What we store, and what we cannot see.

Privacy policy

The short version

Torchpass is not end-to-end encrypted, and we would rather say so plainly than imply otherwise. What you write is encrypted in transit and at rest, and technically we could read it. That trade is acceptable because of what it is: a description of how a website is put together. The service never asks you for a password belonging to you or to a client, and there is nowhere to put one.

What we hold

• Account details — your email address, and a name if you give one.
• Billing records — handled by Stripe. We store a customer reference and what you bought. We never see or store card numbers.
• Protocol data — who you named to confirm, their contact details, your check-in schedule and when you last checked in. This is what actually runs the protocol.
• What you wrote about each project — your clients and their contacts, the services each project depends on, who controls and pays for each, and your notes. Readable to us, and locked to your account by the database itself.
• Operational logs — request logs and error traces, retained briefly for reliability and security.

What we never hold

• Any password, API key or recovery code. The service does not ask for them and has nowhere to store them.
• Any key, or combination of keys we store, that would open one.
• Card details.

The people you name

When you name someone, we store their contact details so the protocol can reach them. They can ask us what we hold about them and ask to be removed, though removing them from our records also removes them from your plan — we will tell you if that happens.

This website

This site asks before it sets an analytics cookie. Decline and Google Analytics is never loaded at all — not loaded and asked politely to behave, simply never fetched. You can change your mind from the Cookies link in the footer.

If you accept, Google Analytics counts visits and shows which pages people read. It sets cookies named _ga and _ga_XVXR4S3GY7, which tell one browser from another so a returning visitor is not counted twice. Google receives your IP address as part of that and uses it to work out roughly which country you are in.

Either way, we count page views with Vercel Web Analytics. It sets no cookies, stores nothing on your device and never identifies you, which is why it does not wait for permission.

There is no advertising on this site, no advertising cookies, and nothing here is used to build a profile of you or to follow you to other websites.

The only other browser storage is a single tp-theme entry in localStorage recording whether you chose light or dark. It never leaves your device and is not a cookie.

You can block all of it with any content blocker, or by turning off third-party scripts, and the site works exactly the same.

Fonts, scripts and styles are served from our own domain. No third-party CDN sees your visit.

Retention

We keep your account and plan data for as long as your plan is active, plus a grace period after any lapse so that a missed payment cannot destroy a continuity plan. Operational logs are kept for a short period. Billing records are kept as long as UK tax law requires.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email privacy@torchpass.dev and we will respond within one month. You can also complain to the Information Commissioner's Office.

Processors

We use a small number of suppliers to run the service — hosting, email delivery and Stripe for payments. Each is bound by a data processing agreement. We will name them all in the final version of this policy.

Changes

If we change anything material we will email you before it takes effect, rather than silently updating a date at the bottom of a page.