Privacy
This site doesn't track you, and here's what that means precisely.
A statement of how tuliocp.com actually behaves, written to be
verifiable rather than reassuring. It is not a legal instrument and has not been reviewed
by a lawyer. Where a claim depends on configuration, that configuration is in the public
repository for this site.
This marketing site
What the pages themselves don't do
No analytics, no tag manager, no pixels
There is no analytics script on this site — no Google Analytics, no Plausible, no Matomo, no A/B testing tool, no session recorder, and no advertising or conversion pixel. The pages ship HTML, CSS, and self-hosted fonts.
No cookies and no local storage
This site sets no cookies of any kind, and stores nothing in localStorage or sessionStorage. That is why you are not seeing a cookie banner: there is nothing to consent to.
No third-party requests
Fonts are served from this domain, not from a font CDN. The content-security policy on every response is restricted to this origin, so the browser is not permitted to load a third-party script, style, or font while rendering these pages.
No accounts and no forms
There is nothing to sign up for here and no form to submit — no newsletter, no contact form, no mailing list. Nothing you type is sent anywhere, because there is nowhere on this site to type it.
What is recorded
Server logs, which do contain personal data
Serving a page means a web server writes a log line, and two of them do here. The public hostname is terminated by a reverse proxy, which sees the IP address your request comes from and records it. The origin behind it sees only the tunnel's own address, so its access log carries that instead of yours. Both record the timestamp, the request line, the response status and size, the referrer, and the user agent.
That is personal data, and calling it anything else would be dishonest. An IP address — on its own, and more so beside a timestamp and a user agent string — can identify a person, and data-protection law such as the GDPR treats it as personal data. So the honest version of "this site collects nothing" is narrower: it runs no analytics, sets no cookies, and asks you for nothing, and it still writes your address into a log the moment you load a page. Every site does. This one says so.
What doesn't happen to those lines is the part that's actually a choice. They exist to operate and debug the server. They are not fed into an analytics product, not joined with any other data set, not used to build a profile of you, and not sold or shared. No identifier is assigned to you across visits, because none is set.
Retention, as configured rather than as aspired to: on the origin the access log rotates daily and fourteen rotations are kept, so a line ages out after about two weeks. That is the stock Debian nginx logrotate policy and it is what the machine is actually set to. The proxy in front of it is a separate system with its own settings, and this page will not quote you a number for it that it can't show you.
The same applies to apt.tuliocp.com: fetching package metadata or a
.deb is an HTTP request that lands in a log like any other. Installing
TulioCP does not phone home to this site, and the panel does not register your server
anywhere.
Limits
What this page cannot offer you
There is no company behind TulioCP — the same statement /terms makes. No incorporated entity, which means no registered data controller to name, no data-protection officer, and no privacy mailbox. Inventing one to fill the slot a privacy policy usually has there would be worse than leaving it visibly empty.
The practical consequence: there is no intake process here for a request to access, export, correct, or delete anything, and no way to authenticate that such a request came from you rather than from someone claiming your IP address. What exists to be asked about is a rotating web-server log line and nothing else — no account, no profile, no record that survives the retention above. If that isn't good enough for your situation, the remedy available to you is the one that always was: use a VPN or Tor, or don't load the page.
Anything you want to raise about this page — an inaccuracy, a claim that no longer matches the configuration — belongs in the panel repository's issues, in public, where the answer is checkable by everyone.
Different rules apply
The billing demo is a separate application
Everything above describes this marketing site. It does not describe billing.tuliocp.com, which runs the TulioBilling application as a public demo. That application is a PHP app with sessions: it does set a session cookie and a locale cookie, and it stores what is typed into it in its own database.
Because it is a demo, treat everything in it as public and disposable. Do not enter real personal data — no real names, addresses, payment details, or passwords you use elsewhere. Its data may be reset or wiped without notice, no payment gateway is connected, and self-registration is closed. The full notice is on the billing page.
Changes
How this page changes
If tracking is ever added to this site, this page changes in the same commit — that is a rule about how the repository is maintained, not a promise about intent. The site's source is public, so the diff is visible either way, and so is the nginx configuration that the claims above are made against.