Groundhog
Developer documentation

Groundhog privacy information

Version: preview-privacy-1

Date: 2026-10-10

Groundhog's hosted service is operated by Unifinity Software Corporation. This information explains how Groundhog works with account information, tunnel traffic, diagnostics, and support reports. It covers https://groundhog.unifinity.com and its hosted tunnels. It does not describe the independent privacy practices of applications developers expose through a tunnel or a separately operated Groundhog service.

Company website: https://unifinity.com. Privacy questions and requests: support@unifinity.com.

1. Your account and workspace

Groundhog uses an external sign-in provider. After sign-in, the service receives identity information used to recognize your account, such as the provider's issuer and account identifier, your display name, your email address, and email-verification information when supplied. Groundhog's dashboard delegates provider sign-in rather than asking you to enter the provider's password into a Groundhog form.

The service associates that identity with workspace membership and permissions. Workspace records can include the workspace's name and URL slug, member roles, who created or invited a member, and relevant timestamps. Free-workspace registration records the workspace you created and the terms version and time you accepted, and uses an account-linked registration record to enforce the one-self-created-workspace rule.

Workspace membership is a sharing boundary. Other members of your workspace can see membership information, including display names and email addresses when available, and can view the workspace's tunnel diagnostics. Permission to manage a tunnel or change body capture is more restricted than permission to inspect workspace diagnostics. Invite only people you intend to share that workspace information with.

2. Your tunnel and connection key

A tunnel record includes its name, workspace association, public address information, creator information where available, settings such as body capture, and relevant timestamps. Its hostname is public; knowing the hostname does not require a visitor to have a Groundhog account.

A new connection key is shown once. Groundhog's stored connection-key record contains a SHA-256 hash used to verify a client, rather than the original key. Key records also track information needed to associate the key with a tunnel and recognize revocation. The client presents its key when connecting, so keep it private even though the stored verification value is hashed.

The service can record connection state, connection/disconnection times, and client package/version information to show tunnel status, gaps, and update guidance. A tunnel's name and its connection key do not authenticate visitors to the application you expose; the application must provide its own access controls.

3. Visitor requests and responses

When a visitor opens a public tunnel address, Groundhog receives the request and forwards it to the connected app on the developer's computer. It also handles the app's response on its way back to the visitor. This processing can involve the request URL, headers, cookies or other credentials sent to the exposed application, request and response bodies, and connection information.

Public HTTPS protects a connection in transit but does not make the hosted relay unable to process the traffic it forwards. Groundhog is not an end-to-end encrypted private network between a visitor and the developer's computer. Developers should use synthetic test data and avoid exposing production credentials, confidential datasets, or sensitive personal information through a public preview tunnel.

The exposed application may separately collect information, maintain its own logs, or use other services. Its developer is responsible for its privacy notices and lawful use of that information. Groundhog's logging controls do not control what the exposed app records.

4. Request diagnostics, usage, and body capture

Groundhog's request diagnostics can include a request identifier, completion time, method, path, tunnel hostname, visitor network address, status code, duration, byte counts, forwarding errors, and selected request and response headers. The recorded request path omits its query string. Usage records include request counts, status counts, and bytes transferred, summarized over time for tunnels and workspaces.

Before storing diagnostic header values, the implementation redacts values for certain sensitive header names, including authorization and cookie headers, and header names containing terms associated with secrets. It removes query strings and fragments from selected URL-valued headers. Header counts and value lengths are bounded.

These measures reduce the information stored in diagnostics; they do not guarantee that every secret, personal detail, or sensitive value will be recognized. A secret placed in a path, an unexpected header, or an application's body can still be exposed through diagnostics or through the app itself.

When an authorized user enables body capture for a tunnel, diagnostics can keep bounded prefixes of eligible text-like request and response bodies. Capture is not a complete archive of every body, and truncation is not a privacy guarantee. Keep capture off unless it is needed and you are authorized to collect the information. Turning it off affects subsequent capture; it does not by itself erase earlier diagnostics.

Members with access to a workspace can inspect its available request diagnostics. Workspace owners and tunnel creators have additional controls for the tunnels they are allowed to manage. The service scopes workspace data access by workspace; a public tunnel visitor does not receive dashboard access merely by opening the public address.

5. Browser storage and client-side secrets

The dashboard uses cookies to maintain a signed-in session and protect state-changing requests. The sign-in process also uses the provider's sign-in flow. Browser storage can remember interface preferences such as the selected theme and a local port used to fill in a CLI command. Remembering that port does not send it to the relay as tunnel configuration.

The website's one-time key reveal does not intentionally persist the displayed connection key in browser storage. If you save a key yourself, your password manager, shell, editor, or development tools govern that copy. Aspire's Save to user secrets option stores values on your computer outside the repository; user secrets are not encrypted. Groundhog cannot erase a copy you put in another tool or location.

Removing browser preferences or stopping a client does not delete the service's account, workspace, usage, or diagnostic records.

6. Support, privacy requests, and abuse reports

If you email support@unifinity.com, your message provides information such as your reply address, message contents, and any attachments you choose to send. This contact is used for service questions, privacy requests, and suspected abuse. Report instructions are available at Report abuse.

Include only what is needed to explain your request. Do not send a connection key, password, authorization header, unredacted private request body, or unnecessary personal information. For an abuse report, a public hostname, observation time with timezone, explanation, and safely redacted evidence are usually more useful than a full traffic capture.

You may contact us about access to, correction of, or deletion of information associated with your account, or to raise a privacy concern. We may need enough information to verify your identity and locate the relevant record before responding. Do not send identity documents or secrets unless a verified, appropriate process specifically requires them. The response must account for applicable rights and any lawful obligations concerning the requested information.

7. Access, retention, and deletion boundaries

Our retention periods are:

The operator and team monitor the support mailbox daily. These are separate record categories; do not assume they all expire with a request diagnostic.

Stopping your client disconnects forwarding. Deleting a tunnel invalidates its key and releases its name. Neither action means every associated account, usage, diagnostic, support, or enforcement record is immediately deleted. Removing a workspace member removes their workspace access; it is not a promise that every historical record about that membership is erased.

Information may need to be handled by people and services involved in operating Groundhog, providing sign-in, hosting/storage, support mail, responding to security incidents, or complying with applicable legal obligations. The fact that a platform administrator can perform an enforcement action does not itself grant general access to read another workspace's traffic through the dashboard.

For questions about a particular record, retention arrangement, or deletion request, contact support@unifinity.com. This disclosure does not promise that traffic is never logged, that every record is anonymous, that data stays in a particular country, or that stopping a tunnel automatically deletes all information.

8. Changes and contact

Material changes to this information will be identified with an updated version and date. Any notice or consent required by applicable law must be provided before changes that require it. A change to this disclosure is not permission to disregard earlier privacy commitments.

Privacy questions, requests, or concerns: support@unifinity.com.

Operator: Unifinity Software Corporation — https://unifinity.com.