What this site stores — and what it does not.

This notice covers the tcptun website and its browser-based tools. It does not replace the privacy policies of hosting, CDN, package registries, or other services that you choose to use with tcptun. The tcptun command-line runtime and any server you operate can process network traffic according to your own configuration; this page does not describe those deployments.

When a browser requests a page or asset, the hosting, CDN, and security infrastructure may receive ordinary technical information such as an IP address, browser and device information, request time, referrer, and requested resource. These providers control their own logs and retention periods. The site does not provide accounts, a contact form, a mailing list, or first-party advertising analytics.

Config generation and URI conversion are designed to run in your browser. Values you paste into those tools, including keys, tokens, passwords, and configuration text, are not intentionally uploaded by the tcptun application. As with any web application, browser extensions, network inspection software, and the browser itself can have their own access.

The site uses browser storage for operations and preferences, such as theme and cookie-consent choice. We do not use first-party advertising or marketing tracking cookies. Hosting, CDN, or security providers may use technical cookies or logs under their own policies.

The site may link to third-party websites, package registries, CDNs, and release services that operate independently. You choose those providers and are responsible for reviewing their terms and privacy policies.

Browser-local data remains until it expires, is replaced, or you clear it through your browser or site settings. You can block storage or clear site data. Blocking storage may reset preferences or prevent some features from working.

For privacy questions or requests, use the project's public repository at github.com/sskycn/tcptun. Please do not publish passwords, private keys, personal documents, or other sensitive data in a public issue. We may update this notice when the site or its data practices change; the “Last updated” date below identifies the current version.

The tcptun-kotlin Android client is a local VPN and transparent-proxy tool. It uses Android VpnService to create a device-level VPN interface and connects to remote endpoints you provide or select. The operator does not provide, sell, rent, or manage VPN nodes, proxy servers, subscriptions, or cloud configuration, and has no operator-owned backend for accounts, sync, advertising, analytics, or crash reporting.

“We do not collect” means the operator does not receive or retain data from the app. It does not mean a user-configured endpoint or a connectivity-test target cannot observe network metadata. The current app does not upload names, emails, phone numbers, accounts, contacts, SMS, call logs, location, advertising identifiers, crash reports, profiles, VPN traffic, traffic-analysis events, runtime logs, or QR images to an operator server, and includes no account, advertising, analytics, or crash-reporting SDK.

The app may process profiles and credentials, TLS/transport parameters, routing rules, runtime settings, installed app package names and labels, local network-interface information, VPN/proxy status, diagnostic state, and logs. Non-secret profile fields, routing rules, and some settings are stored in app-private SharedPreferences. Profile credentials and local proxy account passwords are stored separately with AES-256-GCM, using a key protected by Android Keystore. Protect the device and any exported or shared profile data. Runtime logs and traffic-analysis events are held mainly in memory; sensitive fields are redacted before they are shown in the app or written to visible Logcat.

Clipboard text is read only after you explicitly import a profile. After a successful import, the app attempts to clear clipboard text that still matches the imported value. Camera access is requested only when you open the QR scanner; preview frames are used on-device to recognize a profile or local-proxy QR code and are not uploaded to an operator server. An A1: payload shares one local SOCKS5/mixed username and password. A1 is not encrypted: treat the payload, password, and QR image as a bearer secret. Do not persist them in logs, diagnostics, SavedState, or public storage.

When VPN mode is enabled, device traffic is forwarded according to the selected profile. The endpoint operator may see or retain connection time, source IP (which can reveal approximate location), destination information (including websites visited), traffic metadata, and content not protected by end-to-end encryption. Use only endpoints you trust and review their policies. The tcptun operator does not receive that traffic through a project backend. v0.5.0 and later require an encrypted TLS or REALITY tunnel for Android VPN profiles; security=none, ECH profiles, and arbitrary FileConfig JSON are rejected. Overall security still depends on the profile, device, and remote endpoint.

While a VPN session is active, the app may send lightweight HTTPS 204 probes through the current outbound to connectivitycheck.gstatic.com/generate_204 and cp.cloudflare.com/generate_204. A user-triggered TCPing diagnostic tests port 443 on google.com, github.com, and cloudflare.com. Those sites may process connection metadata under their own policies. These checks are for connectivity, not advertising or behavioral analytics.

If you explicitly enable traffic analysis for one app, the client may display destination domain/IP, port, protocol, route reason, app package name, and timestamps locally. This state is not sent to an operator server. Stopping the feature or changing the target clears the related analysis state.

The app may request network-state and network-access, VPN and foreground-service operation, camera access for QR scanning, and notification permission for the VPN status notification. Camera access is used only after you open the scanner and grant permission, and is not required for ordinary profile editing or VPN use.

Starting in app v0.5.1, the first VPN start shows an in-app disclosure and requires affirmative consent before Android VPN permission is requested. Declining, going Back, or dismissing the dialog cancels the start. Versioned consent is stored in app-private SharedPreferences on the device and is not sent to an operator server. The disclosure and Settings can open this privacy page at https://tcptun.com/privacy/.

Local profiles, routing rules, and settings remain until you edit or delete them, clear the app's data in Android settings, or uninstall the app. Runtime logs and flow-analysis state are primarily in memory and disappear when cleared or when the process ends. The operator has no cloud copy; deletion requests for remote-endpoint or diagnostic-site logs must go to those providers.

The client uses Android VPN APIs, the tcptun-go gomobile bridge, CameraX, and Google ML Kit barcode scanning. The current project has no Firebase Analytics, Crashlytics, advertising SDK, or standalone telemetry SDK. Android VPN routing is dual-stack Full Tunnel only. Reverse Subnet / P2P topology is a tcptun-go capability and is not exposed in the Android product. App-private storage and Keystore-backed credential encryption limit ordinary access by other apps, but they do not protect data if the device, shared profile, remote endpoint, or transport configuration is compromised.

TcpTun is a general-purpose network tool and is not directed to children. The operator does not knowingly collect children’s personal information. Because the app has no operator backend, the project does not receive such information from the app.

tcptun-go is the local Go runtime and embeddable networking library behind the CLI, Android bridge, and other integrations. It has no account system, advertising, analytics, crash-reporting, or developer-owned telemetry endpoint. It does not automatically send configurations, credentials, proxy traffic, logs, or usage reports to the tcptun project.

The core accepts local TCP/UDP flows, SOCKS5 or mixed-proxy requests, TUN traffic, and tunnel protocol traffic according to the configuration supplied by the operator or embedding app. It may forward those flows to direct destinations, user-configured SOCKS5 or tunnel endpoints, reverse-published services, or Reverse Subnet Home Connectors. Destination and endpoint operators may see and retain connection metadata and any content not protected by the selected transport or application encryption. SOCKS5 auth_mode=secure authenticates a shared secret; it does not encrypt the SOCKS5 connection.

JSON configuration, URI profiles, T2/T3 QR payloads, A1 local-proxy payloads, tokens, passwords, TLS/REALITY keys, and routing rules are read, validated, generated, or encoded locally by the Go process or its host. URI, T3, and A1 artifacts can contain credentials. A1 is not encrypted. Generated files should be protected and not shared through untrusted locations. The Go core does not create a cloud copy of these values.

A deployment can use the operating-system resolver or explicitly configured DNS servers. DNS queries may therefore be visible to the selected resolver, remote endpoint, or network provider, depending on the configuration and route. Optional DNS outbound pinning and fake-IP mapping are runtime features; fake-IP mappings are held in memory for that runtime and cleared when it stops. Review the privacy policy of every DNS provider you configure.

Runtime logs are sent only to the output or callback supplied by the host, such as the CLI's local stderr or an embedding app's log callback. Depending on log level and configuration, logs and status events can contain local listeners, remote endpoints, connection errors, timestamps, and runtime state. The host controls whether those outputs are displayed, stored, or shared. Setting the runtime log level to off suppresses runtime logs.

An embedding application can explicitly provide a flow observer or app-identity provider. If it does, the Go core can expose a flow's timestamp, TCP/UDP network, source, destination/domain or IP, port, original IP, outbound tag, route reason, and selected app identity. This is a local callback boundary, not automatic collection by tcptun-go.

The Android bridge can register status events such as remote-endpoint changes, reconnecting, and runtime connection issues. These events update the host's in-process status and may include remote endpoint summaries, state, errors, and timestamps. Registration does not send events to a tcptun server. The current Android client keeps this state local for UI and diagnostics.

In automatic no-config mode, the CLI can scan private IPv4 LAN addresses for a SOCKS5 service on port 1080 and stop after a successful handshake. Reverse publishing can make a selected local TCP/UDP service reachable through a tunnel. Reverse Subnet can proxy IPv4/IPv6 TCP/UDP to a Home Connector; optional direct QUIC (p2p.enabled) may exchange host, Edge-reflexive, STUN-reflexive, and peer-reflexive candidates with the authorized peer. Opt-in host candidates disclose selected private interface addresses. Direct-path failure falls back to relay. These operations create network connections visible to contacted devices and service operators; they are not developer analytics.

The Go core keeps active sessions, route state, DNS fake-IP mappings, counters, and other runtime state in memory unless the host or operator writes it elsewhere. Stop or close ends the runtime and clears its in-memory state subject to normal process and OS behavior. Files, logs, endpoint records, DNS logs, and remote-server logs created by a particular deployment are controlled by that deployment's operator, not by the tcptun project.