Privacy Policy
Torzon Gateway is built to publish information, not to collect it. This page explains exactly what we do and do not see when you visit. Plain language only — if anything below changes, the "Last updated" date above changes with it.
1. What we collect
Nothing optional. The Gateway runs as static files served over HTTPS:
- No analytics scripts (no Google Analytics, no Plausible, no Umami, no Microsoft Clarity, no Hotjar).
- No cookies — first-party or third-party.
- No
localStorageorIndexedDBwrites for tracking. - No fingerprinting (Canvas, WebGL, Audio, Font enumeration are not invoked anywhere on this site).
- No third-party fonts, no third-party CDN scripts. Every asset (fonts, icons, CSS, images) is served from
torzon-gateway.guide.
2. What our hosting provider sees
Any web server that serves a request necessarily processes the request itself. Our hosting provider logs the minimum fields needed to deliver pages and stop abuse:
- Source IP address (transient, used to deliver the response and rate-limit obvious automated abuse).
- Requested URL path.
- HTTP user-agent and referer headers as sent by your browser.
- Timestamp.
We do not aggregate, correlate, sell or share these logs. Standard server-level logs are rotated and purged on our provider's default retention window. We do not retain log copies ourselves.
3. What we never see
- Your identity — no accounts, no sign-ups, no email submission.
- Your location, beyond what an IP address inherently reveals to any server you contact.
- Your browsing history outside this domain.
- Your behavior on this site — we have no event tracking, no heatmaps, no session recording.
- Any traffic that reaches the Tor onion endpoints published here. Those endpoints are operated independently and we do not see your interactions with them.
4. External links
The Gateway links out to torproject.org, F-Droid, the App Store and a handful of bridge directory resources. When you click those links, you are leaving this site and the destination's own privacy policy applies. We do not append tracking parameters (UTM, gclid, fbclid) to any internal or external link.
5. Contact email
The connectivity support address ([email protected]) is hosted on a third party. Messages you send arrive on their infrastructure, governed by their privacy terms. We recommend PGP-encrypting any message you do not want the provider to read in plaintext.
6. Children
This site is informational and not directed at children under 16. We collect nothing, so the question is largely moot, but if you are under 16, please ask a parent or guardian before contacting us.
7. Your rights under GDPR / CCPA
We hold no personal data about you. There is nothing to access, rectify, port or erase on our side. If you believe a server-side log contains identifying information about you, contact us with the timestamp and URL involved and we will request log review from our provider.
8. Security headers
The Gateway is served with HSTS (preload-eligible), a strict Content Security Policy, no Referer leakage to third parties, and a Permissions-Policy that explicitly disables FLoC, Topics API, geolocation, camera, microphone and other browser sensors. These reduce the residual attack surface even before any application-level mitigation.
9. Changes to this policy
If we ever materially change what is collected or who handles it, the "Last updated" date at the top of this page will change and a short summary of the change will be added to News. We do not currently publish a change history page because nothing has changed since launch.
10. Contact
Privacy-related queries: [email protected]. PGP key fingerprint published under Network Security.