Warplet

Privacy Policy

1. Introduction

Warplet ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you use our macOS app, website, tunnel provisioning service, and related services.

2. Information We Collect

We collect:

• Device and tunnel metadata: a random device public ID, optional device name, assigned hostname, Cloudflare Tunnel ID, DNS record ID, last proxy port, client version, and timestamps.
• Subscription data: your RevenueCat app user ID, entitlement status, product identifiers, purchase and expiration metadata, and the Warplet device IDs attribute used to link your subscription to provisioned devices.
• Operational data: server logs, error information, request metadata, and Cloudflare observability data needed to run, secure, debug, and improve the service.
• Website and network metadata: standard data processed by Cloudflare when you visit Warplet pages or when traffic passes through Cloudflare Tunnel, such as IP address, user agent, hostname, timing, and security metadata.

We DO NOT collect:

• Your local MCP server configurations stored in the macOS app.
• Your local proxy bearer token through the Warplet provisioning API.
• MCP server request or response bodies in the Warplet provisioning database.
• Hardware identifiers tied to your Mac; the app uses a random public ID generated on first launch.

The macOS app may show recent request logs on your device, including method, path, status, timing, and a short JSON summary such as a JSON-RPC method name. Those local logs stay on your Mac unless you choose to share them.

3. How We Use Information

We use data for:

• Provisioning and reusing Cloudflare Tunnels and DNS records for your device.
• Verifying subscription access and enabling paid Warplet features.
• Operating, securing, debugging, and improving Warplet.
• Preventing abuse, enforcing service limits, and managing infrastructure cost.
• Responding to support, privacy, and deletion requests.

We do not:

• Use your data for AI model training.
• Sell your personal information.
• Use your MCP traffic content for advertising.

4. Third-Party Services

We use the following third-party services:

• Cloudflare: for hosting the Warplet Worker, D1 database, DNS, Cloudflare Tunnel, edge routing, security, logs, and observability.
• RevenueCat: for subscription status, offerings, purchases, restores, customer information, and entitlement checks.
• Apple App Store: for in-app purchase processing, subscription management, refunds, and App Store distribution.

These services may process information according to their own privacy policies. The AI clients and MCP servers you connect through Warplet are also separate services with their own privacy practices.

5. Data Storage and Security

• Data location: Warplet device and tunnel metadata is stored in Cloudflare D1. Subscription data is processed by RevenueCat and Apple.
• Security measures: Warplet uses HTTPS, bearer token authentication for tunneled MCP requests, Cloudflare-managed TLS, and server-side Cloudflare credentials that are not shipped in the macOS app.
• Bearer tokens: Anyone who obtains your Warplet bearer token may be able to authenticate to your public tunnel URL and access the local MCP servers you have exposed through Warplet. You are responsible for keeping bearer tokens, tunnel URLs, and connected AI client configurations secure.
• Tunnel tokens: Warplet returns the per-device Cloudflare Tunnel connector token to the macOS app but does not store that token in D1.
• Retention: Device and tunnel metadata is retained while needed to provide stable hostnames and service functionality, unless deletion is requested and we no longer need it for legitimate operational, legal, or security reasons.

6. Your Rights

You have the right to:

• Request access to personal information associated with your use of Warplet.
• Request correction or deletion of your Warplet service data.
• Request export of data we can reasonably associate with you.
• Manage or cancel subscriptions through your Apple App Store account.
• Lodge complaints with relevant supervisory authorities where applicable.

7. International Users

For EU/EEA and UK residents:

• You may have rights to access, correct, delete, restrict, or object to processing of your personal data.
• You may have the right to data portability.
• You may withdraw consent where processing is based on consent.
• You may complain to your local data protection authority.

For California residents:

• You may have the right to know what personal information is collected.
• You may have the right to request deletion or correction of personal information.
• You may have the right to opt out of sale or sharing of personal information. We do not sell personal information.
• You have the right to non-discrimination for exercising privacy rights.

8. Children's Privacy

Warplet is not directed to individuals under 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

10. Contact Information

If you have questions about this Privacy Policy, contact us at:

Email: hello@warplet.app

Last updated: 2026-05-20