01Technical cookies
There are two of them. Both are needed for the site and dashboard to work, both are set by us, and neither tracks you across sites.
| Cookie | Purpose | Duration |
|---|---|---|
| tunnelops_session | Keeps you logged into the dashboard or admin panel. Contains only a random session identifier — not your email, not your name, nothing personal; the record of what it points to is kept on our server, not in the cookie. | 30 days, extended with activity |
| tunnelops_csrf | Protects the login, registration, and password-recovery forms from cross-site request forgery (CSRF) while you don't yet have a session. After login, the same token is kept in the server-side session, and a separate cookie is no longer needed. | 1 hour |
Both are HttpOnly (not accessible from JavaScript on the page),
Secure (sent only over HTTPS), and SameSite=Lax
(not sent on requests from another site). These are exactly the properties needed for the session and CSRF-protection cookies — not a broader “just in case” set.
02Analytics: PostHog, Google Analytics, Microsoft Clarity
Three systems, all three running on every public page and every dashboard page. They answer one question — how people use the site — and each answers it differently, which is why all three are in place: PostHog provides events and session replay, Google Analytics provides summary traffic-source and audience statistics, and Clarity provides heatmaps and recordings focused on layout problem spots.
| Cookie | Who sets it and why | Duration |
|---|---|---|
| ph_phc_<…>_posthog | PostHog. Stores an anonymous device identifier and the current session identifier so that the events of one visit form a single sequence, and one person's visits form a single history. After logging into the dashboard, we additionally pass PostHog the account identifier and email address so that visits from different devices can be linked. | 1 year |
| _ga | Google Analytics. A browser identifier that GA uses to distinguish a repeat visit from a new one. | 2 years |
| _ga_<ID> | Google Analytics. The state of the current session for a specific property: when it started and how long it lasts. | 2 years |
| _clck | Microsoft Clarity. A Clarity user identifier linking multiple visits from the same browser. | 1 year |
| _clsk | Microsoft Clarity. The current session identifier: groups multiple page views into a single record. | 1 day |
| CLID, MUID, ANONCHK, SM | Microsoft Clarity and related Microsoft infrastructure. Internal identifiers that Clarity sets on its own domains when the script loads and when a recording is uploaded. | 1 day to 1 year |
Beyond cookies, all three also receive whatever the browser reports on each request: IP address, user agent, window size, the address of the page you're on, and the address of the page you came from. PostHog and Clarity additionally record on-page actions — see section 03.
Their policies, not our summary: PostHog, Google (and the Google Analytics terms), Microsoft. The data each of them receives is listed in the recipients section of the privacy policy.
03Session recording, and what's excluded from it
PostHog and Clarity record the session: cursor movements, scrolling, clicks, navigation between pages, and input into ordinary fields. This is not a screen video recording — it's a sequence of page changes that is played back afterward; neither the camera, nor the microphone, nor other browser tabs are or can be captured in it.
Four kinds of fields are excluded from recording, and this is the only exclusion:
- Passwords — at login, registration, recovery, and password change.
- Second-factor codes and email-address confirmation codes.
- Proxy password and ready-made connection strings in the dashboard, including generated lists and code samples.
- Crypto wallet address in the referral-payout withdrawal form.
The reason is technical, not decorative. No product question is answered by knowing the characters you typed into a password field — no funnels are built on them. But everything listed is working credentials, and letting them into someone else's recording system would turn a compromise of our analytics account into a compromise of your proxies and payouts. Everything else — clicks, input into ordinary fields, scrolling, navigation — is recorded without restriction.
There's one more exclusion you won't see, but it exists: on the pages of the admin panel, none of the three systems loads at all. The panel's address is a random secret string, and session recording would send it to three external services forever.
04What we don't have
- Advertising and marketing cookies. No ad-network pixels, no retargeting, no identifiers for ad delivery. The three systems in section 02 are product analytics: they measure site usage, not ad targeting. Google Analytics features related to advertising (Google Signals, remarketing) are not enabled.
- Sale or transfer of data to third parties beyond what these systems themselves need to operate: recipients are listed by name in the privacy policy, and the list is closed.
- Analytics inside proxy traffic. Proxied connections go to a different domain name, none of these scripts run there, and we do not look at the contents of your traffic — see the privacy policy.
- localStorage and similar storage for anything other than the operation of the form you're filling out and the internal state of these same three systems.
A previous revision of this document stated that there was no analytics on the site. That stopped being true, and the document was changed the same day — a gap between what's stated and what's actually done is worse than the analytics itself.
05Cloudflare
Connections to this site pass through Cloudflare, and Cloudflare may set its own technical cookie to protect against automated traffic (bots, DDoS). We do not read this cookie, do not influence its contents, and receive no data about you from it — it is infrastructure between you and us, not our own data collection.
Traffic through the proxy — what you're actually buying — goes to a different domain name and does not pass through Cloudflare at all; this applies only to connections to the tunnelops.cloud site itself.
06Why there's no consent banner
The two cookies from section 01 are strictly necessary: without
tunnelops_session, you cannot stay logged into the dashboard beyond a single request; without
tunnelops_csrf, the login and registration forms are unsafe. No consent is required anywhere for such cookies.
The analytics in section 02 are not strictly necessary, and we don't hide that behind the word “functional.” There's no banner nonetheless: the service is not directed at consumers in the European Economic Area or the United Kingdom, it is sold worldwide to legal entities and professional users, and measurement is limited to how the site itself is used. We'd rather say this plainly in the document you're reading and give you a working way to opt out (section 07) than show a banner almost everyone dismisses without reading.
If this is not enough for your jurisdiction, write to [email protected]: we will delete what has been collected for your account and your browser identifiers.
07How to opt out
Both cookies can be deleted or blocked in your browser settings at any time. The consequence for
tunnelops_session — you're logged out on the next request; for
tunnelops_csrf — the login form issues a new token on the next page load. Neither is required to read the
homepage or documents like this one: pricing, terms, and policies load without a single cookie.
The analytics in section 02 can be disabled using any of the following methods, none of which break the site: any content blocker or “Do Not Track” mode in your browser (all three scripts load from external domains and are blocked like ordinary trackers); the official Google Analytics opt-out add-on; the Microsoft Clarity opt-out form; or deleting the cookies for these domains in your browser settings. The dashboard, purchases, and string generation work the same with or without them.
Questions — [email protected]. For more on the data we process besides cookies, see the privacy policy.