OwnTunnel — Privacy Policy
1. Who is responsible
OwnTunnel is published by CATALUMIA S.L., a company registered in Spain (Calle Calabria 149, ent 1ª, 08015 Barcelona, Spain, tax ID Y5575476Z). Under the GDPR, CATALUMIA S.L. is the data controller for anything described here.
Contact: [email protected]
We have not appointed a Data Protection Officer. We are not required to: we do not carry out large-scale processing of personal data. As explained below, we do not process personal data at all.
2. The short version
OwnTunnel has no servers. There is no account, no sign-in, no e-mail address, no analytics, no crash reporting and no advertising. Nothing you do in the app is reported to us, because there is nowhere for it to be reported to.
Your VPN traffic goes from your device to a server you own, in your cloud account. It never passes through anything we operate. There is no traffic log for us to keep, hand over or lose, because your traffic never reaches us.
3. What we do not collect
We do not collect, receive, store or have access to:
- your name, e-mail address, phone number or postal address;
- any account or user identifier — there are no accounts;
- your IP address, either your real one or the one your tunnel gives you;
- your browsing history, DNS queries, connection times, session durations or bandwidth figures;
- your WireGuard keys or configuration;
- your cloud provider API token;
- device identifiers, advertising identifiers or IDFA;
- crash reports, diagnostics, performance data or usage analytics;
- contacts, photos, location or health data;
- purchase or payment data — the app sells nothing and contains no in-app purchases.
The app contains no third-party SDKs: no analytics library, no advertising library, no crash reporter, no attribution or A/B testing framework. You can verify this in the published source code.
4. What stays on your device
Two secrets are stored on the device, both in the iOS/macOS Keychain:
| What | Where | Protection |
|---|---|---|
| Your WireGuard configuration, including the private key | Device Keychain | AfterFirstUnlockThisDeviceOnly, not synchronizable |
| Your cloud provider API token (only if you used the setup wizard) | Device Keychain, a separate item | AfterFirstUnlockThisDeviceOnly, not synchronizable |
What those two flags mean in practice:
- Not synchronizable — these items are excluded from iCloud Keychain. They are never uploaded to Apple or to anyone else.
- ThisDeviceOnly — these items are excluded from device backups, including encrypted ones. Restoring a backup onto a second device does not carry your private key or your token with it.
A third copy of the configuration exists in a shared Keychain group so that the VPN system extension — a separate process required by iOS to run the tunnel — can read it. It carries the same protections and does not leave the device either.
"Forget this configuration", on the Your data screen, erases all of the above: the stored configuration, the token, the extension's copy, and the VPN profile the app installed in system settings. If any part of that erasure fails, the app tells you so rather than claiming success.
5. Every network connection the app makes
This is the complete list. There are no others.
- To your cloud provider's API (
https://api.hetzner.cloud/v1), and only while you are using the setup wizard or answering the "leftover server" question at launch. Your API token is sent in theAuthorizationheader of that request, from your device straight to Hetzner. It does not pass through us, and we could not read it if we wanted to — we operate nothing on that path. What Hetzner does with that request is governed by Hetzner's own privacy policy and by the contract between you and Hetzner. We are not a party to it. - To the server you just created, a single TCP connection on port 51821, repeated until it succeeds. This is how the app knows the installation has finished. It carries no data — the connection opens and closes. That port is shut by the server itself 15 minutes after boot.
- The VPN tunnel itself: UDP to your server on port 51820, encrypted with WireGuard. Direct, device to your server.
- Links you tap, which open in your browser: your provider's sign-up page and cloud console. Following a link is your action, and from that point you are on the provider's website under their terms.
There is no OwnTunnel server, telemetry endpoint, update check or licence check. The Your data screen states this inside the app, and it is accurate.
6. DNS
While the tunnel is up, your configuration sets your DNS resolver to 1.1.1.1, Cloudflare's public resolver. Your DNS queries therefore reach Cloudflare, not us, and Cloudflare's privacy commitments for that resolver apply to them.
We mention this because it is the one third party your everyday traffic touches by default, and a privacy policy that quietly omitted it would be a bad one. You can change the DNS = line in your configuration to any resolver you prefer, including one on your own server. A future version will move the resolver onto your own server by default.
7. The camera
The app asks for camera access for exactly one purpose: reading a QR code that contains a WireGuard configuration.
The camera frames are analysed on the device by the system's built-in QR detector. No image or video is written to disk, saved to your photo library, or transmitted anywhere. The app does not request photo library access at all. If you decline camera access, everything else works; you paste your configuration as text instead.
On macOS there is no scanner at all — the system's code detector does not work there — so the Mac app never asks for camera access and declares no camera permission.
8. The server you create
When you use the setup wizard, the app creates a virtual server in your own cloud account, on your own bill. You own it. We have no access to it, no credentials for it and no way to reach it.
- Both key pairs are generated on your device. The server is sent its own private key and your device's public key. Your private key is never sent to the server or anywhere else.
- Servers the app creates are tagged with the label
owntunnel. The app only ever lists or deletes servers carrying that label, so your unrelated machines are invisible to it, and it never deletes anything without asking you first. - Anything the server itself records — system logs, your provider's own billing and infrastructure records — belongs to you and to your provider. We cannot see it. If you want it gone, delete the server; your provider's data retention terms then apply.
9. Referral links
The setup wizard offers a link to open a cloud provider account. When a referral programme is in effect, opening an account through that link earns OwnTunnel a small credit from the provider (a service credit that pays for our own test servers, not a commission on you), and usually earns you a sign-up credit too.
Three things are true of this, by design and visible in the source code:
- the app says so in plain words, on the same screen, before you tap;
- the same screen offers a plain link that earns us nothing, in one tap;
- the provider tells us nothing about you. A referral programme reports a credit, not an identity. We do not learn that you signed up, what you bought, or what you ran on it.
10. Children
OwnTunnel is not directed at children and collects nothing from anyone, children included. It is rated 4+ because it contains no objectionable content, not because it is aimed at young users.
11. Changes to this policy
If the app's behaviour changes, this policy changes with it, before the change ships. The current version always lives at https://owntunnel.app/privacy with its effective date at the top. Because we hold no contact details, we cannot notify you individually; material changes will be noted in the app's release notes.
12. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, to object to processing, and to lodge a complaint with a supervisory authority.
We state honestly what those rights mean here: we hold no personal data about you, and we cannot identify you. There is no account to look up, no record to export and nothing to erase on our side. Under Article 11 GDPR, a controller who cannot identify a data subject is not required to acquire additional information solely in order to comply with a request — and we will not start collecting identifying data in order to be able to answer such requests.
The data that exists is on your device, under your control, and the Your data screen erases all of it in one action.
If you believe we are processing personal data about you, write to [email protected] and we will answer. You may also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), www.aepd.es, or to the supervisory authority in your own country of residence.
13. Contact
[email protected] — CATALUMIA S.L., Spain.
This policy was written to describe what the software actually does, line by line against its source code. It is not legal advice, and review by a qualified lawyer is recommended before publication.