunneling service that exposes local servers to the internet through secure WebSocket tunnels. This policy describes what data we collect when you use Hermez, how we use it, and who we share it with. By creating an account or using the service, you agree to the practices described here.

2. Information We Collect

Account data. When you register, we collect your full name, email address, and a password. Passwords are never stored in plaintext — they are hashed using Argon2 before being written to our database.

OAuth sign-in. If you authenticate via Google or GitHub, those providers share your name, email address, and a provider-assigned unique identifier with us. We do not receive or store your OAuth password.

Profile. If you upload an avatar, the image is stored in Cloudflare R2 object storage. A public URL pointing to that image is stored in your account record.

Tunnel and subdomain data. We store the subdomain names you reserve and any custom domains you register (available on paid tiers). This data is necessary to route traffic to your tunnels.

Request logs. HTTP requests and responses that pass through your active tunnels are logged. What is captured depends on your subscription tier:

• Chelys — method, path, status code, duration, timestamp, client IP. Retained for 1 hour, capped at 100 entries.
• Inventor — same as Chelys. Retained for 3 days, capped at 1,000 entries.
• Petasos — above, plus request and response headers and bodies (up to 64 KB each). Retained for 30 days, capped at 5,000 entries.
• Talaria — same as Petasos. Retained for 90 days, no rolling cap.

Log entries are purged automatically when they exceed their tier's retention window or rolling cap. You can also clear logs for any tunnel manually from your dashboard.

3. How We Use Your Data

• To authenticate you and secure your account sessions.
• To operate the tunneling service — routing traffic to your subdomains and custom domains.
• To send transactional emails (account verification, password reset) through our email provider, Resend.
• To display request inspection data in your dashboard, scoped to your account.
• To enforce the limits associated with your subscription tier.

We do not use your data for advertising. We do not build behavioral profiles. We do not sell or rent your personal data to any third party.

4. Third-Party Services

Running Hermez requires sharing certain data with the following infrastructure providers. Each operates under their own privacy policy.

• Railway. Our hosting provider. Your account data, request logs, and tunnel metadata are stored on Railway's infrastructure (PostgreSQL database and Redis cache). All server-side data resides on Railway.
• Cloudflare. Handles DNS resolution and HTTPS proxying for all *.hermez.online subdomains. Custom domain TLS certificates are provisioned through Cloudflare for SaaS. Avatar images are stored in Cloudflare R2. All tunnel traffic passes through Cloudflare's edge network.
• Resend. Processes your email address to deliver transactional emails (verification, password reset). Your email is shared with Resend only for this purpose.
• Google / GitHub. If you use OAuth sign-in, the respective provider shares your name, email, and a unique identifier with us. We do not receive your password. Use of these providers is governed by their own terms and privacy policies.

No other third parties receive your personal data.

5. Data Retention and Deletion

Request logs are purged automatically per the retention windows listed in Section 2. All other account data is retained for as long as your account is active.

Deleting your account from dashboard settings permanently removes your personal information, reserved subdomains, custom domains, OAuth connections, and all associated request logs from our systems. Residual copies may persist in encrypted infrastructure backups for a short period before being overwritten.

6. Security

• Passwords are hashed with Argon2 before storage. No plaintext passwords are ever written to disk.
• API keys are stored as SHA-256 hashes. The full key is shown only once at generation time.
• All communication between the CLI, our servers, and your browser is encrypted via HTTPS and WSS (WebSocket Secure).
• Access tokens expire and are rotated on each refresh.

7. Your Rights

• You can update your name and avatar from your account settings at any time.
• You can connect or disconnect Google and GitHub from your account settings.
• You can delete your account permanently from the danger zone in settings.
• You can clear request logs for any tunnel from the inspection dashboard.

For any data requests or concerns not covered by the above, contact us at support@hermez.one.

8. Changes to This Policy

We may update this policy from time to time. Changes will be reflected by an updated effective date at the top of this page. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

9. Contact

Questions about this policy can be directed to support@hermez.one.