ngrok

Privacy Policy Overview

> Important scope limitation: This Policy applies to visitors to ngrok.com/ngrok.ai and prospective or potential customers. It expressly says it does not apply to users operating under an ngrok account; their separate agreement governs. The document also contains incomplete sections and blank contact/opt-out links, which may make some procedures unclear.

1. Data Collection and Use

Information collected

ngrok may collect:

• Identity and contact data: name, username/alias, email, postal address, and phone number.
• Professional and demographic data: job title, employer, city, state, and country.
• Content and communications: files or content uploaded to the Services, emails, and other communications.
• Technical and usage data: cookies, web beacons, device identifiers, IP address, pages visited, links clicked, app or website activity, and similar usage information.
• Location and inferred data: approximate location based on IP address, likely preferences, and other characteristics generated through automated analysis.
• Third-party data: information from affiliates, marketing/research partners, and integrations, including contact, demographic, employment, authentication, and content information.

Some data is collected through cookies, mobile advertising IDs, analytics tools, embedded content, and email tracking pixels.

Purposes

The Policy indicates data may be used to:

• Provide, operate, authenticate, and improve Services;
• Maintain and update customer records;
• Analyze website and app performance;
• Store preferences and enable sign-in;
• Communicate with users, including marketing and service notices;
• Develop inferences and tailor advertising;
• Detect fraud and protect security;
• Identify potential customers and support marketing;
• Meet legal, contractual, and legitimate business purposes.

Retention is not stated as a fixed period. ngrok keeps data as long as it considers necessary for services, legal obligations, disputes, agreement enforcement, and other business purposes. Retention can therefore vary substantially.

2. User Rights and Controls

Depending on location, users may be able to:

• Access, correct, delete, or obtain a portable copy of their data;
• Withdraw consent or object to, or restrict, certain processing;
• Opt out of promotional communications;
• Control advertising cookies through the cookie banner, browser settings, Global Privacy Control, or partner opt-out tools;
• Appeal a denied privacy request;
• File a complaint with a European supervisory authority.

California residents may additionally have rights to know, correct, delete, opt out of “sale” or “sharing,” limit certain sensitive-data uses, use an authorized agent, and avoid discrimination for exercising rights.

Requests may be denied where ngrok cannot verify identity, must retain data by law, would affect another person’s rights, reveal confidential information, or are excessive or otherwise legally permitted.

3. Third-Party Sharing

ngrok shares data with or permits collection by:

• Analytics and advertising companies, including Google;
• Marketing and research partners;
• Event, webinar, and engagement providers;
• Integration and authentication providers;
• Affiliates and service providers;
• Third parties involved in linked or embedded services.

Analytics and advertising partners may combine identifiers, browsing activity, device data, geolocation, and inferences across multiple websites. Some disclosures may qualify as a California “sale” or “sharing.” Opting out may stop certain future sharing, but does not necessarily undo prior sharing or eliminate all interest-based advertising.

ngrok may also disclose de-identified information and respond to lawful U.S. government requests, including national-security or law-enforcement requests. Data may be processed primarily in the United States or other countries.

4. AI/ML Training

The Policy does not expressly state whether personal data, uploaded content, communications, or usage data is used to train artificial-intelligence or machine-learning models. It does mention automated inferences and ngrok.ai, but that is not the same as authorizing AI training. Users should seek clarification, particularly before submitting confidential files, code, or communications.

5. Key User Obligations

Users should:

• Provide information only where they are comfortable doing so;
• Understand that refusing necessary data may make features unavailable;
• Use a strong, unique password and never share it;
• Review third-party privacy policies before using integrations, links, events, or embedded services;
• Manage cookies and advertising choices separately on each device and browser.

6. Liability and Disputes

This Policy contains no detailed warranty disclaimer, liability cap, governing-law clause, arbitration provision, or dispute procedure. It is incorporated into ngrok’s separate Terms of Use, which likely control those issues. The Policy does state that ngrok takes “reasonable and appropriate” security measures, but it does not guarantee absolute security.

For EU/UK/Swiss data transferred under the Data Privacy Framework, unresolved complaints may proceed through regulators and, in some circumstances, binding arbitration.

7. Changes

ngrok may revise the Policy for changes in services, data practices, or law. It will post the revised version with a new effective date. For material changes, it will provide additional notice or obtain consent only where legally required. Users are responsible for checking the Policy periodically.

Terms of Service Overview

*This summary is informational, not legal advice. The Terms incorporate ngrok’s separate Privacy Policy and Data Processing Agreement (DPA), which contain important additional details not included here.*

1. Data Collection and Usage

ngrok may collect, retain, use, and disclose:

• Account and registration information, such as contact and payment details.
• Customer Data submitted by you or on your behalf, including information transmitted through ngrok tunnels and data relating to your users.
• User Content, such as posts, messages, communications, images, comments, personally identifiable information, and other material submitted through interactive features.
• AI Inputs and Outputs, including prompts, queries, and generated responses.
• Technical information, including the IP address of the ngrok Agent. On free services, the Agent’s IP address may appear in assigned hostnames or HTTP response headers, potentially making it visible in connection with requests.

ngrok may use Customer Data to provide and improve your use of the Services and may use aggregated and anonymized Customer Data to improve the Services generally. It may also access or disclose data to comply with law, enforce the Terms, respond to legal or rights claims, provide support, or protect ngrok, users, or the public.

You are responsible for ensuring that you have all necessary notices, consents, and permissions to provide data to ngrok. EU users must not include GDPR “sensitive personal data” in Customer Data under these Terms.

2. User Rights

The Terms state that:

• You retain ownership of Your Content—non-public content submitted through the Service—and ngrok receives only a limited license to use it as needed to provide the Services.
• You own AI Inputs and Outputs as between you and ngrok.
• You may cancel your Services, but prepaid fees generally are not refundable.
• You may reject substantive Terms changes by stopping use and terminating your account during the notice period.

The Terms do not themselves provide detailed rights to access, correct, delete, export, or restrict processing of personal data. Those rights, if available, are governed primarily by the Privacy Policy, DPA, and applicable law.

A significant distinction applies to User Content intended for public display: you grant ngrok a worldwide, perpetual, irrevocable, transferable, royalty-free license to use, modify, distribute, sell, display, perform, and otherwise exploit it for any purpose. User Content is also expressly excluded from being confidential.

3. Third-Party Sharing

ngrok may disclose data:

• To comply with legal process or applicable law.
• To enforce the Terms or investigate alleged infringement.
• In response to support requests.
• To protect rights, property, safety, or the public.
• Through third-party AI providers when AI Features are used.

If you connect your ngrok account to a third-party AI provider account, the provider’s separate agreement governs use of Inputs and Outputs. You are responsible for third-party AI usage charges, whether billed directly or passed through ngrok.

The Terms also permit ngrok to use your name and logos in customer lists and marketing materials during the Agreement, subject to any written trademark guidelines you provide.

4. AI/ML Training

ngrok says it will not use AI Inputs or Outputs to train or otherwise improve its AI Features, except for your benefit.

However:

• This protection may not apply in the same way when you connect a third-party AI provider account; that provider’s terms control.
• AI Outputs may be inaccurate, incomplete, outdated, or similar to outputs given to others.
• You must independently review Outputs.
• You may not use the AI Features or Outputs to train or improve separate AI/ML models.
• AI may not be used for legally significant automated decisions without adequate human review and legal compliance.

5. Key User Obligations and Restrictions

You are responsible for:

• All activity under your account, including activity by representatives, contractors, agents, and Customer Licensees.
• Securing passwords, tokens, and access credentials.
• Promptly reporting unauthorized access.
• Ensuring all use complies with law and the Terms.
• Preventing disruption of ngrok’s Services or connected networks.
• Ensuring your content does not infringe rights or contain unlawful, malicious, obscene, threatening, defamatory, or deceptive material.

You may not copy, reverse engineer, modify, resell, lease, scrape, compete with, or create derivative works from the Services or Site Materials. Distribution of the ngrok Agent to customers with their own ngrok accounts requires prior written consent.

6. Liability and Disputes

ngrok provides the Services and AI Features “as is” and “as available,” without guarantees of uninterrupted, secure, accurate, or error-free operation.

To the maximum extent permitted by law, ngrok excludes liability for data loss or corruption, lost profits, substitute services, indirect or consequential damages, and AI-related losses. Total liability is capped at the greater of $100 or fees paid/payable in the six months before the event.

You must indemnify ngrok for third-party claims arising from your breach, use of the Services, legal violations, or content transmitted through your tunnels.

California law governs. Lawsuits must generally be filed in state or federal courts in San Francisco, California. Claims must be brought within one year.

7. Changes and Termination

ngrok may change the Terms. It will post the latest revision date and provide dashboard notice for substantive changes, with at least seven days’ notice before effectiveness. Notice may also be sent by email, mail, or website posting.

ngrok may immediately suspend or terminate access, without prior notice, for any reason, including breach. Surviving provisions include ownership, disclaimers, indemnification, and liability limits.