Privacy Policy

QuoDroid Software Development Private Limited, Kolkata, India. TorchTiger is its brand, and TorchTiger Engineer is its product.

QuoDroid is the controller of your data under UK and EU law, and the data fiduciary under India’s. The one exception is Team workspace data.

On Team, your organisation decides how its workspace data is used, so it is the controller. We process that data for it, as its processor. A data processing agreement (DPA) is available on request.

support@torchtiger.com

security@torchtiger.com

Encrypted under your passphrase (PBKDF2 and AES-GCM). The passphrase is never saved. Unlocked, the key sits in memory-only session storage and never reaches the page.

Encrypted at rest. Each keeps the map that puts redacted values back on your screen, and that map stays on your device.

Every AI change, with the undo copies needed to revert it. It is not encrypted, and it survives Reset.

Write mode for each instance, the instances you have opened and your redaction settings. It also keeps the last four characters of your key, to show it is connected.

How many chats you have sent, up to 30, for a one-time tip about Team, and whether we have asked you for a rating. Neither leaves your device.

None. The site sets no cookies, stores nothing in your browser and runs no analytics.

None. Fonts, icons and videos come from torchtiger.com itself, so opening a page sends nothing to Google or anyone else.

Amazon Web Services stores the site on Amazon S3 and delivers it through Amazon CloudFront. To do that, and to block attacks with AWS WAF, they process your IP address and browser details as each page loads.

We keep no log of your visits. AWS WAF lets us see a small sample of requests from the last three hours, with their IP addresses, so we can check its rules.

Mail to support@torchtiger.com or security@torchtiger.com arrives in our Microsoft 365 mailbox.

Links to the Chrome Web Store, Calendly and others take you to sites with their own privacy policies.

Your work email, name, topic and message. If you give them, your company, what best describes you and how many developers would use TorchTiger.

The form also sends any campaign labels in the page’s address, such as utm_source=linkedin.

Only to reply to your enquiry. No newsletter and no mailing list.

Over HTTPS to our own server, on AWS Lambda in Mumbai. It asks Claude on Amazon Bedrock in India whether the message is spam. Amazon SES then emails it to our Microsoft 365 mailbox, with your address as the reply-to.

Your name, email, company, topic and message, in AWS’s Mumbai or Hyderabad region only. Amazon Bedrock keeps no copy, and Anthropic, which made the model, has no access to it.

A message marked as spam still reaches our mailbox, in a separate folder. The check never deletes anything. If it fails, the message arrives unmarked.

A hidden field and a short-lived page code, fetched when you press Send, keep out bots that post the form directly.

The email in our mailbox is the only record. The server stores and logs nothing you type. It only counts outcomes, such as how many messages were sent or marked as spam.

Our “Book a Call” links open Calendly’s own page, calendly.com/torchtiger/call, in a new tab. We never embed it, so Calendly loads nothing on our pages.

Calendly, LLC runs that page under its own privacy notice. It passes us the details you enter when you book. The call itself is on Microsoft Teams.

Our links tell Calendly which page and which link you used, so we can see where bookings come from.

Steps you ask us to take before a contract. Otherwise, our legitimate interest in answering business enquiries.

Our legitimate interest in keeping sales pitches and automated spam out of our inbox.

Our legitimate interest in running a website that works and stays secure.

We act for your organisation, under our contract with it. As the controller, your organisation decides the legal basis for its members’ data.

Our contract with your organisation.

Legal obligation.

None needed: TorchTiger receives no Community data.

Hosts this website and Team’s servers. Runs the contact form’s server, its spam check (Amazon Bedrock) and its email (Amazon SES). Sends Team’s sign-in codes and invitations.

Microsoft 365 hosts our mailbox and calendar, and Microsoft Teams hosts the calls you book.

Runs the booking page, under its own privacy notice.

Bills Team subscriptions as merchant of record, under its own privacy policy.

Runs Claude for your chats: under your own account on Community, or as your organisation’s AI provider on Team. That is your contract, not ours.

Whichever provider your organisation sets up, such as Amazon Bedrock or its own gateway. Chats go to it straight from your browser.

QuoDroid is based in Kolkata, India. AWS runs the contact form and Team’s servers in its Mumbai region, and the spam check in Mumbai or Hyderabad. Our Microsoft 365 account is registered in India.

Our founder works from the UK and reads our mailbox there.

The website’s hosting is set up in AWS’s US East region. CloudFront delivers each page from an AWS location near you, which may be in another country.

Anthropic, Calendly and Dodo Payments say where they process data in their own privacy policies. On Team, your organisation’s AI provider works where your organisation sets it up.

Keeps nothing you type. The email it sends is the only record. Its error log holds no message content and is deleted after 30 days.

Keeps nothing. Amazon Bedrock keeps no copy.

As long as we need them to answer you and record any work that follows. Ask us to delete yours at any time.

Calendly keeps your booking under its own privacy notice. Our calendar keeps it as long as we need it to hold the call and record any work that follows.

No access log is kept. AWS WAF’s sample of requests covers only the last three hours.

TorchTiger keeps nothing. Data on your device stays until you reset or uninstall the extension, or another account signs in to that browser.

Append-only, and not deleted automatically today.

Also not deleted on a schedule yet. Your organisation can ask us to delete it.

Deleted once our servers confirm receipt, and kept for 7 days at most.

You can ask for a copy of your data, and have it corrected or erased. You can ask us to restrict or stop using it, and to give you data you provided in a portable format. Some rights apply only in certain cases.

Under India’s Digital Personal Data Protection Act 2023, you can ask for a summary of your data and of who we shared it with, and have it corrected, completed or erased. You can also nominate someone to exercise these rights if you die or cannot act, and you can raise a grievance.

Our privacy contact is support@torchtiger.com, and we answer within one month. If our answer does not resolve your grievance, you can complain to the Data Protection Board of India.

You may have rights to know, correct and delete your data. We do not sell or share personal information, as California law defines those terms.

Your organisation controls its workspace data. Ask its administrator first; we help them answer. You can also write to us.

We hold nothing about your use of the extension. If you have written to us, you can ask about that.

Within one month. We may first ask you to confirm who you are.

Tell us first if you can. We acknowledge complaints within 30 days.

In the UK you can also complain to the Information Commissioner’s Office at ico.org.uk. In the EU, contact the supervisory authority where you live or work.

We make no decisions about you by automated means. The spam check only sorts form messages into folders, and it deletes nothing.