Privacy Policy

Squirrel Away collects as little as it can get away with. Here is everything, plainly.

The tracker logs peer IP addresses

Our torrents announce to our own tracker so we can attribute seeding to accounts and show swarm health on each film page. To do that job, a BitTorrent tracker necessarily sees the IP address of every peer that announces to it — that includes you, whether or not you're logged in, whenever your client talks to our tracker. An IP address is personal data, and we treat it that way: it's used only to coordinate the swarm (who has what, who's still seeding) and to attribute traffic to a passkey for logged-in users. We keep raw peer rows for at most 14 days; a periodic job prunes any peer row that's gone stale (the client stopped announcing) past that window. We do not sell, share, or otherwise use this data. Note that this is how BitTorrent works everywhere — any tracker or DHT swarm you join, ours or anyone else's, can see your IP address for the same reason.

How we count downloads

We want to know whether anyone is actually taking titles home, so we count three things, none of which keeps an IP address:

• Tracker milestones. When a peer first announces a torrent and when it finishes, we note the time, the torrent, whether it was one of our own house seeders, whether it was a logged-in account, and the client software named in its peer ID (such as qBittorrent 5.0). The address itself stays only in the 14-day peer rows above, and the milestones are deleted after about 13 months.
• .torrent downloads and fallback webseed requests. Each fetch is counted once per day per visitor. To tell visitors apart without keeping their addresses, we mix your IP address and browser or client name with a random value that exists only in the server's memory for that day — never in our database or its backups — and store only the result. Within about an hour of the day ending that value is erased, and after that nobody, including us, can work out which address produced it. Search engines and other bots are counted only by name. We keep the browser or client family (Firefox, qBittorrent, Googlebot), never the full user-agent string, and delete these daily counts after about 13 months.
• Our own webseed server logs the time, file, response size, and user-agent of each request, with no IP address. Each week we reduce the log to per-day counts by client family, and we delete the raw logs after about two months.

Accounts

An account needs only a username, an email address, and a password. The email is used to confirm the account, to let you log in, and to reset a lost password — nothing else. We don't run ad trackers, and we don't sell or share account data with anyone.

Cookies and scripts

There are exactly two cookies, both set by our own server: the session cookie that keeps you logged in, and a theme cookie that remembers the light/dark toggle. Cloudflare Web Analytics uses a beacon, which gives us aggregate page-view counts. It is cookieless by design — it sets nothing on your machine, identifies no individual visitor, and does no cross-site tracking. There are no ad networks, social-share widgets, or font services calling home to somebody else's server.

We also use self-hosted Umami analytics on public pages to estimate visitors, page views, referring websites, browser/device types, and approximate location. It does not set cookies or receive account identities, torrent passkeys, URL query strings, or URL fragments. Account, sign-in, password-reset, profile, admin, and search pages do not load the Umami tracker; referring URLs are reduced to their website origin. We do not enable session recordings, heatmaps, or advertising profiles.

What we don't do

No behavioral advertising, no data brokers, no cross-site tracking, no fingerprinting. Affiliate links (Amazon, VPN providers) are plain <a> tags — clicking one takes you to the partner's site under their own privacy policy, not ours, and we only know a sale happened after the fact, through the affiliate program's own reporting.

Questions

Reach us at [email protected].