Privacy policy

The controller of your personal data is Fortion Networks, s.r.o., Company ID 26397994, registered office Smetanovy sady 333/8, 301 00 Pilsen, Czech Republic, registered at the Regional Court in Pilsen, file C 17708. The full company details are in the terms of service.

For anything about your personal data, including the requests described under Your rights, write to security@tori.host. We have not appointed a data protection officer.

Your account

Your email address, a display name taken from the part of the address before the @, your plan, and when the account was created. The email address is your account: we use it to sign you in and to write to you about the service.

Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).

How you sign in

• Sign-in links. When you ask for one, we keep the address and a hash of a single-use link that works for 15 minutes.
• Sessions. A signed-in browser holds a session token that works for 30 days. We keep only a hash of it, how you signed in, and when.
• API tokens. For each token you create, or the command-line tool creates when you sign in on a computer: its name (the CLI names it after the computer’s host name), the first characters, a hash of the secret, and when it was created, last used and revoked. We never keep the secret itself.
• GitHub or Google. If you choose to sign in with one of them, the provider tells us your account’s identifier there and your verified email address. We keep the provider’s name, that identifier and the address it was linked through. We do not keep any access token from the provider and do not act on your provider account.

Legal basis: performing our contract (Art. 6(1)(b) GDPR), and our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

What you deploy

Your apps and their settings, the files and source code you upload, the container images built or supplied for them, their environment variables, custom domain names, build logs, what your apps write to their standard output and error (application logs), and the contents of managed databases with their nightly copies. Environment variables and database passwords are encrypted at rest. We use all of this only to build, run and serve your apps and to show it back to you.

Legal basis: performing our contract (Art. 6(1)(b) GDPR).

Billing

If you buy a paid plan, you pay through Stripe: card details are entered on Stripe’s pages and never reach our servers. We keep the identifier of your customer record at Stripe, your subscriptions (plan, status, billing period), your invoices (number, amounts, tax, status, links to the invoice) and the payment notifications Stripe sends us.

Legal basis: performing our contract (Art. 6(1)(b) GDPR), and our legal obligation to keep accounting and tax records (Art. 6(1)(c) GDPR).

Email we send you

Sign-in links, a notice when a GitHub or Google account is connected to yours, and notices about a failed payment. We do not send marketing email.

Legal basis: performing our contract (Art. 6(1)(b) GDPR).

Security and operation

A record of actions taken on accounts (who, what, on which object, when); counters that limit how often sign-in and other requests can be made, which store a hash of the address or network address they count and never the value itself; and the technical logs of our servers, which contain the IP address, time and path of requests to tori.host, my.tori.host and api.tori.host.

Legal basis: our legitimate interest in keeping the service secure, preventing abuse and fixing faults (Art. 6(1)(f) GDPR).

Visiting our websites

tori.host sets no cookies and runs no analytics or third-party scripts; its fonts are served from tori.host itself. It asks api.tori.host for the current plan table, which is an ordinary request our server logs record. The console at my.tori.host keeps your session token in your browser’s local storage so that you stay signed in; it is not used for anything else and disappears when you sign out.

Your apps may collect personal data of their own users, for example in a database or in their logs. For that data you are the controller, and we process it only on your behalf and only to provide the service. We do not look at it, use it for our own purposes, or give it to anyone, except where the law requires us to.

We do not sell personal data and do not share it for advertising. These parties receive some of it:

• Stripe, which processes payments for paid plans. It receives your email address and payment details and keeps the payment records. Stripe is a global company and may process data outside the EU under its own safeguards, as its privacy policy describes.
• Lettermint, an EU email provider, which delivers the email we send you. It receives your email address and the message.
• GitHub and Google, only if you choose to sign in with them. You have your own account with them, under their terms and privacy policies; they learn that you signed in to Tori.
• Let’s Encrypt, which issues the HTTPS certificates for custom domains you connect. It receives the domain name, and like every publicly trusted certificate, the certificate is recorded in public Certificate Transparency logs.
• Public authorities, when the law obliges us to hand data over.

Your apps run, and their files, databases and database copies are kept, in Tori’s location in Prague. Your account, billing records and application logs are kept in Tori’s control plane, and its backups on a separate object store. All of it is on infrastructure that Fortion Networks operates in the EU. Data leaves the EU only through the parties named above, as described there.

• Your account, with its sign-in records, API tokens, connected sign-in providers and account history: while the account exists. When you ask us to close it, we delete it and your apps within 30 days, except what we must keep for billing records.
• Deployed files. For a static site, the live version and the 5 versions before it, for rollback; older ones are deleted, and deleting the app deletes its files. For a server app, every container image built or supplied for it stays in our image registry while the app exists: we do not yet remove older images automatically, and deleting the app does not remove them by itself. We remove them when you ask, and when your account is closed, within 30 days. Source code uploaded for a build on our servers is deleted once that build can no longer be retried.
• Application logs: 7 days.
• Managed database copies: the last 7 successful nightly copies of each database.
• Backups of our control-plane database (accounts, apps, settings, billing records): 30 days. Data you delete therefore remains in backups until they expire.
• Invoices and payment records: 10 years from the end of the year they belong to, as Czech accounting and VAT law requires.
• Technical server logs: 30 days.

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you (access and portability);
• have it corrected if it is wrong;
• have it deleted, or its use restricted;
• object to processing we base on our legitimate interest.

Write to security@tori.host from the address of your account. We answer within one month. To close your account and delete its data, write to the same address. You can delete an app, and revoke API tokens, yourself in the console.

You can also complain to a data protection supervisory authority: in the Czech Republic, the Office for Personal Data Protection, or the authority where you live or work.

Every connection to Tori is encrypted with HTTPS. Sign-in links, sessions and API tokens are stored only as hashes. Environment variables and database passwords are encrypted at rest. Each customer’s apps run isolated from other customers’ code. If you find a security problem, write to security@tori.host.

Tori is not intended for children, and you must be 18 or older to create an account.

When this policy changes, we publish the new version here with a new date. If a change affects how we use data you have already given us, we tell you by email before it takes effect.