Account and session
Torn ID, display name, account role and status, sign-in times, a hashed session token, session expiry, and login IP address.
PRIVACY & DATA USE
A plain-language account of your data.
This notice explains what The Risk Exchange collects, why it is needed, where it is processed, and the choices available to you.
Last updated 24 August 2026
1 · WHO THIS COVERS
Risk Exchange and its operator
The Risk Exchange is a Torn-related entertainment service at riskexchange.7zp.dev, operated by 7ZP [3742399]. This notice applies when you visit, sign in to, play on, or contact the service. Risk Exchange is an independent service and is not operated by or affiliated with Torn or Vultr.
Credits and Xanax references in the service relate only to Torn in-game items and records. Risk Exchange does not accept real-money deposits or payment-card details.
2 · TORN API LOGIN
Exactly how your key is used
Your Public Only Torn API key is submitted to Risk Exchange over HTTPS. The server uses it immediately to call Torn's key-info and basic-user endpoints, confirm the key's access level, and obtain your Torn ID and current display name. The raw key is held only in application memory for that request, is not written to the database or logs, is not used for automation, and is not shared with anyone other than Torn.
| Data storage | Data sharing | Purpose of use | Key storage & sharing | Key access level |
|---|---|---|---|---|
| Persistent — until account deletion (Torn ID and display name) | Service owners (Vultr processes hosted data as infrastructure) | Other — identity verification and account association | Not stored / Not shared | Public (Public Only key) |
You can review or revoke keys in Torn at any time. Never provide Risk Exchange with your Torn password or a higher-access API key. Review the official Torn API documentation and terms.
Automatic deposit verification
Players do not provide a second API key for deposits. The operator uses a separate server-side Torn API key belonging to 7ZP to read 7ZP's incoming item-receive logs. Risk Exchange requests log type 4103 and uses only the unique log ID, time, sender Torn ID, received item IDs and quantities, and whether a valid optional reference is present. Transfer-message text is not stored or used to select an account. The sender Torn ID must map uniquely to an active Risk Exchange account; a valid optional reference is associated only when it belongs to that same account. The key is stored only in protected server configuration, is not exposed to browsers, and is sent only to Torn.
| Data storage | Data sharing | Purpose of use | Key storage & sharing | Key access level |
|---|---|---|---|---|
| Persistent — matched transfer evidence and minimal exception records | Service owners (Vultr processes hosted data as infrastructure) | Other — verify incoming Xanax transfers and prevent duplicate credit | Stored privately by the operator / Not shared beyond Torn | Custom key restricted to the required item-receive log where Torn permits; treat as full-access secret |
3 · INFORMATION WE PROCESS
Data created when you use the service
Wallet and transfers
Credit balance, immutable ledger entries, deposit and withdrawal requests, Xanax amounts, reference codes, Torn log or payout references, sender Torn ID for incoming transfers, match or exception reason, cryptographic payload fingerprint, notes, receipts and staff decisions. Full raw item-log payloads are not retained by the detector.
Games and fairness
Game, wager, payout, result, round ID, seeds, commitments, round counters, timestamps and feature state. Poker table-chat messages are visible only to players currently seated at that table and are retained for no more than 48 hours. Public fairness pages can expose round verification data, but not your account identity.
Support and safety
Tickets and messages you submit, notifications, voluntary play limits, cooling-off or self-exclusion settings, account restrictions and related staff notes.
Security and operations
IP address, request time and path, browser or user-agent details available to web-server logs, rate-limit identifiers, administrator actions, error information, audit events and service-health results.
Device preferences
Your browser stores sound, music, volume and spin-speed preferences locally. These preferences do not identify you and are not sent to us merely because they are stored.
4 · WHY WE USE IT
Service delivery, integrity and safety
- Authenticate your Torn identity and keep you signed in.
- Maintain your credit balance, automatically verify exact-match deposits, route exceptions for manual review, process withdrawals and provide receipts.
- Settle games, prove results, enforce configured wagers and manage payout exposure.
- Answer support requests and apply responsible-play controls.
- Prevent abuse, investigate disputes, secure administrator actions, reconcile the ledger, restore the service and meet legal obligations.
- Operate, diagnose and improve reliability without behavioural advertising or cross-site profiling.
Depending on the law that applies, these uses are necessary to provide the service you request, pursue legitimate interests in operating a safe and auditable service, comply with legal obligations, or act with your consent where consent is required.
5 · COOKIES & LOCAL STORAGE
Essential session, optional persistence and preferences
Risk Exchange sets one essential, secure, HTTP-only session cookie after a successful sign-in. The cookie contains a random session token—not your API key—and the server stores only a SHA-256 hash of that token. If you leave Remember me off, the cookie is a browser-session cookie and is removed when that browser session ends; the matching server session also expires after the configured short session period.
If you actively select Remember me on this device, the same type of cookie persists for up to 30 days so that browser can sign you in without another Torn API request. Do not use this option on a shared device. Signing out revokes the current server session and removes its cookie; clearing browser cookies also removes it.
Game audio, volume and speed choices are stored in your browser's local storage so the interface remembers them. Risk Exchange currently uses no advertising cookies, third-party analytics pixels, or cross-site tracking. You may clear cookies or site data in your browser, but removing the session cookie signs you out and removing local storage resets preferences.
6 · HOSTING & DISCLOSURE
Who can process or receive data
The production service and database run on infrastructure supplied by Vultr. Vultr can process hosted data and network metadata as an infrastructure provider under its own terms and privacy commitments. Data may therefore be processed in a country different from your own.
We send your API key and authentication requests to Torn as described above. Torn processes those requests under its own policies. We do not sell personal data, rent player lists, or share data for advertising.
Data may also be disclosed when reasonably necessary to comply with law, respond to a valid legal request, protect players or the service, investigate fraud or security incidents, or establish and defend legal rights. If another provider is added in a way that materially changes processing, this notice will be updated.
7 · RETENTION
Different records have different lifetimes
- Session records expire automatically and are removed after expiry or sign-out; a limited number of active sessions is allowed per account.
- Rate-limit records last only as needed to enforce their security window.
- Rotating web access logs are configured for no more than 30 days and may roll off sooner.
- Account identity and operational records remain while the account is active. Support content remains as needed to resolve requests and disputes.
- Ledger, transfer, game-fairness and audit records are deliberately immutable and may be kept for the life of the service and afterward where needed for reconciliation, fraud prevention, dispute evidence or legal obligations.
- Encrypted backups contain copies of the same database data. Host backup copies are normally rotated after 30 days; a deletion or correction may remain in a protected backup until that backup rotates.
When a record no longer needs to identify you, we may delete it, anonymise it, or restrict its use. Retention may be extended for an active dispute, security investigation or legal requirement.
8 · SECURITY
Controls designed for sensitive records
Risk Exchange uses HTTPS, secure and HTTP-only session cookies, hashed session tokens and rate-limit identifiers, restricted administrator access, authenticator verification for sensitive administrator actions, immutable financial and audit records, encrypted backups, network controls and routine reconciliation. No Internet service can guarantee absolute security, so please report suspected misuse promptly and never include an API key or password in a support message.
9 · YOUR CHOICES
Access, correction and deletion requests
You can stop further API-key use by signing out and revoking the key in Torn. You may ask to see the account information associated with you, correct inaccurate information, close your account, or request deletion or restriction where applicable. Some immutable financial, fairness, security and audit records cannot be altered or erased without undermining ledger integrity, legal compliance or the rights of other players; those records may instead be retained with access restricted or identity minimised where practical.
Authenticated players can contact the operator through private support. If you cannot sign in, send a Torn message to 7ZP [3742399]. We may ask you to verify the Torn account before disclosing or changing account data.
10 · ELIGIBILITY & CHANGES
Use only where permitted
Risk Exchange is intended only for Torn players who are permitted to use this type of service under Torn's rules and the law that applies to them. It is not directed to children. Do not use the service if you are not eligible.
This notice may change when the service, providers, law or operating practices change. Material changes will be highlighted in the service where practical, and the date at the top will identify the current version.
QUESTIONS OR REQUESTS