synous.dev

Privacy policy

This policy explains how Synous handles data when you create a tunnel, visit a public route, or use the dashboard.

Effective September 11, 2026

Summary

Keep secrets out of URLs.

Recent request records include query strings. Anyone who knows an active public URL can reach it unless the local service requires authentication.

Data Synous handles

SSH tunnels

Synous handles your GitHub username, any SSH public key you offer, and the public keys that GitHub publishes for your username. When an offered key is unknown, Synous temporarily stores the public key, fingerprint, SSH username, source IP address, and client version while you approve or deny it in the browser. When no public key is offered, Synous temporarily stores the SSH username, source IP address, and client version for the same purpose. Choosing 24 hours, 30 days, or Forever stores an offered public key and its GitHub-account association for later tunnel authentication; Once and no-key approvals do not.

While your route is active, Synous records the public hostname, connection time, SSH source IP address and port, SSH client version, any public-key type and fingerprint, and the latest round-trip-time sample.

Synous doesn’t receive or store your SSH private key.

Public routes

Synous processes request and response headers and bodies while it proxies them between a public client and the tunnel operator’s local service.

For each active route, Synous keeps up to 100 completed request records. Each record contains the time, HTTP method, full request URI including the query string, client IP address, response status, duration, and request and response byte counts. The records don’t contain headers or bodies.

Dashboard and logs

GitHub OAuth gives Synous your GitHub username. Synous requests no additional OAuth scope. During sign-in, Synous uses the OAuth access token to call GitHub’s /user endpoint. Synous doesn’t put the token in its session cookie or store it in an account database.

The service administrator can view active route metadata and aggregate traffic. If the administrator opens another operator’s detailed route view, Synous logs the administrator’s GitHub username, the operator viewed, and the administrator’s source IP address.

Synous writes operational events for service lifecycle and failures. Hosting infrastructure might also create network or system logs.

Website

The homepage, docs, and dashboard load JetBrains Mono from Google Fonts. A browser that opens these pages might send its IP address, user agent, and request metadata to Google. The website doesn’t use analytics.

Use and sharing

Synous uses data to authenticate users, assign and route temporary endpoints, forward traffic, show live route information, enforce capacity, diagnose failures, update the service, and audit administrator access.

The following parties receive data as part of the service:

Tunnel operator
The operator receives the full requests sent to the active route and can independently log or retain them in the local service.
GitHub
Synous requests public SSH keys from GitHub and uses GitHub OAuth for dashboard sign-in.
Google Fonts
A browser can request font styles and files from Google when it opens the homepage, docs, or dashboard.
Service administrator
The administrator can view active route metadata and aggregate traffic. Access to another operator’s detailed route view creates an audit event.

Retention

DataExpiration and deletion
GitHub public-key lookups Up to five minutes in a bounded memory cache, including results that don’t find a user.
Pending SSH authorization Stops accepting a decision after 10 minutes. After approval, the GitHub owner, selected decision, terminal tunnel result, and connected public hostname (if any) remain available for browser status reporting for up to 10 minutes after the decision. No-key authorization supports only Once or Deny. For an offered key, if persistent-key publication is interrupted, the decision remains until recovery or the selected 24-hour/30-day association expires; a Forever decision remains until recovery completes. Expired records are deleted during startup or a later authorization operation.
Browser-approved SSH key association Stops authorizing after 24 hours or 30 days, or when revoked for Forever, according to the choice made during authorization. Expired records are hidden from key listings and deleted when that key is next checked or the association is updated. Revoked records are deleted immediately.
Active route and SSH metadata For the tunnel’s lifetime. A protected runtime file supports graceful updates and is removed when the route ends.
Counters and recent requests For the route’s lifetime, with at most 100 completed request records per route.
SSH status output Up to 128 queued lines in memory. Synous doesn’t replay them after disconnect.
OAuth state cookie 10 minutes.
Dashboard session cookie 12 hours or until you sign out.
Private route state cookie 5 minutes.
Private route session cookie 12 hours. Synous rejects it sooner if the active route ID changes or the route ends.
Operational and audit logs 30 days.

Cookies

Synous uses four kinds of first-party cookies: two on the dashboard origin and up to two on each private route origin. All four kinds are Secure, HttpOnly, use SameSite=Lax, apply to /, and have no Domain attribute, so each cookie is host-only.

__Host-synous-oauth-state
Protects the GitHub OAuth redirect against cross-site request forgery. When sign-in starts from an SSH authorization page, it also contains the local path to reopen after sign-in. It expires after 10 minutes.
__Host-synous-session
Contains a signed GitHub username and expiration time. It expires after 12 hours and isn’t an advertising or analytics identifier.
__Host-synous-auth-state
Binds a private-route sign-in grant to the browser that requested access. It expires after 5 minutes.
__Host-synous-route
Contains a signed GitHub username, route ID, and expiration time for one private route origin. It expires after 12 hours, and Synous rejects it if the active route ID changes or the route ends.

Before forwarding a public or private request, Synous removes every cookie whose case-sensitive name starts with __Host-synous-. The tunnel operator receives the trusted private-route identity headers instead. Other application cookies still reach the local service.

When a local service returns a valid Set-Cookie header with a Domain that matches the public route, Synous removes Domain before returning the response. That makes the HTTP-set cookie host-only to the exact route hostname. Synous drops malformed cookies, unrelated-domain cookies, and cookies using the reserved __Host-synous- prefix. This rewriting can’t intercept JavaScript calls to document.cookie; while routes share synous.dev, route applications must not set Domain=synous.dev.

Generated hostnames can be reassigned after their 10-minute hold. Application cookies or other browser storage retained for an exact generated hostname might therefore reach a later tunnel if the browser revisits it. A retained Synous route cookie can’t authenticate to the later tunnel because each session is bound to the active route ID.

You can use public routes and docs without Synous cookies. Blocking cookies prevents dashboard and private-route GitHub sign-in and homepage personalization but doesn’t prevent SSH authentication or private-route HTTP Basic authentication.

Choices and security

Public clients use HTTPS, and traffic between the Synous edge and your local service travels through the authenticated SSH tunnel. Synous signs dashboard and private-route session cookies and prevents browser scripts from reading them. A signature prevents modification; it doesn’t encrypt the cookie or prevent replay if someone copies a valid, unexpired value.

Synous will update this policy when its data handling changes. For privacy questions, contact the maintainers through the Synous GitHub repository. Don’t post sensitive information in a public issue.