Privacy Policy
This Privacy Policy explains how Torek ("we", "us", or "the Service") accesses, uses, stores, and shares information when you use the application, including information received through Google OAuth.
Information we collect
We process your Torek account email and session information, and, when you connect Google, your Google account identifier, verified email address, the permissions you granted, and an OAuth refresh token. For visitors who start an anonymous demo we also log the IP address, used only to prevent abuse and enforce rate limits. The public anonymous demo and guides chat are protected by Google reCAPTCHA v3, which processes your IP address, browser signals, and cookies to tell humans from bots; we receive only a risk score and use it solely to block abuse.
How we use Google user data
We use Google user data only to connect the Google account you choose, show the connected account to you, and provide features you request. We do not use it for advertising, profiling, or training generalized AI models.
Storage, sharing, and retention
Refresh tokens are encrypted using authenticated encryption before storage, browser sessions use HTTP-only cookies, and access to connected-account records is limited to the authenticated account owner. No method of storage is completely secure. We do not sell Google data and share only with providers needed to operate the Service. You can disconnect Google or revoke access at any time.
Your rights (GDPR / CCPA)
If you are located in the EU, UK, or California you have rights to access, correct, export, and delete your personal information. Most of these can be exercised in the application under Settings → Data & Privacy, which offers export, deletion, and a consent log. You may also make a request through our Contact page, and we will respond within the timeframes required by law. We do not sell personal information, including under CCPA.
Lawful bases and international transfers
We process personal information based on consent (connecting Google or optional features), contract (providing the Service), legitimate interests (security and abuse prevention), and legal obligation. Data may be processed in regions where our sub-processors operate, including Google, Stripe, Vercel, and Resend, with appropriate safeguards applied. A Data Processing Agreement (DPA) is available on request via our Contact page.