API Key Security & Encryption

A Limited Access key is read-only by design: there is no request Torn Intel could send that spends your money, moves items, or takes an action in your name. That is a property of the key level itself, not a promise we ask you to take on trust. If you want to verify it, the Torn API documentation lists exactly which selections each access level permits.

What we do read is the game data the tracker is built on: your activity timestamps, personal stats, battle stats, faction roster and rank, company performance, and travel state. The key itself is never returned to your browser: the settings page shows only a short preview so you can tell which key is stored, and every call to Torn is made server-side.

One thing your key does leave our server for, and we would rather say it here than bury it: battle-stat estimates come from BSP, whose API takes the key as part of the request. Fetching an estimate therefore means sending your key to a server we do not run, and we have no visibility into how they log or retain it. It is the only service that receives the key you enter at login. The key saved separately under Limited API Key in your settings is the one sent to FF Scouter, and to nothing else.

Game data, not your key, also leaves for one other service: the AI features send the roster figures they summarise, meaning player names, IDs, levels and war scores, to Groq. Those features run only when you trigger them, and no credential is ever included. Both flows are set out in full in the Terms of Service.

Encryption keys are versioned rather than fixed. Each stored value carries the version that encrypted it, so a new key can be introduced and start encrypting immediately while older values stay readable under the key that wrote them. Rotating therefore needs no mass re-encryption pass, which is what usually makes rotation get postponed indefinitely.

You can remove your key at any time from your settings, which deletes the stored value rather than merely hiding it. You can also revoke it from Torn's own API key page, which invalidates it everywhere at once, including here. Neither action requires contacting us, and neither is reversible from our side.

Everything runs on a single dedicated server in Canada, with the database on the same machine rather than a managed third-party service. Your game data is therefore held in one place by one party, and one person is accountable for that machine, which is the trade-off we prefer at this size.

Four services are the exceptions, and none of them holds a copy of your data: BSP receives your key when a battle-stat estimate is fetched, Groq receives the roster figures an AI feature summarises, and product analytics and advertising receive usage events and standard request data, never your faction figures and never your key. All four are described in the Privacy Policy.

Backups are taken daily and kept on the same host. If you want your data removed entirely rather than just your key, the contact routes on the About page reach the person who can do it.