Privacy

1. What Cortex asks of you

No API key. No account. No sign-in. No email. Reading the auction database and running the companion script require nothing from you, on desktop or in Torn PDA. Neither has a field that takes a credential.

Two narrower cases are set out below, and neither applies to the database or the script.

• The Elimination board sends the Torn name or id you type into it, because it cannot rank an opponent without knowing who it is ranking against. See section 4.
• That board has one page where a player can donate a Torn API key so it can refresh faster. You have to open that page and paste one. Nothing asks you for a key, and the board works the same either way. See section 2.4.

A separate, unlisted preview of a parked account tool does accept a Torn key from people given access to it. That tool is not part of the public product, and its key handling is described at the point a key would be entered rather than here.

2. What Cortex holds

2.1 Auction sale records

The auction database is built from completed sales that Torn published through its official API. Each sale becomes one row holding the item, perk, roll, rarity, quality, price, bid count and the time it sold, plus an identifier for the individual copy that changed hands. Each row also carries the buyer's and seller's player names and player ids, exactly as Torn reported them.

Those are Torn character names: the handle chosen in the game and the number Torn assigned to it. They are not real names, and nothing in this database can connect one to a person outside Torn. Every field came from Torn's public API, and stays on the relevant profile and in Torn's own sale records whether this site exists or not.

If you have bought or sold ranked-war gear at auction, some of these rows describe your trades, and the item page displays them: your character name beside the price, linking to the same profile Torn links to. What Cortex changes is the reach of that record, not whether it is public.

Sale rows are not attached to a Cortex account, because there are none, and they do not record who looked them up.

2.2 Faction snapshots

Once a day, a scheduled job records one row for every Torn faction from the official snapshot feed: name, tag, respect, member count, and the member player ids in that faction on that day. Torn's own feed retains about a week, and measuring faction turnover needs longer.

If you belong to a faction, your player id appears in that day's row. The tool built to read these snapshots is parked and not publicly reachable. The recording runs regardless.

2.3 The Elimination board

During Torn's Elimination competition, torncortex.com/elimination serves a target board for one team. It is public and unauthenticated, so anyone holding the address can read it. It holds more about more people than the rest of the site combined, and none of them were asked.

Per participant it holds:

• Torn player id and character name
• level
• current status, such as hospital or travelling
• the time of their last action
• an estimate of their battle stats
• a running count of how often they act, described below

Every team's roster is stored, not only the opposing ones. Torn enrolled roughly 22,000 players in the 2026 competition, and each appears as a row carrying a link to their Torn profile and an attack link.

The last item is derived rather than read. Comparing one roster sweep with the next shows whether a player acted in between, and those comparisons are added up per player over the course of the event. Cortex keeps counts, not a log: how many intervals a player was observed for, and in how many of them they acted. It holds no record of what anyone did, only that they did something. The board uses it to work out which hours of the week a team is at the keyboard.

All of it arrives from Torn's official API and from FFScouter, and none of it is a credential. It is a list of players compiled to work out who is worth attacking, which is what the competition is.

One further record is about the person reading the board rather than the players on it. The board shows how many people are reading it, and to count them it stores one row per open page: a random number your browser invents when the page loads, and the time that page last checked in. It checks in every 20 seconds while the page is visible. The number is not derived from you, your address or your Torn account, it is not written to your browser's storage, and a new one is made the next time you open the page. Rows older than a few minutes are deleted, so closing the page removes it within the minute.

2.4 Keys donated by other players

The Elimination board refreshes faster when it can spread its Torn requests across more than one account, because Torn's rate limit applies per account. Some players have donated a Torn API key for that purpose. The board has a page for it, linked from its footer, where a player pastes a key and sets how many requests a minute the board may use it for.

For each donated key, Cortex stores:

• the key itself, encrypted with AES-GCM under a secret held outside the database, so a copy of the database alone does not reveal it
• the owner's Torn player id, and their character name if they gave one
• the key's access level and the request rate its owner set
• when it was added, when it last worked, and how many requests have been spent through it

A donated key is used only to read the public Torn endpoints the board depends on. It is sent to Torn in a request header, never in a URL. Requests made with it count against that account's own Torn rate limit and appear in that account's API log. The board asks for a Public key, which is Torn's lowest access level.

A donor takes a key back by pasting it again on the same page, which deletes the record. There is nothing to log in to, because possession of the key is the only proof involved. Deletion is complete rather than nominal, because the encrypted copy is the only one held. See section 8.

2.5 Information stored in your browser

Two things, both local to your device: auction prices already loaded, so a repeat visit is quick, and interface preferences such as theme. Clearing this site's storage removes both.

3. Where the information comes from

Torn's official API supplies the auction sales, the faction snapshots, and the rosters, levels, statuses and scores on the Elimination board. FFScouter supplies the battle-stat estimates on that board. Nothing is scraped from Torn's website, and a field the API did not return is shown as missing rather than estimated.

Neither the site nor the companion script contacts Torn on your behalf. Neither carries a key that would let it. A separate collection service does that, using the key belonging to Cortex and the keys players have donated.

4. What leaves your browser

Loading a price sends the Cortex price service the item, perk and roll on your screen, and nothing else: no key, no account, nothing that identifies you. That service is a public read-only API. Anyone can query it directly, so the sale records in section 2.1 are as reachable there as they are on this site.

The Elimination board is the one exception on this site. It sends the Torn name or id you type into it to the Cortex Elimination service. That service matches the name against the rosters it already holds, and asks Torn if it has not seen you before. The answer is cached for the rest of the competition so the same lookup is not repeated.

The companion script prices the listings on the Auction House page you already have open. It asks for the items, perks and rolls in front of you, plus the copy ids of those specific listings, so it can report whether a copy has sold before. A copy id names an item, never a person. It reads only the tab you are viewing, only while that tab is visible, and does not poll or run in the background.

5. Cookies

The auction database and the companion script set no cookies.

The Elimination board sets one. Opening a board link that carries an access token stores that token in a cookie named elim_token, so the plain address works afterwards. It is marked HttpOnly, Secure and SameSite=Lax, page scripts cannot read it, and it holds the shared access token and nothing about you.

Cloudflare may set a cookie of its own when its bot check challenges a visitor. That belongs to Cloudflare's infrastructure, and Cortex neither reads nor stores it.

6. Third-party services

Three, and each one's role is limited to what is described here.

Cloudflare

Hosts and delivers this site, the price service and the Elimination board.

As the host it sees what any host sees: your IP address, your browser user agent and which pages you asked for. It terminates the connection’s encryption, and its bot check may set its own cookie.

FFScouter

Supplies the battle-stat estimates shown on the Elimination board.

Cortex asks it about Torn player ids, using a key belonging to Cortex. No request to FFScouter comes from your browser, and nothing about you is sent beyond the ids being asked about.

jsDelivr

A public CDN. The Elimination board’s Activity tab loads the ApexCharts library from it when you open that tab.

Opening that tab reveals your IP address to jsDelivr. The file is pinned to an exact version and checked against an integrity hash, so a substituted file will not run.

There is no analytics service, no tracking pixel, no advertising network, and no font loaded from another host. Apart from the charting library named above, the Elimination board embeds its own fonts and all twelve team sigils, so a tool used mid-competition does not depend on anyone else answering.

7. How long information is kept

Auction sale rows are kept indefinitely, with no automatic deletion. The database exists because Torn's own auction history does not reach far back, so expiring rows on a timer would remove the reason for holding them. Faction snapshots are kept on the same basis.

Elimination data lives in its own database, separate from the auction sales, and records a two-week event rather than a permanent archive. Two days after the competition closes the whole database is deleted: rosters, battle-stat estimates, presence counts and donated keys. That is a scheduled job in the service, not a promise to remember: it runs once, empties every table, and the board stops collecting.

A donated key is kept until its owner asks for it back, until it stops working and is ejected, or until that deletion, whichever comes first.

8. Corrections and removal

On your device, clearing this site's storage removes everything held locally. There is no account to close and no key of yours to revoke.

Off your device, the answer differs by what is being asked about.

Auction sale rows

A completed sale cannot be un-published. Editing a character name out of the database would not hold: the collection service reads that same sale back from Torn whenever it fills a gap or re-checks an item, and its write puts the name back. Cortex therefore does not offer removal of a name from a sale row. The row lasts as long as Torn publishes the sale, which is as long as anyone can read it inside Torn.

A row that is wrong

This can be fixed. If a price, a name or a date does not match a sale you were part of, report it and it will be checked against the underlying record.

Elimination data

The whole competition database is deleted two days after the event, on a schedule, and can be deleted sooner on request. An individual roster row is a different matter: while the competition runs, the board re-reads every roster from Torn each minute, so a row deleted now returns within the minute.

A donated key

Deleted on request, and the deletion is complete: the encrypted copy in the database is the only one held, and removing the row removes the key. It can also be taken out of rotation without being deleted.

9. Security

Volunteered API keys are encrypted before they are written, and the secret that decrypts them is held outside the database, so a copy of the database on its own yields nothing. Those keys travel to Torn in a request header rather than a URL, which keeps them out of logs that record addresses. The site, the price service and the board are served over HTTPS only.

Everything else described on this page is either already public inside Torn or stored on your own device, so it holds no secret of yours to protect. No method of storage or transmission can be guaranteed against every attack.

10. Age

Cortex is a tool for people already playing Torn and is not directed at children. It has no accounts, no sign-up and no contact details to give, so it gathers nothing from a visitor of any age. The player records it holds come from Torn's public API, not from the people reading the site.

11. Changes to this policy

The date at the top of this page is the date it last changed. When what Cortex does with data changes, this document changes in the same release, and the change is listed in the public changelog. There is no mailing list to notify, so the date and the changelog are the record.

12. Contact

Questions, a correction, or a request about a donated key: message Shield [3516052] in Torn. If a statement on this page does not match what the code does, that is a bug worth reporting.

For where the numbers come from and what they cannot tell you, see the data policy.