Privacy Policy

Localians gives developers temporary HTTPS preview links for web applications running on their own computers. You start your app locally, run a command, and Localians makes it reachable at a link you can share with a client or teammate. This policy explains what information Localians handles to do that, why, and what choices you have.

Localians is built and operated by THINXIFY Technologies. In this policy, “Localians”, “we” and “us” mean that operator running the service at localians.com and its preview domain. We don't publish a registered company number or postal address on this page; you can reach us at hello@thinxify.com.

This policy covers the Localians website, dashboard, command-line tool (CLI) and preview links. It does not cover the applications you share or third-party sites you link to from them.

We collect only what the service needs. In practice that is:

• Account information: your name, email address, a username if you choose one, and a user ID (like LOC-000123) that we assign. If you sign up with a password, we store a one-way hash of it, never the password itself. If you sign in with GitHub (where offered), we receive the basic profile details GitHub shares with us, such as your name, email and avatar. You can also add a profile picture as an image link.
• Authentication and session information: session records with the IP address and browser/device description (user agent) they were created from, email verification and password-reset tokens, and, for the CLI, the name of each computer you approve and the time it was last used. CLI access tokens and one-time setup codes are stored as hashes.
• Projects and preview settings: project names and descriptions, the local port and framework you choose, whether a preview is public or password protected (preview passwords are stored as hashes), preview URLs and custom URL names, timers, session durations, and which plan applies to a project.
• Usage and technical information: when a preview connected, disconnected or expired and why; the number of requests and the amount of data a preview transferred, in short time buckets; and an activity trail of important actions such as passes being activated or accounts being suspended. IP addresses are also used, briefly, as keys for rate limiting (sign-in attempts, CLI requests and preview-password attempts). Our servers record errors as structured logs that include the request path but not headers, cookies or bodies.
• Upgrade orders and payment records: for a 7-Day Preview Pass order, the Order ID, project, amount, currency and network, any custom URL you requested, the transaction hash you provide, the result of our blockchain check, the review status and notes, and timestamps. See Payments and blockchain.
• Support communications: messages you email to hello@thinxify.com, including anything you attach.
• Other information you choose to give us, for example in a bug report.

We don't run a contact form, and the marketing site doesn't collect personal information through forms. Your browser also remembers a few convenience settings on your own device (for example your last sharing options in the dashboard); these stay in your browser and aren't sent to us.

When you share an app, you deliberately make it reachable from the public internet. Visitors who open your preview link connect to Localians over HTTPS, and our gateway forwards each request through the encrypted tunnel your CLI opened to your computer, then returns your app's response.

Preview content passes through our servers. Because the gateway sits between the visitor and your computer, it handles the requests and responses in order to forward them, including their content, while they are in transit. We don't say that Localians is unable to see preview traffic: that would not be accurate. We don't store the bodies of your requests or responses, and our gateway logs are written to contain metadata only.

What we do record about preview traffic is limited to metadata:

• the preview's label (its hostname), the HTTP method, the request path with any query string replaced by [redacted], the response status and how long it took;
• connection events (connected, disconnected, expired, stopped), and counts of requests and bytes per preview in short time buckets, used for your dashboard and fair-use limits.

Public and password-protected previews. A public preview can be opened by anyone who has the link. A password-protected preview asks visitors for the password you set before showing your app. After a correct password, the gateway sets a cookie on that preview only, valid for the duration you choose, and removes it from requests before they reach your app. Changing the password or choosing “sign out all visitors” invalidates those cookies. Wrong passwords are rate limited per visitor IP address. Password protection controls who can open the link; it is not a substitute for securing the app itself.

Your responsibility. You decide what your preview exposes. Don't share an app that contains real customer data, production credentials, API keys or other secrets, and remember that anyone with a public link, or the password, can pass it on. Your app, and anything it sets, such as its own cookies, is yours; we don't control it.

We use the information described above to:

• create and secure your account, verify your email address and sign you in;
• connect your computer to the gateway, create and stop preview links, enforce preview timers and plan limits, and show you your projects and traffic;
• answer support requests and troubleshoot problems you report;
• protect the service: rate limiting, detecting abuse and sign-in attacks, enforcing our Terms of Service and suspending accounts or previews when necessary;
• verify upgrade payments, review them, and activate, extend or revoke passes and custom URLs;
• monitor reliability and fix errors;
• send service emails, such as verification, password-reset, security and order messages. We don't send marketing email;
• meet legal obligations and respond to valid legal requests where they apply.

We don't sell your personal information and we don't use it for advertising.

Localians uses only the cookies and browser storage it needs to work:

• Sign-in session cookie. When you sign in, we set an HTTP-only session cookie (named with a __Host-localians prefix on the live site) that keeps you signed in for up to 30 days unless you sign out. It is restricted to our own host, sent only over HTTPS and never readable by page scripts.
• Preview access cookie. On a password-protected preview, a visitor who enters the correct password receives an HTTP-only cookie for that preview only.
• Local browser storage. The dashboard may remember your last sharing choices in your browser's local storage. It is not sent to us.

Analytics and advertising. We checked our code: Localians does not use Google Analytics, Google AdSense or other advertising products, and does not include third-party analytics, advertising or tracking scripts or cookies on the website. We use Google Search Console to verify ownership of our site, which doesn't place tracking cookies on your visit. If we add analytics or advertising later, we'll update this section first and ask for consent where the law requires it.

Because we only use cookies that are strictly necessary to provide the service you ask for, we don't show a cookie consent banner. You can block or delete cookies in your browser, but you then won't be able to stay signed in. Applications you share through Localians may set their own cookies; those are governed by that app's own policies.

We share limited information with providers we need to run Localians. They may process it only to provide their service to us.

• Hosting and infrastructure: Localians runs on a virtual private server from Hostinger, which hosts our web app, gateway and database. Your account data, preview metadata and preview traffic in transit are processed on that infrastructure.
• Email delivery: Resend sends our service emails (verification, password reset, order and security messages), so it receives your email address, name and the content of those messages. Support mail you send to hello@thinxify.com is handled by our email provider for that mailbox.
• Sign-in: if you choose GitHub sign-in, GitHub provides us with your profile details under its own privacy terms.
• Blockchain data: to verify a payment, our server queries a public BNB Smart Chain node. That query contains the transaction hash and wallet addresses, which are already public on the blockchain. See below.

We also use standard open-source libraries. We don't disclose personal information to others except to these providers, where you ask us to, where the law requires, or to protect the service and its users (for example against abuse). If our business were ever transferred, we would tell you how this affects your information.

The 7-Day Preview Pass is paid in USDT on BNB Smart Chain (BEP20) and reviewed by a person. You create an upgrade request in your dashboard, which gives you an Order ID; you send the payment and give us the transaction hash (or email it to us). We then check on the blockchain that the transfer exists and matches, and an administrator approves or rejects the request. We store the order, the transaction hash, the result of the check, the reviewer and any note, so we can activate, support and, where appropriate, revoke or correct a pass.

• Blockchain transactions are public and permanent. Anyone can see a transaction and its wallet addresses on a public explorer. We can't delete or alter them, and a transfer can't be reversed by us or by the network. Cryptocurrency payments aren't anonymous, and we don't describe them that way.
• Evidence you send us. You may email a screenshot or other proof of payment. These can show wallet balances, other transactions, account names or other personal details. Crop or hide anything unrelated before sending. Don't send seed phrases, private keys or passwords. We will never ask for them.
• No payment-card data. We don't collect card or bank details.

Payments and pass availability are rolled out in stages; see the Terms of Service for current availability and the conditions that apply. Refunds are handled case by case as described there.

We keep information for as long as it is needed to run the service, support you, prevent abuse and keep accurate financial and security records. We have not set fixed retention periods for most data, and we don't promise automatic deletion that isn't in place. What happens today:

• Account and project data stays until your account is deleted. You can remove your own sessions and revoke CLI computers yourself in Settings.
• Sessions expire after 30 days of inactivity or when you sign out. Short-lived records, such as expired device-approval codes, expired share-setup codes and rate-limit counters, are cleaned up automatically.
• Preview metadata (sessions, connection events and traffic counts) is kept with your project so your dashboard history stays available.
• Payment and order records and the activity trail of administrative actions are kept so that payments, passes and disputes can be traced.
• Server logs are kept on our servers under the host's ordinary log handling and are used for troubleshooting and security.

Deleting your account. Email hello@thinxify.com from the address on your account. When we delete an account we sign you out everywhere, revoke CLI access, stop and archive your previews, remove your sign-in methods (password hash and linked GitHub account), and replace your name, email address, username and picture with placeholders. We keep the anonymised account record and the order, payment and activity records that refer to it, because we may need them for accounting, fraud prevention, security and legal reasons. We won't re-identify you from them.

We take reasonable steps to protect information, including:

• HTTPS for the website, dashboard and preview links, and an encrypted tunnel between the CLI and our gateway;
• hashed passwords, hashed CLI and one-time tokens and hashed preview passwords, and encryption of stored OAuth tokens;
• host-only, HTTP-only session cookies, CSRF protection, email verification and rate limiting on sign-in and password flows;
• limiting administrator access to a small number of accounts, with a separate admin sign-in and an activity trail.

No online service is completely secure, and we can't guarantee that information will never be accessed without authorization. Please use a strong, unique password, and tell us right away at hello@thinxify.com if you suspect your account has been accessed by someone else.

You can view and edit your name, username and profile picture in your dashboard settings, manage your sessions and CLI computers, and change your password. To ask for a copy of the personal information we hold about you, to correct it, or to have it deleted, email hello@thinxify.com from the address on your account. We may ask you to confirm it's you, and we'll reply as soon as we reasonably can.

Depending on where you live, you may have additional rights, for example under the EU or UK GDPR or US state privacy laws: to object to or restrict certain processing, to data portability, or to complain to your local data protection authority. We will honour those rights where they apply to us. We don't claim any particular certification or compliance status beyond that. Some information can't be deleted or changed, such as public blockchain records and records we must keep by law.

Localians is available to developers worldwide. Your information is processed on our hosting provider's servers and by the providers listed above, which may be located in countries other than yours, including countries whose data protection laws differ from those where you live. Preview traffic can also pass through networks in other countries on its way to and from visitors.

We take reasonable steps to protect information wherever it is processed, including choosing established providers that publish their own data protection terms. We don't claim any specific transfer mechanism or certification. Ask us at hello@thinxify.com if you want to know more.

Localians is a developer tool and isn't directed to children. You must be at least 18 years old to create an account. If you believe a child has given us personal information, email hello@thinxify.com and we will delete it.

We may update this policy as Localians changes. The date at the top shows when it last took effect. If we make a material change, we'll tell you in the dashboard or by email before it applies, where that is practical. Continuing to use Localians after the change means you accept the updated policy.

Questions about this policy or your information? Email hello@thinxify.com, or see our contact page.