Privacy

Updated 27 October 2026

TormentLabs operates these services from New Zealand.

Your account

Torment Labs uses a central sign-in service for its websites. Account records include your email address, password hash, profile information you provide, account role and account dates. Domain memberships and permissions determine which features you can access.

Sign-in and security cookies keep you signed in and help protect account actions. Signing out ends the relevant session; it does not delete the account or all security records.

Sign-in security

Successful central sign-ins can record the time, IP address and approximate country or region supplied through the trusted network connection. This helps review account security. A region describes an approximate network location, not your home address, and may be unavailable or inaccurate.

These sign-in observations have a 30-day retention window, with scheduled cleanup. The administration interface restricts IP and region history to the root administrator. This window applies to sign-in observations, not to every account record, server log or backup.

Website traffic

The local traffic summary measures request counts, response status groups, response sizes and server response times, grouped by fixed public route categories. It retains up to seven days of aggregates. These counts include automated requests and are not a count of individual visitors.

This summary excludes account and authentication routes and does not store visitor IP addresses, raw URLs, query strings, cookies or referrers. Separate operational logs may contain IP addresses and request information for troubleshooting and security.

Nginx operational logs are configured for daily rotation with up to 14 rotated files. Rotation depends on scheduled jobs and whether logs contain data; this is not an exact 14-day deletion guarantee. Protected recovery backups may contain historical account or security records. Managed checkpoints rotate by count and storage limits after a replacement is verified; older historical backups are separate. Deleting a live record does not immediately remove it from existing backups.

Hosting and delivery

Cloudflare helps deliver and protect these websites. Requests pass through its network, where connection information may be processed to provide those services. See Cloudflare's privacy policy. The local traffic summary is separate from any Cloudflare-side measurement.

Cloudflare may also measure browser performance or usage. Its optional analytics configuration has not yet been confirmed for these sites. This notice does not claim that the local traffic summary is the only measurement performed.

Questions

Do not send passwords or session tokens by email.

For account or privacy questions, including requests to access, correct or delete your account information, email [email protected]. For security reports, email [email protected].

TormentLabs handles account closure and deletion requests manually and may need to verify that you control the account. Support will explain what can be deleted and whether any records must be retained. Sending a request does not immediately delete your account.

More about your privacy rights in New Zealand.