Privacy Policy

AI processing and service providers

To answer you, Tunneltunnel and the model service process your prompt, relevant conversation context and any selected files in readable form. For saved chats, your browser supplies a conversation key so the server can decrypt context and encrypt the generated reply for storage. This is not end-to-end encryption that keeps content hidden from Tunneltunnel or the model during processing.

• Depending on the model and enabled features, requests use OpenAI, Anthropic, Google Gemini, Mistral, or a configured hosted model service. TunnelAI also requires server-side processing; its name does not mean the model runs on your device.
• Safety checks can send text or images to OpenAI moderation, including when another model is selected. Image generation, voice transcription and web search may use additional services. Voice input uploads audio for transcription; web search sends queries derived from the conversation to a search service.
• Encryption is not a guarantee of automatic anonymization, zero logs, zero provider retention or exclusion from model training. Avoid including unnecessary personal or confidential information in prompts, files and recordings.

Reporting AI responses

You can report an AI response from its Report response control. Reports contain the category you choose, your account reference, message/model references, submission time and any explanation you enter. Response text is included only if you choose to share an editable excerpt. A separate, initially unchecked option lets you share the whole available conversation text, including your own messages, as a readable report copy. You can preview it before sending. This includes older saved messages, not just the current screen; unsaved chats include the history still available in this session. Deleted messages cannot be recovered. Images, files and encryption keys are not attached. History sharing fails rather than silently truncating if the chat exceeds 2,000 messages or 1,000,000 transcript characters, or cannot be fully decrypted.

Report text is stored in readable form for safety review, separately from encrypted chat history. Administrators can review reports; review records include a status, review note, reviewer account reference and review time. Deleting a chat does not delete its report. Account deletion removes account-linked report records from the primary database; backups, logs and external services require separate handling. Contact us about report retention or deletion.

Request account and data deletion

Open the account-deletion request page for email instructions, data covered and subscription-cancellation steps.

You can start account deletion from Settings. You can also request deletion of your Tunneltunnel account and associated data without signing in or reinstalling the app by emailing [email protected]. Send the request from your account email where possible. We may need to verify account ownership; do not send your password, recovery phrase or payment-card details.

If you subscribed through Google Play, cancel that subscription in Google Play as well: deleting your Tunneltunnel account does not currently cancel Play billing. Contact us if you cannot complete these steps. Stripe subscriptions are canceled as part of the in-app deletion flow; if cancellation or cleanup cannot be confirmed, the app reports an error and lets you retry.

Deleting an account or conversation is not a promise of immediate erasure from every backup, log or external service. Contact us for questions about your data, retention or the status of a deletion request.