Privacy

Two planes

nthbouncer is two apps. The control plane at nthbouncer.com is the source of truth for organizations, pools, keys, and billing. The data plane on Cloudflare Workers is the door callers hit (*.nthpool.cloud).

What we store in the dashboard

When you create an account we keep your name, email, and a hashed password or passkey. Organizations hold pool config, key labels, invitations, and billing state. You can delete an organization or your account from the dashboard.

We do not store managed upstream credentials in the dashboard. Not even a hash.

Upstream credentials

You can give a pool an origin secret so callers never hold it. The secret is encrypted at the edge and decrypted only inside an isolated sandbox when the pool reaches your origin. Callers authenticate with a pool key. They never receive the origin secret.

Rotate a credential from Credentials and every attached pool picks up the new secret.

Access logs and metrics

We log pool traffic. Every request through a pool produces an access log entry, including admits and rejects. Nothing consumes a slot silently.

A typical HTTP entry includes timestamp, method, path and query (truncated), host, content type, length, status, outcome, timing, occupancy, caller IP, referer host, a truncated user-agent, Cloudflare colo / country / ASN, and the label of the pool key that authenticated the caller. You can attach a short tag with X-Nthpool-Tags.

We do not record HTTP request or response bodies, credentials, raw keys, or full header sets.

Database pools also log the SQL statement (truncated), row counts, and whether the result was capped. A statement the database refused is logged too. That is how you can see who ran what.

Logs live in a short window on the pool, then ship to Cloudflare R2. Retention follows the plan: Starter 1 day, Team 2 days, Business 7 days. Custom plans can keep them longer. Search and download them from the Logs tab. Metrics roll up hourly from the same entries.

Billing

Paid plans go through Stripe. Stripe sees the card. We keep the subscription and usage we need to bill you.

Cookies

The dashboard uses a session cookie so you stay signed in. The public pages do not set advertising or product-analytics cookies.

Who else sees data

These are the providers this product actually uses:

• Laravel Cloud hosts the control plane
• Cloudflare runs the data plane (Workers and Durable Objects) and stores access logs (R2)
• Stripe handles checkout and subscriptions

We do not have a signed DPA or a longer subprocessor list yet. If a vendor review needs one, email us and we will say where things stand.

Questions and deletion

Email [email protected]. You can also delete organizations and your account yourself. Deleting an organization removes its pools and the edge vault for that org.

Changes

This is early access. We will update this page when the product changes how it handles data. See also the Terms.