01Who we are
Burrow is operated by Bramble Labs Inc. This policy covers useburrow.app, the Burrow tunnel service we operate, and related support. Contact burrow@mawa.dev for privacy questions and requests.
If you self-host Burrow, you control that installation and its data practices. If you visit someone else’s tunnel, the owner of the exposed application is responsible for what that application collects; their privacy information also applies.
02Traffic through a tunnel
Burrow relays HTTP and WebSocket traffic between a public URL and the local service its owner exposes. Requests and responses can contain URLs, headers, cookies, credentials, form submissions, files, and other content chosen by the application and its visitors.
The hosted service terminates TLS and processes traffic to relay it. It is not end-to-end encryption that hides HTTP content from the service operator or its hosting infrastructure. HTTPS protects supported network connections; it does not make a public tunnel private.
Anyone who can reach a tunnel’s public URL can interact with the exposed service, subject to that application’s own authentication and controls. Burrow owner credentials protect tunnel management, not access to your application.
03Connection and request information
- Ownership: the CLI creates an owner credential without requiring an account. It stores credentials locally by server origin; the server uses an owner hash to bind and authorize tunnels.
- Connection records: tunnel identifier, local port, connection/generation state, timestamps, and transfer information needed to operate the tunnel.
- Request history: bounded entries containing an opaque entry ID, time, method, path, response status, size, duration, and network address. The current request-history records do not store request/response bodies, authorization headers, cookies, or query strings.
- Operations and support: technical logs, security information, and messages you send us. Hosting infrastructure may process network addresses and request metadata separately from the tunnel history.
A path can still contain personal or confidential information. Avoid embedding secrets in URLs and use test data appropriate for the service you expose.
04Why information is used
We process this information to connect and route tunnels, authenticate management requests, display owner-scoped history and status, prevent URL takeover, investigate abuse, troubleshoot failures, and provide support. Where a legal basis is required, it can include providing the requested service, legitimate operational/security interests where permitted, and legal obligations.
The application does not provide other owners with your management history. Server operators and infrastructure providers can process information needed to run the service. We do not sell tunnel content or use it for advertising.
05Retention and closing a tunnel
The current server keeps at most 200 request-history entries per tunnel. Active connection records have a refreshed 24-hour expiry; a disconnected connection’s metadata and history are retained for a 20-second reconnection grace period. Closing a tunnel clears its history and permanently revokes its identifier.
A minimal identifier reservation with its owner hash and closure state is retained without automatic expiry to prevent a previously shared URL from being reassigned to someone else. This is separate from traffic content and request history. Infrastructure logs, support records, and any provider backups have their own operational retention.
You can close a tunnel through the CLI and remove locally stored configuration when no longer needed. Contact us about personal information, retained ownership records, or provider-held data. Do not send the owner credential in an email. A request may require proof of control and may be subject to security or legal retention exceptions.
06Providers and disclosure
The hosted service uses DigitalOcean for application infrastructure, Upstash for Redis, and Cloudflare for domain/DNS services. The marketing website uses Vercel hosting and Web Analytics. Information is processed by these providers to carry out their roles and may be processed outside your country.
Traffic is also delivered to the tunnel owner’s application and any recipients that application selects. We may disclose information where necessary for a lawful request, rights or safety, professional advice, or a business transfer subject to applicable protections.
07Website analytics and demos
Vercel Web Analytics measures aggregate page visits, referrals, and broad device/region information without tracking cookies. We do not send tunnel traffic or request-history content as website analytics. Hosting can separately process IP addresses, URLs, browser details, and request times.
The terminal previews contain example data, not live tunnels or customer traffic. Their selections stay in the page. Copy controls write the displayed text to your clipboard only when selected; they do not read your clipboard. Fonts and artwork are served with the website.
08Your choices and rights
You choose which local service to expose and when to close it. Protect the exposed application appropriately and tell its visitors how their information is used. Self-hosting lets you choose your own infrastructure and retention configuration.
Depending on your location, you may have rights of access, correction, deletion, portability, objection, restriction, withdrawal of consent, or complaint to a privacy authority. Contact us to exercise these rights; we may verify control and explain lawful exceptions. If you believe a child’s personal information has been submitted without required authorization, tell us.
09Security and updates
We use authenticated management access, owner-scoped records, protected credentials, and encrypted supported connections. No service can guarantee complete security. Report suspected exposure privately to burrow@mawa.dev.
We update this policy as the service changes, show the effective date, and provide notice or obtain consent where required.