Privacy & data handling

finch works like a Cloudflare Tunnel: encrypted transport, an outbound-only connection from your machine, and no retention of the requests and responses it relays. finch is not end-to-end encrypted, because its Cloudflare edge ends the transport encryption and handles each payload in memory long enough to route it.

Ordinary relay traffic

A client connects to finch over HTTPS. finch checks the caller's key or sign-in and relays the request to your machine over the machine's outbound WSS connection. Responses come back over the same encrypted connections. Your machine opens no inbound port and its IP address is never shown to the caller. The last hop, from finch on your machine to your app, is yours to choose: finch allows plain HTTP to a loopback address and to single-label hosts (such as a Docker Compose service name). A single-label name can resolve to another computer, and when it does, that hop crosses your network in the clear. Use https:// for any app that isn't on the machine itself.

This is transport encryption, not end-to-end encryption. finch's runtime can read the plaintext while it forwards a request, even though it keeps none of it. So we don't claim that finch is unable to inspect traffic.

Operational metadata we retain

finch keeps a short record of each call so you can see what reached your services and troubleshoot them with finch logs <name>. For each relayed call, that record holds:

• the time of the call;
• the route (the request path, such as /notes/mcp);
• the caller's label: a key's label, or the account id of an OAuth sign-in;
• the response status code and how long it took; and
• running counts of requests, latency and errors.

finch also records a call it answers itself with a 503 because no machine serving the service is connected. A call refused for a missing or wrong key is not recorded. Beyond calls, finch keeps what it needs to run your account: your services, machines, keys and settings. Keys are stored as hashes; the full key is shown only once, when it is made. Request and response bodies are never part of the call record, logs or metrics.

What this means in practice

• Every request through a finch address gets the no-retention guarantee.
• The call record is shown to you, the account owner, and to no other finch user.
• Each finch account belongs to one person; there are no shared accounts or team members.

Accounts from before September 2026

finch used to have team features. Their records (members, invitations, groups, access rules and requests, and the activity entries about them) are deleted the first time finch handles a request for such an account, and if anyone besides the owner could sign in, its keys, machines and logins are revoked so the owner can re-add their own.