Privacy

Privacy policy

PassTunnel does not collect any information about you. Your profiles, passwords and TOTP secrets stay on your device, and the apps connect only to the VPN servers you set up and, on the Mac, to GitHub to check for updates and, when you ask, to Apple’s time server.

Last updated:

In short

  • No accounts, analytics, ads, tracking or crash reporting.
  • Passwords and TOTP secrets are stored only on your device, protected by the system’s Keychain or Keystore.
  • Your credentials go only to the VPN servers in your profiles.
  • The code is open source, so all of this can be checked.

Who publishes PassTunnel

PassTunnel is free, open-source software under the MIT license, published by Furkan Parlak. The source code is on GitHub. The project has no servers of its own and no user accounts.

What this policy covers

  • PassTunnel for Mac, the app and its passtunnel command-line tool.
  • PassTunnel for Android, a VPN client for OpenVPN profiles, and PassTunnel for iPhone, a companion app for profiles and one-time codes. Both are in development; this policy describes how they are designed and will be updated if that changes.
  • This website, passtunnel.github.io.

Information collected

None. The apps contain no analytics, advertising, tracking or crash-reporting code, and nothing you enter in them is sent to the project. There is nothing to sell or share, and nothing is.

What stays on your device

Mac

  • Passwords and TOTP secrets are stored in your login Keychain. They are not synced to iCloud Keychain; like the rest of the login keychain, they are included in your Mac’s backups and moved by Migration Assistant. With Confirm with Touch ID turned on for a profile, they are encrypted with a key that never leaves the Mac’s Secure Enclave.
  • Profiles and settings are files in ~/Library/Application Support/PassTunnel, readable only by your user account. They contain no passwords or TOTP secrets, but an OpenVPN configuration may contain certificates and keys from your VPN provider.
  • Connection logs (vpn.log, one per profile, in the same folder) start empty for every connection and are trimmed when they grow past 5 MB. They contain server names, your user name and IP addresses, but not your password or one-time codes: the VPN tools receive them in files only the system can read and run at a log level that does not record them. When the MCP server or passtunnel log --json returns a log, values that look like credentials are masked as well.
  • Copied codes stay on this Mac (no Universal Clipboard), are marked so clipboard managers skip them, and are cleared after 1 minute (or 30 seconds or 2 minutes, as you choose in Settings) unless something else was copied meanwhile.

Android

  • Passwords and TOTP secrets are encrypted with a key held in the Android Keystore. The app’s files are in its private storage and excluded from backups.
  • Profiles that ask for confirmation use a key that works only after strong biometrics, such as your fingerprint, or your screen lock.

iPhone

  • Passwords and TOTP secrets are stored in the iPhone’s Keychain as items that stay on this device. They are not synced through iCloud or with the Mac.
  • Face ID or Touch ID can be required per profile, and copied codes are kept on the iPhone and expire when the code does.

No app writes secrets to its logs. Deleting a profile in the Mac app removes its files and its Keychain items.

Network connections

Mac

  • Your VPN servers. The bundled openvpn and openfortivpn connect to the servers in your profiles. Your user name, password and one-time code are sent only there.
  • Checks you set up. If you give a profile a health check host, the app pings it or opens a connection to it every 30 seconds while that profile is connected. Fetch fingerprint in the FortiGate editor reads the certificate of the gateway you entered.
  • Clock checks. One-time codes are worked out from your Mac’s clock, so a clock that is off makes the codes wrong. When a FortiGate gateway rejects a sign-in, PassTunnel asks that same gateway once what time it is: one request over an encrypted connection that trusts the gateway exactly as the VPN does, with no user name, password, code or cookie in it. It does this only after a rejected sign-in, never at other times, and never with an OpenVPN server. Apple’s time server (time.apple.com, which macOS also uses to set its clock) is asked only when you ask for it, with the “Check the clock” button in the app, passtunnel diagnose --check-clock or through the MCP server’s diagnose tool with check_clock. That request carries nothing about you, not even your Mac’s time. The last result is kept in the profile’s folder on your Mac.
  • Updates. The app checks for a new version once a day by downloading a signed update feed from the project’s releases on github.com, and downloads an update only when you click Install. GitHub receives these requests like any other web request, under GitHub’s own privacy statement. You can turn the daily check off in Settings → Updates.
  • The MCP server (passtunnel mcp) runs on your Mac, started by the MCP client you set up, and talks only to that client over standard input and output; it opens no network port. What its tools return (profile names, server names, user names, IP addresses and log lines, never passwords, TOTP secrets or codes) goes to that client and the AI assistant behind it, and so to that assistant’s provider.

Android

The app makes no network connections of its own. Its VPN connects only to the servers in your profiles.

iPhone

The app makes no network connections. The VPN connection is made by the VPN app you already use; when you share a profile’s configuration with it, the configuration goes without your credentials.

Permissions

Android

  • VPN. Android asks you to allow PassTunnel to set up a VPN connection, which it uses only for the profiles you connect.
  • Camera, only when you choose to scan a TOTP QR code. You can import the code from an image instead. QR codes are read on the device.
  • Fingerprint, face or screen lock, only for profiles you set to ask for confirmation.

iPhone

  • Camera, only when you choose to scan a TOTP QR code. You can pick a photo instead.
  • Face ID or Touch ID, only for profiles you set to ask for it.

Mac

  • A privileged helper that you approve once in System Settings → General → Login Items; it starts the VPN tools.
  • Notifications, for dropped connections and similar events, shown on your Mac only.
  • Accessibility, requested only if you turn on auto-type (off by default).
  • Screen Recording, only if you use Scan QR on screen and macOS does not let PassTunnel capture the window or display you pick in the system’s picker, which needs no permission. PassTunnel says why before macOS asks. Either way, the picture is read for the QR code in memory and is never saved or sent.

This website

The site is a set of static pages hosted on GitHub Pages. It uses no cookies, analytics or trackers and loads nothing from other sites. If you pick a color theme, the choice is saved in your browser and never leaves it. GitHub serves the pages under its own privacy statement.

Children

PassTunnel is a tool for connecting to VPNs and is not directed at children. It collects no information from anyone, including children.

Changes to this policy

This policy is part of the project’s public repository, and every change to it is visible in the history of this page. The date at the top shows when it last changed.

Contact

For questions about this policy, open an issue on GitHub. To report a security problem privately, follow the security policy.