Privacy Policy

Squirrel Away collects as little as it can get away with. Here is everything, plainly.

The tracker logs peer IP addresses

Our torrents announce to our own tracker so we can attribute seeding to accounts and show swarm health on each film page. To do that job, a BitTorrent tracker necessarily sees the IP address of every peer that announces to it — that includes you, whether or not you're logged in, whenever your client talks to our tracker. An IP address is personal data, and we treat it that way: it's used only to coordinate the swarm (who has what, who's still seeding) and to attribute traffic to a passkey for logged-in users. We keep raw peer rows for at most 14 days; a periodic job prunes any peer row that's gone stale (the client stopped announcing) past that window. We do not sell, share, or otherwise use this data. Note that this is how BitTorrent works everywhere — any tracker or DHT swarm you join, ours or anyone else's, can see your IP address for the same reason.

Accounts

An account needs only a username, an email address, and a password. The email is used to confirm the account, to let you log in, and to reset a lost password — nothing else. We don't run ad trackers, and we don't sell or share account data with anyone.

Cookies and scripts

There are exactly two cookies, both set by our own server: the session cookie that keeps you logged in, and a theme cookie that remembers the light/dark toggle. Cloudflare Web Analytics uses a beacon, which gives us aggregate page-view counts. It is cookieless by design — it sets nothing on your machine, identifies no individual visitor, and does no cross-site tracking. There are no ad networks, social-share widgets, or font services calling home to somebody else's server.

We also use self-hosted Umami analytics on public pages to estimate visitors, page views, referring websites, browser/device types, and approximate location. It does not set cookies or receive account identities, torrent passkeys, URL query strings, or URL fragments. Account, sign-in, password-reset, profile, admin, and search pages do not load the Umami tracker; referring URLs are reduced to their website origin. We do not enable session recordings, heatmaps, or advertising profiles.

What we don't do

No behavioral advertising, no data brokers, no cross-site tracking, no fingerprinting. Affiliate links (Amazon, VPN providers) are plain <a> tags — clicking one takes you to the partner's site under their own privacy policy, not ours, and we only know a sale happened after the fact, through the affiliate program's own reporting.

Questions

Reach us at [email protected].