Privacy Policy

This Privacy Policy explains how Swyft Labs ("Swyft Labs," "we," "us," or "our") collects, uses, discloses, retains, and protects information in connection with Serve, including the Serve command-line client, dashboard, reverse-tunnel relay, APIs, websites, and related support (collectively, the "Service"). It applies to account holders, authorized device users, visitors, and people who interact with a public link created through the Service. If you use the Service for an organization, you are responsible for making sure that your use and any information you route through it are authorized by that organization.

This policy is intended to describe our actual practices. It is not a promise that a particular control, retention period, security measure, or legal right will apply where applicable law does not require it. The Terms of Service and Acceptable Use Policy govern use of the Service.

1. Information We Collect

1.1 Information You Provide

• Account information: email address, account identifier, authentication status, and information you provide in account or support communications. Passwords are handled by our authentication provider; we do not receive your plaintext password.
• Device and client information: device names or labels, device authorization records, public keys or identity fingerprints, activation and authorization status, token metadata, and timestamps. Secret tokens, private keys, activation secrets, and token hashes are not displayed to browser users after creation and are not intentionally placed in background-job inputs or ordinary application logs.
• Link and tunnel configuration: labels, assigned subdomains, ownership and plan state, live or stale state, protection settings, expiry times, capability or viewer-grant metadata, and actions taken to claim, release, protect, renew, or revoke a link.
• Entitlement information: if you purchase or hold a subscription, Polar.sh (our Merchant of Record) shares with us the information needed to verify entitlement, such as Polar customer identifiers (which match our account identifiers), product/subscription status, and reconciliation results. We do not ask Serve for your Polar password or payment-card number.
• Communications: messages, abuse reports, support requests, feedback, and other information you choose to send to us.
• Payment information: Serve does not process payment cards directly. Purchases are made through Polar.sh as Merchant of Record, whose terms and privacy notice apply to payment processing (see Polar.sh's privacy policy); we will update this policy when required.

1.2 Information Collected Automatically

Depending on the feature, request, and environment, we may collect or generate operational information such as IP address, approximate location inferred from IP address, browser and operating-system information, user agent, language, referring URL, timestamps, request identifiers, HTTP method and path, response status, error details, rate-limit events, connection and WebSocket lifecycle metadata, protocol and client version, bytes or aggregate traffic counters, and relay or API health information. We use this information for delivery, security, abuse prevention, capacity, troubleshooting, and reliability. Not every field is collected for every request or retained after the operational need ends.

1.3 Tunnelled Content and Published Artifacts

Serve operates in two modes. In live mode, it is a transport: HTTP requests, responses, WebSocket frames, headers, cookies, and other bytes sent through a tunnel pass through relay memory and network infrastructure while being forwarded to or from your local server, and live traffic is forwarded rather than stored as a content archive. In published mode, a copy of the artifact you explicitly publish is stored in Serve-managed cloud storage so the link keeps working without your machine. Stored artifacts are processed to deliver, cache, and validate the published link; they are not used for advertising or intentionally inspected for product analytics. We may access, preserve, or disclose limited content when reasonably necessary to investigate a security incident, respond to a lawful request, enforce the Terms or Acceptable Use Policy, or protect users and the Service.

The Service is not an end-to-end encrypted storage system: TLS may terminate at the public edge, and content can be visible to the tunnel owner, public-link viewers, the local destination, and infrastructure providers involved in delivery. Use end-to-end encryption at the application layer for information that requires it.

1.4 Information From Third Parties

We may receive information from Supabase for authentication, Polar.sh for entitlement verification (as Merchant of Record), infrastructure and security providers, and from people who report abuse or interact with a public link. We may combine that information with information collected directly from you where permitted.

2. How We Use Information

We use information to:

• provide, authenticate, maintain, and personalize the Service;
• create and manage accounts, devices, links, reservations, and grants;
• route tunnel traffic and preserve supported HTTP and WebSocket behavior;
• verify Polar.sh (Merchant of Record) entitlements and maintain plan state;
• secure the Service and prevent abuse, fraud, unauthorized access, and attacks;
• measure capacity, diagnose failures, and improve reliability and features;
• respond to support, legal, security, and abuse communications;
• send transactional or service messages, including security notices and account changes;
• comply with law, legal process, and contractual obligations; and
• establish, exercise, or defend legal claims and protect our rights and users.

We may create aggregate or de-identified information that is no longer reasonably capable of identifying a person or account. We may use and disclose that information for lawful business purposes, including capacity planning, security research, and service improvement.

3. Legal Bases

Where data-protection law requires a legal basis, we generally process information to perform our contract with you, to pursue legitimate interests in operating and securing the Service, to comply with legal obligations, or with your consent. You may withdraw consent where consent is the basis, but withdrawal does not affect processing already performed and may prevent use of the related feature.

4. How We Disclose Information

We do not sell personal information or share it for cross-context behavioral advertising. We may disclose information in these circumstances:

• Service providers: vendors that host, authenticate, store, secure, monitor, support, or operate parts of the Service. Current infrastructure includes Supabase for authentication and database services, Amazon Web Services for hosted infrastructure, Cloudflare for dashboard or network delivery, Polar.sh for the billing you request (as Merchant of Record), and Resend for transactional email delivery (such as internal notifications of new account signups, which carry the signup email, account identifier, authentication provider, and timestamp). Providers may process information only as needed for their services and under their own terms and privacy notices.
• Legal and safety requests: courts, regulators, law enforcement, government authorities, or other parties when we reasonably believe disclosure is required by law, valid legal process, or an urgent need to prevent harm, fraud, abuse, or a security incident.
• Corporate transactions: actual or prospective purchasers, investors, lenders, advisers, or successors in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to customary confidentiality obligations where appropriate.
• At your direction: when you authorize a device, share a public link, request a viewer grant, or otherwise direct us to disclose or make information available.
• With consent: when you separately agree to a disclosure.

5. Cookies, Local Storage, and Similar Technologies

The dashboard uses essential browser storage and similar technologies to maintain authentication state, remember required preferences, prevent abuse, and make the application work. The browser may also send standard request metadata to our infrastructure.

We do not use Serve's dashboard to sell targeted advertising, and we do not use advertising trackers or cross-site tracking. The marketing website (servelink.cc) collects aggregate, cookieless traffic statistics — page views, referrer, device and browser type, and approximate location — through a self-hosted analytics service running on our own infrastructure (Umami). It sets no cookies and does not identify individual visitors. You can control browser storage in your browser, but disabling essential storage may prevent login or use of the dashboard.

6. Retention

We retain information only for as long as reasonably necessary for the purposes described in this policy, including security, dispute resolution, accounting, fraud prevention, and legal compliance. Retention varies by type and may be extended by a legal hold, active investigation, backup cycle, or unresolved dispute. Current service rules include:

• expired device activations and OAuth states are deleted after 24 hours;
• Polar webhook raw bodies are removed after 30 days while event hashes, metadata, and status may remain;
• completed relay invalidations are retained for 30 days and then deleted;
• released or quarantined vanity claims are removed when their release period ends;
• account, link, device, entitlement, and security audit records may remain while the account is active and for a reasonable period afterward; and
• backups and provider-controlled logs may persist for a limited additional period before normal rotation.

Live tunnel bytes are intended to be forwarded rather than stored as a content archive. Published artifacts are stored on our infrastructure until you unpublish or replace them; unpublishing deletes the stored artifact bytes. Operational logs and temporary buffers may exist as needed for delivery, security, debugging, or legal compliance.

7. International Processing

Swyft Labs and our providers may process information in countries other than the country where you live. Where required, we use an appropriate transfer mechanism, contractual protection, or other safeguard. The laws of those countries may provide different protections from your local law.

8. Security

We use administrative, technical, and organizational measures designed to protect information, including access controls, encryption in transit where supported, secret separation, token hashing or encryption, least-privilege database access, request limits, and operational monitoring. No system, network transmission, or storage method is completely secure. You are responsible for protecting your account credentials, device private keys, link URLs, protection secrets, and local server.

Report suspected security issues promptly to serve@servelink.cc. Do not include passwords, private keys, raw access tokens, or unnecessary personal information in a report.

9. Your Choices and Privacy Rights

Depending on where you live and subject to legal exceptions, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal information; withdraw consent; opt out of certain marketing; and complain to a data-protection authority. You may revoke devices and tokens in the dashboard and may request account deletion by contacting us.

To make a request, email serve@servelink.cc with the request type, the account email or other information needed to locate the account, and the country or state whose law you are relying on. We may verify your identity, ask for clarification, deny or limit a request where permitted, and retain information needed to document and respond to it. We aim to respond within the period required by applicable law. You may use an authorized agent where permitted, but we may verify the agent and your authorization.

We do not discriminate against you for exercising a privacy right. If you use the Service through an organization, the organization may control the account and content, and you should direct requests about organization data to that organization first.

10. California and Similar State Notices

For applicable U.S. state privacy laws, the categories we may collect or disclose include identifiers and contact information; internet or network activity; device and account information; geolocation approximations; commercial or entitlement information; professional or organization information you provide; communications; and inferences used for security or service operations.

We use those categories for the purposes described above and disclose them to service providers, legal authorities, transaction participants, and parties you direct. We do not sell or share them for targeted advertising. We do not use sensitive information to infer personal characteristics or for purposes beyond providing, securing, and complying with law regarding the Service. California residents may contact us at the address above to exercise applicable access, correction, deletion, or opt-out rights and may appeal a denied request by replying to our response.

11. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If local law sets a higher age for consent or independent use, that higher age applies. Contact us if you believe a child provided information, and we will take reasonable steps to investigate and delete it where required.

12. Third-Party Services and Links

The Service may link to or interoperate with third-party services. Their privacy policies, terms, security practices, cookies, and data retention apply to their processing. We do not control and are not responsible for third-party practices, outages, or content.

13. Changes to This Policy

We may update this policy to reflect changes in the Service, law, providers, or our practices. We will post the revised version with a new "Last updated" date and, where required, provide additional notice or obtain consent. Your continued use after the effective date means the revised policy applies to future processing, except where law requires a different treatment.

14. Contact

Privacy questions, rights requests, security reports, and legal notices may be sent to serve@servelink.cc. Abuse reports and takedown requests go to abuse@servelink.cc. Please include enough information for us to understand and respond to the request, but do not send secrets or sensitive information unnecessarily.