This Privacy Policy explains how Torek ("we", "us", or "the Service") accesses, uses, stores, and shares information when you use the application, including information received through Google OAuth.
We process your Torek account email and session information, and, when you connect Google, your Google account identifier, verified email address, the permissions you granted, and an OAuth refresh token.
We use Google user data only to connect the Google account you choose, show the connected account to you, and provide features you request. We do not use it for advertising, profiling, or training generalized AI models.
Refresh tokens are encrypted using authenticated encryption before storage, browser sessions use HTTP-only cookies, and access to connected-account records is limited to the authenticated account owner. No method of storage is completely secure. We do not sell Google data and share only with providers needed to operate the Service. You can disconnect Google or revoke access at any time.
If you are located in the EU, UK, or California you have rights to access, correct, export, and delete your personal information. Most of these can be exercised in the application under Settings → Data & Privacy, which offers export, deletion, and a consent log. You may also make a request through our Contact page, and we will respond within the timeframes required by law. We do not sell personal information, including under CCPA.
We process personal information based on consent (connecting Google or optional features), contract (providing the Service), legitimate interests (security and abuse prevention), and legal obligation. Data may be processed in regions where our sub-processors operate, including Google, Stripe, Vercel, and Resend, with appropriate safeguards applied. A Data Processing Agreement (DPA) is available on request via our Contact page.