Legal

Privacy

Last updated: 29 August 2026

The short version

Torwarden is software you run on your own infrastructure. Your monitoring data never reaches us: no telemetry, no usage reporting, no crash reporting and no update check. Not a metric, not a hostname, not an aggregate.

One thing does leave a licensed instance. It checks its licence key against Polar, our payment provider, roughly twice a day, so that a cancelled or refunded licence stops working. That request carries the licence key and nothing else — no machine identifier, no host count, no list of what you monitor. An instance on the free tier makes no such request at all.

This page is therefore in two parts: what the software does with data, and what this website does.

The software

What it collects

Torwarden collects what you point it at: system metrics from hosts running the agent, results of HTTP and TCP checks against endpoints you configure, certificate details for those endpoints, and the alerts, comments and audit entries your team generates. It also stores the accounts you create, including password hashes and session identifiers.

Where it goes

Into two SQLite database files in your data directory. Nowhere else. You are the controller of that data; we are not a processor of it, because we never receive it.

What leaves your network

Only what you configure:

• Notifications to the channels you set up — email, webhooks and similar. These go directly from your server to the destination you chose.
• Domain expiry lookups, if you enable them for a certificate. These query a public RDAP registry for the domain name in question. They are off unless you turn them on, per certificate.
• Licence validation, on a licensed instance: the licence key is sent to Polar roughly twice a day, so a cancelled or refunded licence stops working. Nothing about your estate travels with it — no machine identifier, no host count, no list of what you monitor. An instance on the free tier makes no such request.

That is the complete list. Everything else stays inside your perimeter.

Deletion and retention

Retention is yours to set, per resolution, in the settings. Deleting a host removes its registration and its series; its historical samples age out with their retention window. Nothing requires our involvement.

Diagnostic bundles

If you send us a diagnostic bundle for support, it is built deliberately to be safe to share: it carries versions, schema state, counts and recent log lines, and excludes hostnames, credentials, certificate keys and the values of configured settings. We hold what you send us only for as long as the support conversation needs it.

This website

This site is static HTML, CSS and images. It sets no cookies, runs no analytics, embeds no video and loads nothing from a third-party domain — every asset, including the screenshots and the stylesheet, is served from this site.

It is hosted on a server we run, behind Cloudflare, which acts as a content delivery network and reverse proxy. Cloudflare therefore processes your request on its way to us, including your IP address, under its own terms as our processor.

Our web server records ordinary access logs: your IP address, the page requested, the time, the referrer and your user agent. These are kept for 10 days and used only to operate and secure the site. We do not build profiles from them and we do not share them.

Buying a licence

Payments are handled by Polar, which acts as the merchant of record. When you buy, you transact with Polar rather than with us: they take your payment details, handle VAT and issue the invoice. We never see or store your card details.

From Polar we receive what we need to support the account — your email address, the plan you bought, and its status. Polar's own privacy notice governs what they do with the rest.

The public demo

The demo at demo.torwarden.com is a real Torwarden watching a synthetic fleet. The hosts in it are generated; none of them is a real machine and none of the metrics describe real infrastructure.

It is a shared, read-only account. Signing in creates a session and writes ordinary access log entries, the same as any page here. Please do not enter anything into it you would not want another visitor to see — everyone uses the same login.

Your rights

Where data protection law gives you rights over personal data we hold — access, correction, deletion, objection and portability — you can exercise them by contacting us. For data inside your own Torwarden installation, those requests go to whoever runs it, not to us; we have no copy.

Contact

Questions about this notice, or a request about your own data, go to support@torwarden.com.