# Privacy Policy

<https://tor.live/pages/privacy-policy>

This Privacy Policy explains what information Tor.Live collects and how it's
used.

## Information we collect

- **Account information**: your username, password, and recovery phrase, used
  solely to authenticate you. We do not collect an email address.
- **Profile information you provide**: full name, bio, contact details, and a
  public PGP key, if you choose to add them. This information is visible to
  other logged-in users.
- **Two-factor authentication key**: if you enable 2FA, the PGP public key you
  provide is stored to issue login challenges. It is used only for that
  purpose.
- **Sites, reviews, and comments** you submit, along with the images you
  upload for them.
- **Technical and abuse-prevention data.** We set two cookies. Both are
  first-party, neither is used for advertising, and neither is shared with
  anyone else:
    - `abuse_track` — enforces rate limits, for example on registration,
      login and account-recovery attempts, so that they cannot be reset by
      discarding the cookie. Kept for one year.
    - `pv_visitor` — counts visits so that site owners can see traffic
      figures for their own sites. Kept for 30 days.

  We also use standard request metadata, such as your IP address, to detect
  and prevent abuse.

## How we use it

We use this information to operate your account, display your public profile
and sites, enforce the Site Rules and Acceptable Use Policy, and prevent
abuse of the Service (spam registrations, brute-force login attempts, and
similar).

## How we protect it

Your password is stored using industry-standard one-way hashing and is never
visible to administrators. Your recovery phrase and password are used to
authenticate account access; because there is no email-based recovery on this
platform, treat your recovery phrase like a password and never share it with
anyone, including anyone claiming to be a site administrator.

## What we don't do

We do not sell your information to third parties, and we do not use your data
for third-party advertising.

## Your choices

Contact and profile fields are optional - leave any of them blank if you'd
rather not share them. Contact information and your PGP key are only visible to
other logged-in users, never to guests.

## Changes to this Policy

We may update this Policy from time to time; the current version always applies
to your use of the Service.