Privacy Policy

1. Introduction

This Privacy Policy explains how TorrentCDN (“we,” “us,” or “our”) collects, uses, and protects personal data when you use the TorrentCDN service (the “Service”). We are committed to protecting your privacy and processing personal data in accordance with the Kenya Data Protection Act, 2019, and, where applicable, the EU General Data Protection Regulation (GDPR) for users in the European Economic Area.

2. Information We Collect

Account information

When you register, we collect your email address and a hashed password. If you choose to enable two-factor authentication, we store a TOTP secret and hashes of your one-time backup codes. We also store your plan, verification status, referral code, and bandwidth usage so we can provide the Service.

Content you upload

We store the files you upload (or their storage references), filenames, sizes, and the magnet links we generate for them. Uploaded files are scanned for known malware; files up to 32 MB may be submitted to VirusTotal for scanning.

Usage and analytics data

We collect data about how your content is delivered: view counts, bytes transferred from our origin, bytes exchanged between peers (P2P), and delivery performance. This powers the analytics shown in your dashboard and is used to operate and improve the Service.

Technical data

We collect IP addresses, browser type, and device information for security, rate limiting, and abuse prevention. We do not use this data to identify or profile you for advertising.

Payment data

When you subscribe to a paid plan, payment is processed by Paystack. We do not receive or store your card details; Paystack handles them in accordance with its own privacy policy.

3. How We Use Your Information

• –To create and manage your account, authenticate you, and secure the Service.
• –To store and deliver the content you upload, and to generate embed codes and magnet links.
• –To measure your bandwidth usage and display analytics in your dashboard.
• –To bill you for paid plans and manage subscriptions through Paystack.
• –To send service-related emails: verification, password reset, billing, and policy notices.
• –To scan uploads for malware, prevent abuse, enforce our Acceptable Use Policy, and respond to legal requests.
• –To operate, maintain, and improve the Service.

4. Legal Bases for Processing

We process personal data on the following bases:

• –Performance of a contract — providing the Service you requested, including storage, delivery, and billing.
• –Legitimate interests — security, abuse prevention, and service improvement, balanced against your rights.
• –Legal obligation — compliance with applicable law, such as lawful requests from authorities.
• –Consent — where we ask for it (for example, optional marketing), which you may withdraw at any time.

5. Sharing With Third Parties

We share personal data only with the processors needed to operate the Service, and never sell your data. Current processors include:

• –Cloudflare R2 — object storage for uploaded files.
• –Supabase — PostgreSQL database for account and usage records.
• –Paystack — payment processing for subscriptions (and transfers where payouts apply).
• –Resend — transactional email delivery.
• –VirusTotal — malware scanning of uploads (hash lookups and, for files up to 32 MB, file submission).
• –Render and Vercel — hosting of the backend API, Redis, and frontend.

We may also disclose personal data where required by law, regulation, or a valid legal request, or to protect the rights, property, or safety of TorrentCDN, our users, or the public.

6. Peer-to-Peer Disclosure

TorrentCDN uses WebTorrent, a peer-to-peer technology. When a viewer plays embedded content, their IP address may be visible to other viewers in the WebTorrent swarm, and their browser may upload chunks of the file to other peers. This is inherent to P2P delivery and is not controlled by us. If you embed TorrentCDN content on your own site, you should disclose this to your viewers, as their IP addresses and participation in the swarm may be visible to other peers.

7. Cookies and Local Storage

We do not use tracking cookies or third-party advertising cookies. We use your browser’s session storage to keep you logged in and to carry a referral code between pages. Session storage is cleared when you close your browser tab. See our Cookie Policy for details.

8. Data Retention

We retain your account and personal data for as long as your account is active, and for a reasonable period afterwards where needed to comply with legal or accounting obligations (for example, billing records). Files you delete are removed from storage; deleted objects are also subject to our orphaned-object cleanup that removes uploaded-but-unfinalized files on a schedule.

9. Data Security

We take reasonable measures to protect your data, including:

• –Passwords stored only as salted hashes (never in plaintext).
• –API keys stored only as hashes, with a one-active-key-per-user policy and instant revocation.
• –TLS encryption for data in transit, and encryption at rest on our storage providers.
• –Two-factor authentication (TOTP) support for your account.
• –Email verification required before login, and session revocation on password or security changes.
• –Security audits, secret scanning, and malware scanning of uploads.

No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security.

10. International Transfers

Your data may be processed in countries other than your own, including where our hosting providers (Cloudflare, Supabase, Render, Vercel) operate. Where we transfer personal data internationally, we rely on appropriate safeguards to protect it, consistent with applicable law.

11. Your Rights

Depending on your jurisdiction, you may have rights to request access to, correction of, or deletion of your personal data; to object to or restrict certain processing; and to data portability. Under the Kenya Data Protection Act, 2019, you may also lodge a complaint with the Office of the Data Protection Commissioner. You may delete your account and its data at any time from your dashboard. To exercise any of these rights, contact us at privacy@torrentcdn.store.

12. Children’s Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us at privacy@torrentcdn.store and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where practical, notifying you by email or within the Service.

14. Contact

For privacy-related questions or requests, contact us at privacy@torrentcdn.store. Our services are operated from Kenya.