Privacy Policy

The data controller is ARTAD CREATIVE S.R.L., CUI 52756946, trade register no. J2025081187008, registered office at Str. Republicii nr. 8, bl. 8, sc. C, ap. 13, Suceava, jud. Suceava, Romania. Torchlite is a free game hosting service made and paid for by TorchByte.

For anything about your data, email us at [email protected], write to the address above or reach us on Discord.

• Account data: your email address, and the password you set on the panel, which the panel stores only as a hash.
• If you log in with Google or Discord: the email address that account confirms as yours. We do not receive your password there. From Google we keep nothing else; for Discord, see below.
• If you link Discord to your account: your Discord user id and username, the notices our bot sends you, and how long your servers were online each day, for the Discord leaderboard.
• Server data: the game, plan, location and settings you pick, the files you upload to your server, and its console and activity logs.
• Technical data: your IP address, browser user agent and the time of each request, to keep the service secure, stop abuse and enforce the per-account limits.
• One allowance per person: a random browser id and the Discord accounts your account was used with, and what our checks found when you created a server. See One free allowance per person.
• Emails we send you: verification codes, server notices and password resets.
• The forum: your display name, the posts and votes you make and the reports you send. Your name and posts are public. We keep them under a code made from your email, never the email itself. See The forum.
• Our Discord server, if you join it: what our bot keeps there. See Discord.
• Servers you host with us: whatever you and your players put on them. See Servers you host.
• Your choices: the version of the Terms you accepted, with the time and IP address, and a request to delete your account.
• Abuse reports sent through /abuse: what the report says and the name and email you give, kept for up to 2 years after the case closes.

We do not ask for payment details, and we do not sell personal data.

If you choose "Continue with Google", Google asks whether you agree to share your email address with Torchlite. That is the only thing we request, through the "openid" and "email" permissions. We never ask for access to your Gmail, Drive, contacts, calendar or any other Google data.

• What we receive: your email address, Google's confirmation that it is verified, and a one-time sign-in token that proves the login came from Google.
• How we use it: only to log you in to your Torchlite account, or to create one for that address if you do not have one yet. After that the address is used as described in this policy: to identify your account and to send you verification codes and server notices.
• What we store: the email address, as part of your account. The sign-in token is checked once and discarded. We keep no Google access or refresh token, so we cannot reach your Google account afterwards.
• Who sees it: nobody outside Torchlite. We do not sell Google user data, we do not share it except where needed to run the service or where the law requires it, and we never use it for advertising, ad targeting or training AI models.
• Removing it: you can disconnect Torchlite from your Google account at any time in Third-party apps & services. To delete the address from our systems as well, ask us to delete your account, using the contact details above; we delete it together with its servers.

Torchlite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Logging in with Discord works the same way: we ask Discord for your account and its email address (the "identify" and "email" permissions), keep the verified email, and keep no Discord token. Discord also asks you to let us add you to the Torchlite Discord server (the "guilds.join" permission): when you log in, our bot adds you there with the member role, using that permission once. You can leave the server at any time.

A Discord login also links your Torchlite account to that Discord account, which you can also do with /link on our Discord server or "Connect Discord" on the panel's Account page. We then keep your Discord user id, your Discord username and the language you linked in, so our bot can send you your servers' notices in private (renewals, stops, crashes, installs and deletion warnings) and show how long your servers were online on the Discord leaderboard. You choose which notices you get with /notifications, and /unlink or "Disconnect" on the Account page removes the link and those details, except the note that your account was used with that Discord account (see One free allowance per person). The bot's messages travel through Discord, under Discord's privacy policy.

Free servers are limited, so each person gets one allowance. To stop one person from taking many free servers through many accounts, we compare accounts in a few limited ways. We do not ask for a card or an ID, and we do not fingerprint your device.

• A random browser id, only if you say yes to "Fair use" in the cookie choice. Then the page where servers are created gives your browser a random id, kept in the __Host-torchlite_device cookie and, as copies, in local storage and IndexedDB (torchlite-device). It is sent with each server you create and stored with your account. It says nothing about you or your device; it only shows that several accounts made servers from the same browser. Saying no never stops you from creating a server.
• Your Discord account. If you log in with Discord or link Discord, we note that your Torchlite account was used with that Discord user id. The note stays if you unlink Discord later, so the same Discord account cannot start a new allowance on another Torchlite account. Discord user ids contain the date the Discord account was made; we use that date to decide whether a new Discord account can take bigger plans yet.
• Hints for a person only: our admins can see which accounts made servers from the same network address (mobile networks left out) or have email addresses with the same letters, and nothing is decided automatically from them. The separate limit on servers per network address is described under Automatic decisions.

What can happen: when another account that used the same browser or Discord account already has a free server, a new server may have to wait up to a day, may be limited to the Lite plan, or may be refused when that browser or Discord account already has all the servers one person can have. A Discord account made in the last few days can take Lite servers only. These checks run automatically when you create a server. They only decide whether you get another free server; they have no legal effect on you and change nothing outside Torchlite.

Siblings, relatives, a shared family computer: open a ticket on our Discord or email us and explain the situation. A person on our team reviews it and can lift the limit for your account or give it its own limits. Please do not send identity documents; a short explanation is enough, and if needed both people confirming from their own accounts. We keep the decision and a short note with your account, for example the ticket number.

Legal basis: for the checks we run on our side, our legitimate interest in sharing a limited free service fairly and keeping it from being abused (art. 6(1)(f) GDPR). The browser id is stored on and read from your device only with your consent (art. 5(3) of the ePrivacy Directive and art. 4(5) of Romanian Law 506/2004), which you give or withdraw at any time under "Cookie settings".

Your choices: you can ask a person to review any automatic decision, explain your side and contest it. You can object to this processing (art. 21 GDPR); we will look at your case, but without these checks we may not be able to give you a free server. Saying no to "Fair use", or clearing your browser, removes the id from your device and stops it from being sent; the record of which browsers and Discord accounts your account used is kept as long as the account exists and deleted with it.

Posting on the forum needs an account; reading it does not. Your display name, posts and votes are public. We keep them under a code made from your email, so a copy of the forum database names nobody.

• Anyone can report a post with the Report button: we keep the reason, the explanation, the time and, if given, the reporter's email (to tell them what we decide). The author is not told who reported them.
• Moderators, who are named people on our team, can pin, lock and remove posts. When they remove one of yours, you see under it why, when and how to contest it.
• A removed post is hidden at once and its text is erased 30 days later. Reports are kept for 2 years after they are closed.
• When your account is deleted, your posts stay so the threads still make sense, but your name on them becomes "Deleted user" and nothing links them to you any more.

Legal basis: running the forum you use (art. 6(1)(b) GDPR), and our legitimate interest in keeping it lawful and safe, which the Digital Services Act also requires of us (art. 6(1)(f) and (c)).

Our Discord server is moderated with help from our bot. If you join it, Discord shares with us what it shares with every server: your user id, name, avatar, when your account was made, and your messages there. Our bot keeps:

• moderation records (warnings and cases) for 12 months;
• support tickets and their transcripts, which are also sent to you and to a staff-only channel, for 12 months after the ticket closes;
• staff and partner applications, including the age you give, for 6 months;
• a staff-only log of deleted and edited messages and of people joining, for 90 days;
• the notices it sends you in private, for 90 days;
• your bumps, Halloween candy and giveaway entries, while those features run.

The hours leaderboard is public on our Discord server and mentions people by name. Everyone linked to a Torchlite account appears on it by default, including after a Discord login. To leave it, use /leaderboard hide on our Discord server; /leaderboard show brings you back.

Legal basis: running the Discord features you use (art. 6(1)(b) GDPR) and our legitimate interest in a safe community and a lively leaderboard (art. 6(1)(f)), which you can object to at any time with the command above or by writing to us.

What you put on your server and what it collects from the players who join it, such as their names, IP addresses and chat, is your responsibility: for that data you decide why and how it is used, and we only store and run it for you, keep it secure, and use it for nothing else. If your server collects personal data, tell your players.

Our team can open a server's files and console only when it is needed: when you ask for help, to keep the service secure, to look into a report of abuse, or when the law requires it. Network traffic to game servers passes through zero.ms, our DDoS protection provider, which sees the players' IP addresses.

A few rules run by themselves, the same for everyone. None of them has a legal effect on you; they decide what the free service does for you right now. You can always ask a person to review one, explain your side and contest it, on Discord or by email.

• Renewal: a free server that is not renewed in time is stopped. Starting it again gives it a new period.
• Inactivity: a server on which nothing is done for the inactivity period is deleted, after a warning a day before; signing in to the panel alone does not count as activity.
• Memory: when a node runs out of memory, the free server closest to its renewal deadline is stopped, and new starts wait until there is room again.
• Limits: one free allowance per person, at most 3 new servers per network address in 24 hours (12 for mobile operators' addresses), and new accounts only with the common email providers listed on the sign-up page. See also One free allowance per person.
• Ads: Start and Renew in the panel wait for the short ads, and stay locked while an ad blocker stops them from loading.

• To create and run your account and servers (performance of a contract, art. 6(1)(b) GDPR).
• To protect the service and other users from abuse and attacks (legitimate interest, art. 6(1)(f) GDPR).
• To share the free servers fairly, one allowance per person, as described above (legitimate interest, art. 6(1)(f) GDPR).
• To show ads that pay for the free servers (your consent, art. 6(1)(a) GDPR, where the law requires it).
• To meet legal obligations, for example answering requests from authorities (art. 6(1)(c) GDPR).

• A login cookie, set only while you are logged in on the website, and the panel's session and security cookies, while you use the panel.
• A random browser id (__Host-torchlite_device, 2 years, with copies in local storage and IndexedDB), set on the page where servers are created to keep one free allowance per person, only if you say yes to "Fair use" in the cookie choice. Saying no never stops you from creating a server.
• A language cookie (tl-lang), kept for one year, so the pages without a Romanian address open in your language; and the progress of a server being built, kept in your browser's local storage.
• Advertising cookies set by Google and its partners, described below.
• Microsoft Clarity cookies (_clck, kept for one year, and _clsk, for one day), which tell apart visits to the site and the panel so we can see how pages are used. Clarity loads only after you say yes to statistics when the site asks; until then, or after a no, it does not run at all. Your answer is kept in the tl-consent and tl-analytics cookies, shared by the site and the panel. Details are in "Who we share it with".

The Cookie Policy lists every cookie and storage key by name, with how long it stays, and is where you change your answer; "Cookie settings" at the bottom of every page does the same. You can also delete cookies and local storage from your browser settings. Blocking them does not stop the site from working, but you will have to log in again.

The free servers are paid for by ads served through Google Ad Manager. Ads appear on torchlite.host and in the control panel at game.torchlite.host, and starting or renewing a free server asks you to watch a short series of ads. No ads are placed inside your game server itself.

Because the service is paid for by ads, the Start and Renew buttons in the panel do not work while an ad blocker is on. To find out, your browser checks whether Google's ad scripts can load and whether a test element is hidden. The check runs only in your browser; we count, without any identifier, how many visits a day had an ad blocker, and store nothing else about it.

• Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' cookies at aboutads.info.
• For now the ads on the site and in the panel are our own banners, which set no cookies. While Google reviews the site, Google's AdSense script is loaded on our public pages: it shows no ads, but Google receives your IP address and browser details and its consent tool sets the FCCDCF cookie, listed in the Cookie Policy. Before Google ads are shown, the Cookie Policy will list Google's ad cookies and you will be asked for consent first, with personalised ads off unless you turn them on.

Google explains how it uses data from sites that use its services on this page, and how it uses advertising cookies here.

• TorchByte, which provides the hardware and the network the servers run on, in data centres in the European Union.
• No outside email provider: verification codes and notices go out from our own mail server.
• Google: for the ads described above, the AdSense script on our public pages, the fonts on the panel and the status page, and reCAPTCHA, which checks for bots on the panel's login page.
• Cloudflare, which carries all traffic to torchlite.host and the panel and protects them from attacks: it sees your IP address and the pages you request.
• Discord: the server widget on the panel's login page loads from Discord, and our bot's messages travel through it.
• Modrinth, when you browse mods and plugins in the panel: your browser asks Modrinth's catalogue directly.
• zero.ms, which filters attacks on the game servers' network and sees the players' IP addresses.
• Microsoft, through Clarity: on torchlite.host and in the panel it records how pages are used (clicks, scrolling, mouse movement and the pages you open) as heatmaps and session replays, so we can find what is confusing or broken. Text you type into fields is masked before it leaves your browser; in the control panel, and where the site shows your email address, all text is masked, so consoles, files and passwords never reach a replay. We use it only to improve the site, never for ads. Microsoft describes how it handles the data in its privacy statement.
• Google or Discord, only if you choose to log in with them: they learn that you logged in to Torchlite.
• Authorities, when the law requires it.

Our servers are in the European Union. Google, Microsoft, Cloudflare and Discord may process data in the United States; they are certified under the EU-US Data Privacy Framework, and their standard contractual clauses apply as a fallback.

• Verification codes: 10 minutes.
• Security logs: 30 days.
• The panel's activity log (sign-ins, server starts, file changes, with the IP address): 90 days.
• A login on the website: up to 12 hours, or 30 days with "Keep me signed in".
• Account and server data: as long as the account exists. When you delete your account, or ask us to, it is deleted together with its servers 7 days later; until then you can change your mind.
• The forum: posts as long as they are up; a removed post's text 30 days after removal; reports 2 years after they are closed. See The forum.
• Discord: as listed under Discord.
• Backups of our databases: daily copies for 14 days, and copies made before a change for 30 days. Something deleted from the service can stay in them until they roll over.
• Server logs with IP addresses: 14 days for the web servers and the website, 4 weeks for the system logs.
• Browser ids and Discord accounts seen with your account, and notes about exceptions we granted: as long as the account exists, deleted with it.
• Records of the servers you asked for (email address, IP address, plan, game, what our checks found): as long as the account exists, and at most 30 days after it is deleted.

You can ask for access to your data, for it to be corrected or deleted, for its processing to be restricted, for a portable copy, or object to the processing, and you can withdraw consent at any time without affecting what was done before.

If an automatic check delayed, limited or refused a server, you can ask for a person to review it, explain your side and contest the decision.

Right to object: where we rely on our legitimate interest (security, fair use, moderation, the Discord leaderboard), you can object at any time on grounds relating to your situation, and we then stop unless we have compelling reasons or need the data for a legal claim.

You can delete your account yourself on the panel's Account page.

Contact us using the details above and we will reply within one month. You can also complain to the Romanian data protection authority, ANSPDCP.

Torchlite is not meant for children under 16. If you are younger, you need the permission of a parent or legal guardian to create an account.

We may update this policy; the date at the top shows the current version. Significant changes are announced on the site or by email.