1 The short version
If you read nothing else
- Your photos never reach us. Reconstruction and training run entirely on your own GPU. We could not look at your source images if we wanted to.
- Your 3D models never reach us either — unless you explicitly press Publish, which uploads that one model so it can be embedded on your website.
- We run no third-party analytics and no trackers. There is no Google Analytics, no advertising pixel, no session recorder and no third-party script on this website.
- The application does send us anonymous usage counts — how many times a kind of action happened between opening and closing it, which version you are on, your GPU model, and whether it crashed. It never sends the names of your files or projects, or anything about what you are working on. You can switch it off in Settings; clause 4.9 lists every counter.
- We never sell or share your data for advertising, profiling or any other purpose.
- What we do hold is your email address, your licence keys, an anonymous fingerprint of each activated computer, and server logs. That is essentially it.
2 Who we are
The data controller
The controller responsible for your personal data is [LEGAL ENTITY NAME] of [REGISTERED ADDRESS].
Questions, requests and complaints: privacy@torchweave.com.
This policy covers the Torchweave desktop application, the Torchweave capture app for mobile devices, this website, your account, and the splats we host on your behalf.
3 Local by design
The architecture is the privacy policy
Torchweave is a desktop application, not a cloud service. Every computationally interesting thing it does — feature detection, camera pose estimation, training the Gaussian splat, rendering, editing — happens on your own machine, using your own graphics card.
This is not a privacy feature we bolted on. It is how the product works, and it means the most sensitive material you handle — photographs of your products, your premises, your property, and anyone who happens to be in frame — is never transmitted to us and never stored on our servers.
The capture app transfers photos and video from your phone directly to your PC over your own local network, discovered by QR code and mDNS. That traffic does not route through us and is not visible to us.
There are exactly three ways your own content reaches us, and all three are deliberate acts on your part: publishing an asset (clause 4.4), attaching a log or dataset to a support request (clause 4.5), and submitting in-app feedback (clause 4.3).
4 What we collect
Every category, itemised
4.1 Your account
When you sign up we store your email address, a hashed password (Argon2 — we never store, and cannot recover, the password itself), your account status and role, whether your email is verified, and the date you signed up. If you join a waiting list rather than sign up, we store only your email address.
While you are signed in we hold a session record — a random opaque identifier, your user id, and an expiry date — so the site knows it is still you.
4.2 Licensing and activation
This is the data that makes a perpetual licence enforceable, so it is worth being precise about. When you activate the Software, and once per launch thereafter, it sends us:
| Item | What it actually is |
|---|---|
| Licence key | The code issued to your account. |
| Machine fingerprint | A one-way, salted cryptographic hash derived from stable hardware and operating-system identifiers on your PC. It cannot be reversed: we cannot turn it back into anything about your computer, and we do not keep the identifiers it was built from. It is meaningless outside our licensing system, and it is not a browser or advertising identifier. |
| Machine name | The computer's name, so you can tell your own machines apart on the account page when releasing a seat. This can contain your name if you named your PC after yourself. |
| Application version | So we can tell whether a bug is already fixed. |
| IP address & timestamp | Recorded as "last seen" and in our security log. |
The Software does not send us your images, your models, your project files, your file or folder names, a list of your installed programs, or anything about what you are working on.
4.3 In-app feedback and bug reports
If you choose to send feedback or a bug report from inside the Software, we receive your message together with your email address, licence plan, application version, operating system, graphics card model, machine name, machine fingerprint and IP address — plus, if you tick the box, a tail of the recent application log.
The log can contain file paths and project names from your machine. We show you what is being sent before it is sent. If a path would reveal something you would rather we did not see, edit it out or leave the log unattached.
4.4 Published splats
When you press Publish, we receive and store the model file itself, its size and content hash, the title and URL slug you gave it, and a small preview image so your account page can show you what each asset is. See clause 6 for an important note about the resulting URL.
4.5 Support correspondence
If you email us, we keep the correspondence so we have context next time. If you send us a sample dataset to reproduce a problem, we use it only to diagnose your issue and delete it when we are finished.
4.6 Security and audit logs
We keep an append-only record of security-relevant actions — sign-ups, sign-ins, downloads, activations, publishes, deletions and administrative changes — with the account email, the action, what it affected, the IP address and the time. Our web server also keeps ordinary request logs. This is how we detect abuse, investigate a compromised account, and answer "what happened to my licence".
4.7 Payments
Payments are handled by our payment processor. We never see or store your card number. We keep the processor's customer reference, what you bought, and when, so we can honour your licence and issue refunds.
4.8 The capture app
The mobile capture app uses your camera and your device's motion sensors to record the imagery and rough camera positions Torchweave needs. That data is written to your phone and sent to your PC across your local network. [Confirm the exact permission list the published app requests before this goes live.]
4.9 Usage data from the application
The Software keeps a tally, while it is running, of how many times certain kinds of action happened — a training run was started, an export finished, a reconstruction failed. When you close it, that tally is sent to us as a single summary for the session, together with the application version, your operating system, your graphics card model and its memory, how much system memory and how many CPU threads the machine has, how long the session lasted, and how the previous session ended — normally, because Windows restarted or logged off, because the Software reported an error, because it crashed, or unrecorded. It is attributed to your licence key, in the same way a bug report is.
This is the complete list of what is counted:
| Group | What is counted |
|---|---|
| Projects | How many projects were opened, created and saved. |
| Import & export | How many files were imported or exported, by format only (PLY, SOG, SPLAT, glTF, mesh). |
| Reconstruction | How many runs were started, finished, failed or cancelled; total images processed; total seconds spent. |
| Training | The same four outcomes, plus total iterations, total seconds, and the final splat count. |
| Editing | How many edit operations, undos, merges, splits, stitches, clone-stamp strokes and crops were performed. |
| Publishing | How many publishes succeeded or failed. |
| Failures | The error codes shown to you when something fails (for example T-0042), and how many times each occurred. |
| Health | Whether the graphics card ran out of memory or was reset, and how the session ended: normally, because Windows restarted or logged off, because the Software reported an error, because it crashed, or unrecorded. |
Notice what is not in that list, and what cannot be reconstructed from it: no file names, no folder paths, no project names, no image or model contents, no timestamps within a session, and no record of the order things happened in. We learn that ten training runs were started and seven finished. We do not learn what any of them were of.
We turned this on because we cannot otherwise tell the difference between software nobody is using and software that is failing silently — the error-code counts above are how we find out that a step is breaking for people who never got round to reporting it.
Turning it off. Settings → Privacy → Send anonymous usage data. With it off, the Software sends nothing described in this clause. Licensing checks (clause 4.2) continue either way, because they are what makes your licence work.
4.10 Crash reports
If the Software closes unexpectedly, it writes a crash file on your own computer. The next time you start it, it tells you what happened and asks whether to send us the report. Nothing is sent unless you say yes. The report contains a technical snapshot of what the program was doing at the moment it failed and, if you leave the box ticked, a tail of the recent application log — which, as in clause 4.3, can contain file paths from your machine. You are shown what is being sent before it goes.
5 What we never collect
The list that matters most
We do not build profiles of you, we do not make automated decisions that produce legal or similarly significant effects, and we do not enrich your record with data bought from anyone else.
6 A word about your public URLs
Something you should know before you publish
Each account has a public address — a short identifier that appears in the web address of every splat you host with us:
cdn.torchweave.com/a/your-address/product.sog
You choose it yourself when you sign up, and we suggest one based on your email only as a starting point you can overwrite. We do this deliberately: it means nothing about you ends up in a public URL unless you put it there.
Because it is public, pick a name you are happy for customers to see — normally your brand or studio name rather than your own. Anyone who views the source of a page your splat is embedded in can read it.
Published splats are served from public, unlisted URLs. They are not indexed by us and not listed in any directory, but they are not access-controlled and not encrypted — anyone with the link can view and download the model. Do not publish anything confidential.
7 Cookies
One cookie, and it is doing a job
| Cookie | Purpose | Life |
|---|---|---|
| Session cookie | A signed, opaque identifier that keeps you signed in. Set only after you sign in. Marked HttpOnly and SameSite=Lax, and Secure over HTTPS. | 30 days |
That is the complete list. It is strictly necessary to provide a service you asked for, which is why this site shows you no cookie banner — there is no non-essential cookie to consent to. We set no analytics, preference or advertising cookies, and no third party sets cookies through us.
8 Why we're allowed to
Legal bases under the UK GDPR and EU GDPR
| What | Basis |
|---|---|
| Account, licence keys, activations | Contract — we cannot give you a licence, or enforce its terms, without them. |
| Payments and records | Contract, and legal obligation for tax and accounting records. |
| Hosting published splats | Contract — it is part of the Service Subscription you bought. |
| Security and audit logs, abuse limits | Legitimate interests — keeping the service secure and available, and preventing fraud and licence abuse. We have balanced this against your rights and consider it proportionate: the logs are minimal and are not used to profile anyone. |
| Feedback, bug reports, support datasets | Consent — you initiate every one of these, and can decline. |
| Product emails you opt into | Consent — withdrawable at any time, with a link in every message. |
Where we rely on consent, withdrawing it is easy and costs you nothing else; withdrawal does not affect processing already carried out.
9 Who we share with
A short list of suppliers, and nobody else
We do not sell, rent or trade your personal data. We share it only with the service providers we need to run the business, each acting on our instructions under a data-processing agreement:
| Provider | What they handle |
|---|---|
| [Payment processor] | Card payments, invoices and refunds. They see your payment details; we do not. |
| Cloudflare | Content delivery and storage for published splats, and protection against attacks. Sees request metadata including IP addresses. |
| [Email provider] | Account emails — verification, password resets, licence delivery. |
We may also disclose data where we are legally required to — a valid court order, or a binding request from a competent authority. Where we are permitted to tell you about such a request, we will. If the business is ever sold or merged, your data may transfer to the buyer, who would be bound by this policy or one no less protective; we would tell you first.
10 International transfers
Where the data physically sits
Our application servers and database are located in [COUNTRY]. Published splats are distributed by a global content network, which means copies of those files — content you chose to make public — are cached in data centres worldwide so they load quickly for your visitors.
Where personal data is transferred outside the UK or EEA, we rely on an adequacy decision where one exists, and otherwise on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, together with appropriate technical safeguards.
11 How long we keep it
Retention periods
| Data | Kept for |
|---|---|
| Account details | While your account is open, then deleted within [30] days of closure. |
| Licence keys & activations | For the life of the licence. Because licences are perpetual, this is indefinite unless you close your account. |
| Sessions | 30 days, then expired automatically. |
| Published splats | Until you unpublish them, close your account, or [90] days after a lapsed Service Subscription — whichever comes first. See clause 12.5 of the Terms. |
| Security & audit logs | [24 months], then deleted. |
| Feedback & bug reports | [24 months] from submission. |
| Usage data (clause 4.9) | [24 months] from the session it describes. |
| Crash reports (clause 4.10) | [24 months] from submission. The copy on your own computer is yours to delete at any time. |
| Support correspondence | [24 months] after the conversation ends. |
| Payment & tax records | As long as tax law requires — typically 6–7 years. We cannot delete these on request. |
| Waiting-list emails | Until you ask us to remove you, or the list is retired. |
12 Security
What protects it
- All traffic to our servers and CDN is encrypted in transit with TLS.
- Passwords are hashed with Argon2, a memory-hard algorithm chosen specifically to make offline cracking expensive. We cannot read your password.
- Licence tokens are signed with Ed25519; the signing key is held offline and never leaves our control.
- Session identifiers are random, opaque, server-side, and carried in signed HttpOnly cookies.
- Administrative access is limited to those who need it, and every administrative action is written to the audit log.
- Rate limits and per-key abuse controls guard the publish and feedback endpoints.
No system is perfectly secure. If we suffer a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and tell you directly without undue delay where the risk to you is high.
If you believe you have found a vulnerability, please report it to security@torchweave.com. We will not pursue good-faith security research that respects our customers' data and does not degrade the service.
13 Your rights
What you can require us to do
Depending on where you live, you have some or all of the following rights. We honour them for every customer regardless of location, because maintaining two standards is how mistakes happen.
- Access — a copy of the personal data we hold about you.
- Rectification — correction of anything inaccurate.
- Erasure — deletion, where we have no overriding obligation to keep it (see clause 14).
- Portability — your data in a structured, machine-readable format.
- Restriction and objection — including an absolute right to object to direct marketing, which we will action immediately.
- Withdraw consent — at any time, where consent is the basis.
- Complain — to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk). We would rather you came to us first, but it is your right either way.
If you are in California, you additionally have the right to know what we collect and disclose, to delete it, to correct it, and not to be discriminated against for exercising those rights. We have not sold or shared personal information for cross-context behavioural advertising in the preceding 12 months, and we do not do so now.
To exercise any right, email privacy@torchweave.com. We will respond within 30 days. We may need to verify your identity first — usually by confirming you control the account email. We do not charge for this.
14 Deleting your account
What happens, and what survives
Email privacy@torchweave.com and we will close your account. When we do:
- your account record, password hash and sessions are deleted;
- all your published splats are removed from hosting, which immediately breaks any page they are embedded in — unpublish deliberately first if that matters;
- your licence keys are revoked and all seats deactivated.
Deleting your account ends your right to use the Software and does not entitle you to a refund. If you simply want to stop hearing from us, ask us to do that instead — it is not the same thing.
Two things lawfully survive deletion:
- Payment and tax records, which we are legally required to retain.
- Security and audit log entries, which are append-only and exist precisely so they cannot be edited after the fact. We retain them for the period in clause 11, then delete them. Where practical we pseudonymise the account identifier in them on request.
Nothing on your own computer is affected. Your projects, exports and photographs are yours and stay where they are.
15 Children
Not a product for children
Torchweave is a professional tool sold to businesses and adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, tell us and we will delete it.
16 Changes
How you'll know
We will update this policy as the product changes. The current version always lives at this address with its effective date at the top. If a change materially affects how we handle your data, we will email your account address at least [30] days before it takes effect. We will not apply a materially worse policy to data we already hold without telling you first.
17 Contact
Talk to a human
Privacy questions, data requests and complaints:
privacy@torchweave.com
Security reports: security@torchweave.com
Everything else: support@torchweave.com
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
[COMPANY REGISTRATION NUMBER, if applicable]
[EU/UK REPRESENTATIVE, if required — needed if you have no UK/EU
establishment but sell to people there]
If anything here is unclear, ask. A privacy policy nobody understands protects nobody.