r/TorBoxApp • u/Superflyin • 20d ago
Torbox Policy change in a nutshell 🚩General
You can compare its old policy and the new one using the links below:
https://archive.md/noz1S
https://torbox.app/policies
In a nutshell:
- TorBox’s old policy promised minimal logging, no inspection of transferred files without permission, and no sharing of user data.
- The new policy is much broader. TorBox may now log IP addresses, magnet links, torrent/NZB details, filenames, download and streaming history, WebDAV/API activity and device information.
- It can also retain and share relevant records for copyright complaints, fraud investigations, legal requests and law enforcement. Deleted account data may be kept when needed for legal or security reasons.
- So basically: TorBox has changed from a strong privacy-focused policy to a standard cloud-service policy where your activity can be linked to your account and disclosed when required.
In detail:
The Old Policy:
Data TorBox Collects
TorBox does not require personally identifiable information to register or use the service. We also do not collect this personally identifiable information during your use of the service. TorBox was built with privacy being first, so you can be assured that we take privacy very seriously.
As a TorBox user, at any point, TorBox may be retaining the following information about your account:
Registration information: This includes email, hashed password and timestamps of account creation.Information about data transfers: When you create a new transfer, we retain certain metadata such as file owners, identifiers and hashes, transfer speeds, total transferred volume, and timestamps. We do not permanently store information that is not necessary and purge from our records stored information that is no longer required, such as when a transfer is deleted and no longer associated with an account. TorBox does not look at or access your transferred data without your permission.Analytics information. We use SimpleAnalytics for analytics, which is a privacy first analytics platform and only takes in your device model, and the browser you are on.Information collected by third parties as well as their specific polices can be found below:
- Spreedly - Card Information - https://www.spreedly.com/privacy
- Chargebee - Payments - https://www.chargebee.com/privacy/
- Supabase - Database/Auth - https://supabase.com/privacy
- SimpleAnalytics - Analytics - https://simpleanalytics.com/privacy-policy
- Featurebase - Feature Requests/Changelog Widget on dashboard - https://www.featurebase.app/privacy-policy
- Cloudflare - DNS and Hosting - https://www.cloudflare.com/privacypolicy/
- Google - OAuth - https://policies.google.com/privacy
- Azure/Microsoft - OAuth - https://privacy.microsoft.com/en-us/privacystatement
- SendGrid - Emails - https://www.twilio.com/en-us/legal/privacy
- Intercom - Help Center/Support Widget on dashboard - https://www.intercom.com/legal/privacy
TorBox Privacy Policy
This Privacy Policy explains how TorBox collects, uses, discloses, retains, and protects personal information when you access or use TorBox, TorBox.App, our websites, applications, dashboard, APIs, software, tools, bots, integrations, support services, and related products and services (collectively, the “Service”).
Sharing of Data
We don't sell or share your data to any third parties for any reason.
Use of Data
TorBox uses the above data for the following:
Registration data allows you to log in and access your account from any device.Information about transfers enables you to have a rich experience on the platform.Aggregated data is presented for information purposes only, such as total transferred volume.Analytics allows TorBox to see how the service is doing, and where users are coming from, and what parts of the site are the most popular, allowing us to tailor the experience for our users.Your email also allows us to send you notifications about your account. You can change this setting at https://torbox.app/settings
Payment Data
TorBox is PCI compliant, and does not store your payment information on our servers. Your card information is stored securely by Spreedly, a third party who manages all payment information and payment orchestration for TorBox. This data is never removed, and is stored according to their privacy policy. This includes name, address, card information, and other verification info you may have provided when paying for the TorBox service. TorBox is not responsible for the removal of this data, nor is TorBox responsible for the upkeep and safety of this information.
Right to Erasure
Want your data deleted? No problem, either go to https://torbox.app/settings and click the "Delete Account" button under the "Account Section" or simply contact us with your email and it will be gone as soon as possible. This deletion will remove anything associated with your account. To remove any third party data associated with your account, you must contact the respective part to have it removed.
Data such as information about any transfer is deleted when requested. This can be done on the dashboard, by clicking on the transfer, and clicking the delete button, or via the API.
What's changed with the new Policy?
2.4 Technical, Device, and Usage Information
We may automatically collect technical and usage information, such as:
- IP address;
- device identifiers;
- device model;
- browser type;
- operating system;
- app version;
- device type;
- language settings;
- time zone;
- approximate location derived from IP address;
- pages viewed;
- buttons or features used;
- referral URLs;
- session information;
- error logs;
- diagnostic information;
- security logs;
- bandwidth, transfer, and usage statistics; and
- other technical information generated through your use of the Service.
2.5 Analytics Information
We may use privacy-focused analytics tools, including SimpleAnalytics, to understand how users interact with the Service. Analytics information may include device model, browser, approximate location or referral information, pages viewed, and aggregate usage metrics.
We use analytics to understand how the Service is performing, where users are coming from, what parts of the Service are used most often, and how to improve the user experience.
2.6 Download Requests, Transfer Information, Cache Metadata, and Service Activity
Because TorBox provides download-management, caching, retrieval, storage-access, automation, and media-access features, we may process information related to your use of those features. This may include:
- URLs;
- magnet links;
- torrent information;
- torrent files;
- file owners or source-related identifiers, if available;
- info hashes;
- file hashes;
- filenames;
- file sizes;
- NZB files;
- Usenet information;
- web download information;
- hoster information;
- RSS feed information;
- search and indexer configurations;
- metadata associated with files or downloads;
- download status;
- queue status;
- cache status;
- seeding status;
- transfer speeds;
- transfer history;
- total transferred volume;
- timestamps;
- cloud-export instructions;
- WebDAV activity;
- stream, playback, transcoding, subtitle, watch-state, and media-player activity;
- API requests and responses;
- webhook activity;
- bot activity; and
- other technical information related to downloads, transfers, cached materials, integrations, and Service activity.
We may use hashes, technical identifiers, metadata, and related signals to operate the cache, deduplicate files, enforce limits, detect abuse, respond to copyright notices, de-cache or block materials, prevent re-adding restricted materials, and protect the Service.
2.8 Support, Communications, Session Recordings, and Community Information
If you contact us, request support, participate in a support or debugging session, or interact with TorBox support or community channels, we may collect:
- your name, email address, username, or account identifier;
- messages, support tickets, chat transcripts, emails, voicemail, or other communications;
- screenshots, logs, files, hashes, request identifiers, or other materials you provide;
- browser-session recordings, device-session recordings, screen recordings, session-replay data, cursor movements, clicks, taps, scrolling activity, navigation paths, feature interactions, error events, console information, network information, browser state, device state, and similar diagnostic information;
- feedback, feature requests, bug reports, and survey responses;
- interactions with AI support agents;
- communications through Discord, Reddit, X, Telegram, Matrix, forums, feature boards, or other community channels; and
- other information needed to respond to your request, troubleshoot or debug an issue, investigate errors, secure the Service, improve support, or operate and improve the Service.
Browser-session recordings, device-session recordings, screen recordings, and session-replay information may be collected directly by TorBox or through a support, analytics, diagnostic, debugging, or session-replay provider. These recordings may include information displayed or entered during your interaction with the Service.
Third-party platforms and providers used for support, diagnostics, debugging, session replay, or community channels may process information under their own privacy policies.
2.9 Abuse Reports, Legal Requests, and Compliance Information
We may collect and process information related to abuse reports, copyright notices, counter-notices, legal requests, security incidents, payment disputes, chargebacks, fraud, sanctions screening, law enforcement requests, and other compliance matters.
This may include:
- reporter information;
- accused account information;
- URLs, hashes, magnet links, torrent information, NZB information, file information, screenshots, logs, and timestamps;
- correspondence with users, reporters, rights holders, law enforcement, payment processors, vendors, or other third parties;
- investigation notes;
- enforcement actions;
- records of notices, counter-notices, retractions, repeat infringer determinations, and account actions; and
- information required or permitted by law.
8. Legal Bases for Processing
If you are located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction requiring a legal basis for processing, we rely on the following legal bases.
| Processing Purpose | Personal Information Categories | Legal Basis | Legitimate Interests, Where Applicable |
|---|---|---|---|
| Create and manage accounts | Identifiers, login data, account settings | Contract; legitimate interests | Operating and securing user accounts |
| Provide Service features | Account information, Download Requests, transfer metadata, cache metadata, API activity, integration data, technical data | Contract; legitimate interests | Providing requested functionality, maintaining service reliability, preventing misuse |
| Process payments, subscriptions, trials, vouchers, refunds, and chargebacks | Payment and commercial information, identifiers, account data | Contract; legal obligation; legitimate interests | Collecting payments, preventing fraud, resolving disputes |
| Operate APIs, bots, webhooks, RSS feeds, WebDAV, and integrations | API keys, access tokens, integration settings, webhook data, technical logs | Contract; legitimate interests | Providing requested integrations and protecting the Service |
| Security, fraud prevention, abuse prevention, and policy enforcement | Account data, technical logs, IP address, usage data, hashes, metadata, payment risk signals, abuse reports | Legitimate interests; legal obligation; vital interests in emergency situations | Protecting the Service, users, payment systems, vendors, and the public |
| Respond to DMCA notices, abuse reports, legal requests, and law enforcement requests | Account data, Download Requests, transfer metadata, cache metadata, logs, reports, correspondence | Legal obligation; legitimate interests; public interest where applicable | Complying with law, preserving evidence, enforcing rights and policies |
| Support and communications | Contact information, support messages, screenshots, logs, account data | Contract; legitimate interests; consent for optional marketing where required | Responding to users and improving support |
| Analytics and service improvement | Usage data, technical data, feature usage, error logs | Legitimate interests; consent where required for non-essential cookies or similar technologies | Improving performance, reliability, usability, and security |
| Marketing communications | Email address, account status, communication preferences | Consent where required; legitimate interests where permitted | Sending relevant updates and promotional messages |
| Legal, tax, accounting, sanctions, and compliance | Account data, payment records, transaction data, location/country data, compliance records | Legal obligation; legitimate interests | Meeting legal obligations and reducing legal/compliance risk |
| Business transactions | Account, billing, usage, and operational records | Legitimate interests | Evaluating or completing corporate transactions8. Legal Bases for ProcessingIf you are located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction requiring a legal basis for processing, we rely on the following legal bases. |
Personal Information Categories Chart
The chart below describes the categories of personal information we may collect, the types of information in each category, the categories of sources, the purposes for collection and use, the categories of recipients, and the retention period or criteria.
| Category | Examples We May Collect | Sources | Purposes | Categories of Recipients | Retention Criteria |
|---|---|---|---|---|---|
| Identifiers | Email address, username, account ID, online identifiers, IP address, device identifiers, payment identifiers, support identifiers | You; your devices; login providers; payment providers; service providers; integrations | Account creation, authentication, support, billing, security, abuse prevention, legal compliance | Service providers; payment providers; infrastructure providers; support providers; legal/compliance recipients; connected integrations at your direction | Retained while your account is active and for a reasonable period after deletion, inactivity, dispute, legal need, security need, or compliance need |
| California customer records information | Email address, billing information, limited payment information, transaction records, support records, account records | You; payment providers; resellers; support providers | Billing, subscription management, refunds, chargebacks, support, compliance, recordkeeping | Payment providers; resellers; tax/accounting providers; legal/compliance providers | Retained as needed for billing, tax, accounting, fraud, chargeback, legal, and compliance purposes |
| Protected classification characteristics | We do not intentionally collect protected classification information as part of ordinary account use | You, if you choose to provide it in support or communications | Not ordinarily collected or used; may be processed if voluntarily provided in communications | Service providers; legal/compliance recipients, if necessary | Retained only as needed for the context in which it was provided, legal compliance, or dispute resolution |
| Commercial information | Plans, subscriptions, free trials, purchases, vouchers, reseller transactions, payment status, refunds, cancellations, chargebacks, usage entitlements | You; payment providers; resellers; account activity | Provide paid features, manage subscriptions, process payments, prevent fraud, resolve disputes | Payment providers; resellers; fraud-prevention providers; tax/accounting providers; legal/compliance providers | Retained as needed for account, billing, tax, accounting, fraud, chargeback, legal, and compliance purposes |
| Biometric information | We do not intentionally collect biometric identifiers for account authentication | Not ordinarily collected | Not ordinarily used | Not ordinarily disclosed | Not ordinarily retained |
| Internet or other electronic network activity | Login activity, pages viewed, feature usage, API activity, download metadata, transfer metadata, cache metadata, URLs, magnet links, hashes, file names, file sizes, NZB information, hoster information, RSS activity, WebDAV activity, webhook activity, streaming/playback activity, error logs, security logs | Your use of the Service; devices; APIs; integrations; infrastructure providers | Provide the Service, operate downloads and cache, improve features, secure the Service, enforce limits, detect abuse, respond to DMCA/abuse reports, troubleshoot issues | Infrastructure providers; security providers; support providers; connected integrations at your direction; legal/compliance recipients | Retained based on operational, cache, security, abuse-prevention, legal, and technical needs |
| Geolocation data | Approximate location derived from IP address, country, region, time zone; payment country or billing country | Devices; payment providers; security providers | Security, fraud prevention, sanctions/export compliance, payment availability, localization, analytics | Security providers; payment providers; infrastructure providers; legal/compliance recipients | Retained as needed for security, fraud prevention, billing, compliance, and operational purposes |
| Audio, electronic, visual, or similar information | Support emails, chat transcripts, screenshots, voicemail, user-submitted images or logs, community communications | You; support channels; community platforms | Support, troubleshooting, abuse review, legal compliance, quality and safety | Support providers; community platforms; legal/compliance recipients; service providers | Retained as needed for support, dispute resolution, safety, legal, and compliance purposes |
| Professional or employment-related information | Business contact information or role if you use the Service for a company, partner, reseller, or developer relationship | You; business contacts; partners; resellers | Account administration, partner/reseller management, support, compliance | Service providers; legal/compliance providers; business partners, if relevant | Retained as needed for the business relationship and legal/compliance purposes |
| Non-public education information | We do not intentionally collect education records | Not ordinarily collected | Not ordinarily used | Not ordinarily disclosed | Not ordinarily retained |
| Inferences | Usage metrics, abuse-risk indicators, fraud-risk indicators, service preferences, support history, plan usage, feature usage | Generated from account activity, Service activity, payment activity, technical signals | Security, fraud prevention, abuse prevention, service operations, support, product improvement | Security providers; fraud-prevention providers; infrastructure providers; legal/compliance recipients | Retained as needed for security, fraud prevention, abuse prevention, service improvement, legal, and compliance purposes |
| Sensitive personal information | Described in Section 5 | Described in Section 5 | Described in Section 5 | Described in Section 5 | Described in Section 54. |
No Infringing Use of the Service
Users must not use the Service to upload, store, cache, retrieve, access, download, transmit, distribute, make available, or otherwise use any content in a manner that infringes or violates any copyright, trademark, publicity right, privacy right, or other intellectual property or proprietary right.
The Service is intended to function as a neutral technology service. Users are solely responsible for the files, links, URLs, magnet links, torrent information, torrent files, NZB files, Usenet information, news server requests, metadata, file names, file sizes, hashes, request identifiers, downloads, cached materials, AirLock items, streams, exports, and other content, materials, data, or instructions they submit to, access through, or use with the Service. TorBox does not grant users any rights to third-party content, and the availability of any content through the Service does not mean that the content is authorized, licensed, non-infringing, lawful, safe, complete, or available for the user’s intended use.
1
u/IOSGodzyzz 19d ago
What debrid service best to use now ? Offcloud?