Legal

Privacy Policy

Last updated October 19, 2026 · version 2026-10-19.2

Unthrottled ("we", "us") scores PC stress tests and game runs from sensor logs and suggests what you could try. To do that we store your account, your builds and the runs you send us. This page explains what we collect, why, who else gets it, how long we may keep it, and how to download or delete it. We don't sell your personal data.

The short version:

• Other users can't see your account, runs or builds. The exceptions are averaged figures in community comparisons (which you can switch off), your Arena entries, and any rating we publish.
• The Windows agent sends your sensor readings, your computer's name and details of your hardware. The agent section lists what it sends.
• When you agree to our terms or acknowledge a hardware risk, we record it with your username, email address, IP address and browser, and we may keep that record for up to 3 years after you delete your account.
• Google's ads and cookies only load if you choose Accept all in the cookie banner, and never when your browser sends a Global Privacy Control signal.
• Every ad is labeled "Advertisement", and we don't use affiliate links.
• You can download or delete your data yourself, at any time, from your account page.

What we collect

• Your account. Your username, email address and password. We store the password only as a bcrypt hash, never as readable text. Your first and last name are optional. We also record whether you've verified your email address, whether you agreed to marketing email (the box is unticked unless you tick it), your plan, and whether you've joined the Arena or AI beta.
• Your age band. When you sign up, or the first time you view results on an account created before we asked, we ask for the month and year you were born, to check that you're at least 13 and whether you're under 18. We keep only the resulting age band and when you answered, never your date of birth.
• Records of what you agreed to. When you agree to our Terms of Service, we record which version you agreed to, a fingerprint (a SHA-256 hash) of that exact text, how you agreed (for example, the checkbox on the sign-up form) and when, together with your username and email address at the time, your IP address and your browser's user agent. We also record which version of this Privacy Policy was shown to you at the time. If you agree to the terms in the Windows agent's first-launch notice, the agent (version 0.70 or later) tells us which version of that notice you agreed to and when, and we record it the same way, with the agent's version.
• Hardware-risk acknowledgments. Before Unthrottled shows you detailed steps for a suggestion that involves changing a hardware setting, it asks you to confirm that you understand the risks, and it asks once for a general risk acknowledgment too. We record which suggestion or notice it was and the run it was about, which version of the risk wording you saw, what you chose (to see the steps, or to keep your current settings) and when, together with your username and email address at the time, your IP address and your browser's user agent.
• Your runs. Every sensor log you upload or record with the agent. We keep the log file itself, compressed, on our server, along with statistics we work out for each sensor, such as its minimum, average and maximum. We also keep what you add to a run: its name, notes, ambient temperature, the program or game, and what the run focused on.
• Your builds. The computers, parts and fan curves you enter or the agent detects. If a part isn't in our catalog yet, its name goes on a list we use to improve the catalog.
• Ratings and messages. If you rate Unthrottled in the "How are we doing?" box, we keep your score and comment. If we reply, the conversation is stored with your account.
• Bug reports. The category you choose (a bug, unsafe or wrong advice, a hardware problem after following advice, or a security issue), the email address you give, your subject and description, the page you were on, your browser's user agent string, and any files you attach.
• Contact and advertising forms. Whatever you type in: usually your name, email address and message, plus company and budget on the advertising form. These reach us by email and Discord. We don't store them in our database.
• Sign-in and security records. For each sign-in attempt: the username entered, the time, your IP address, your browser's user agent and whether it worked. When you use a form that could be abused, such as sign-up, password reset, device pairing, bug reports or the contact form, we keep your IP address for a short time to limit repeat attempts. Our web server also keeps standard access logs: IP address, time, the address requested and your browser's user agent.
• Agent downloads. When you download the agent, we record your account, the file, the version of the install notice you confirmed reading, your IP address and your browser's user agent.
• Visits to our public pages. When you open a public page like this one, our visit counter records the page, the kind of source you came from (search, social, another site or direct), the referring site's domain, any utm_source tag in the link, and a short code made by hashing your IP address and browser user agent together. The code lets us estimate how many different people visit without storing your IP address or user agent. Moving between our own pages isn't counted, known bots are skipped, and the counter uses no cookies. Choose Essential only in the cookie banner, or send a Global Privacy Control signal from your browser, and it stops counting you.
• Which of our ads brought you, if you sign up. Our own ads link to us with a utm_source tag that names the ad. If your visit began on one of those links and you create an account during that visit, we keep the tag with your account, and we add one to a daily count of sign-ups for that tag, which isn't linked to you or your account. This tells us which ads bring people who sign up, and how many of those accounts go on to upload a run. It also lets us show the people we pay for an ad, such as a voice artist, what it brought in, as totals only, never who signed up. The tag travels only in the addresses of our own links as you move around the site, never in a cookie. Neither happens if you chose Essential only or your browser sends a Global Privacy Control signal.
• What the Windows agent sends. See the next section.

The Windows agent

The Unthrottled agent is an optional Windows app that records sensor logs and uploads them to your account. It only reads your hardware: it never changes a hardware setting. This is what it sends and what it keeps.

• Pairing. When you link the agent to your account, it sends the pairing code from the website and a device name, which is your Windows computer name. The device name appears in your list of linked devices.
• Every request. Each request to our server includes the device's secret token (which tells us which account it belongs to), the agent's version number and, as with any internet connection, your IP address. From version 0.70, it also includes the version of the agent's first-launch notice you agreed to, and when you agreed. Each time the agent checks in, we update the "last seen" time shown for the device on your Agent page.
• While it runs. The agent reads your sensors continuously so it can show them live, but those live readings stay on your PC. It contacts our server when it starts and then at regular intervals while it's open: the installed version checks for new versions, and once the agent is paired it asks which Arena runs you've signed up for.
• Detect my build. Only when you click it, the agent sends your computer name and a list of your hardware: CPU, graphics cards, memory (total size, number of modules, DDR generation, speed and module maker), motherboard maker and model, and the model and size of each drive that isn't connected by USB. We use this to create or update a build named after your computer. No serial numbers are sent.
• Uploading a run. When you stop a recording, the agent asks you to confirm before it uploads. Arena runs upload automatically when their timer ends. An upload contains the run's name, the program or game, what the run focused on, the Arena entry and run length for Arena runs, and the log itself.

The log has one row per second, each with a timestamp and a column for every sensor the agent can read. That covers:

• the CPU, graphics cards and motherboard sensor chips: temperatures, clocks, power, voltages, fan speeds and load
• memory modules, including their part numbers
• drives, including used space and the total data read and written over each drive's life
• network adapters, including connection names and how much data was sent and received
• the battery, power supply, and cooling or embedded controllers, where your PC has them
• your main display's resolution and refresh rate
• on NVIDIA cards, clock readings and which limits the card hit
• sensor names from HWiNFO, if HWiNFO is running and the agent's HWiNFO option is on (it is by default)
• frame rate (FPS) columns, named after the program that drew the most frames during the run. That is usually your game or benchmark, but it can be any program you had open.

• What it doesn't send. Your Windows username, hardware serial numbers, MAC addresses or a list of your network addresses. It has no usage analytics or crash reporting, and it never uploads your files or browsing history.
• What stays on your PC. The agent saves every run it records as a CSV file in Documents\Unthrottled\logs (or a folder you choose), including runs you decided not to upload. It stores its pairing token in your Windows user profile, and diagnostic files you create from its troubleshooting tools are saved in Documents\Unthrottled. Uninstalling the agent doesn't delete your saved runs, so delete that folder yourself if you want them gone.
• The CPU sensor driver. Reading CPU temperature and power on Windows needs a kernel driver. With your permission, the agent installs PawnIO, a signed driver made by a third party. PawnIO stays installed until you remove it, even if you uninstall the agent, because other monitoring tools can use it too. You can remove it from Windows Settings, under Apps, then Installed apps.

Prefer not to install the agent? Log a run with HWiNFO and upload the CSV yourself. We then receive only the file you choose, with whatever columns HWiNFO recorded.

Why we use it

We use your information for these purposes, each with a legal basis under data protection laws such as the GDPR:

• To provide the service you signed up for. Analyzing and scoring your runs, keeping your history and builds, running the agent and the Arena, and sending the email the service needs, such as verification and password reset messages. We need this information to provide Unthrottled to you. Your age band is part of this too: it decides whether your account can be created and whether detailed tuning steps are shown.
• To keep Unthrottled secure and working. Sign-in records, rate limits, server logs, backups, agent upload diagnostics and bug reports help us protect accounts, stop abuse, fix problems and recover from failures. This is our legitimate interest in running a safe, reliable service.
• To keep a record of what you agreed to. Agreement records, hardware-risk acknowledgments and agent download records let us show which terms and risk notices you agreed to, when and from where, including for up to 3 years after you delete your account, so we can establish or defend legal claims. This is our legitimate interest in being able to show what was agreed.
• To understand how people find us. The cookie-free visit counter shows which public pages get visited and where visitors come from, and the ad tag kept at sign-up shows which of our ads lead to accounts, and to accounts that upload a run. This is also a legitimate interest, and choosing Essential only, or sending a Global Privacy Control signal, turns both off for you.
• To show how your runs compare. Community comparisons pool averaged results from everyone who hasn't switched them off. This is a legitimate interest that benefits every user, and you can opt out.
• With your consent. Google's advertising cookies (only if you choose Accept all), marketing email (only if you ticked the box) and publishing your rating on our home page. You can withdraw your consent at any time.
• When the law requires it. For example, keeping payment records if you buy a paid plan, or answering a valid legal request.

What other users can see

Other people can't see your account, runs or builds, with three exceptions:

• Community comparisons. Unless you switch it off, the averages from your runs are pooled with other people's to show how a run compares with other builds. Only averaged sensor figures are used, never your name, username, build names or files. You can switch this off under Privacy & data on your account page and still see comparisons yourself.
• The Arena. The Arena is an invite-only beta with shared leaderboards. If you take part, other Arena users can see your first name (or your username, if you haven't given a first name), the main parts in the build you used, the programs you ran and your scores. They don't see your email address, your build's name or notes, or your other runs. Arenas you create, with their names and descriptions, are visible to other Arena users too.
• Ratings we publish. If you rate Unthrottled 75 or higher, we may show your rating and comment on our home page with your first name (or your username). We review every rating before it appears, and we'll take yours down if you ask.

Who receives it

The people who run Unthrottled can see account details, runs and builds when we need to, for example to answer a support request or fix a problem. We also use these service providers, who handle data on our behalf:

• DigitalOcean hosts our servers and backups in the United States.
• Brevo sends our email, such as verification and password reset messages and our replies to you. It also delivers contact messages, advertising inquiries, ratings and bug reports to our own inbox.
• Discord carries notifications to the people who run Unthrottled: each new rating (with your name, username, email address, score and comment), contact messages, advertising inquiries, bug reports, a daily summary of site activity, and, if an existing account answers the age question as under 13, its account number and username (never the date of birth).
• Google serves ads through AdSense, but only after you choose Accept all. Google then receives your IP address, browser details and the page you're on, and sets its own cookies (see Ads and cookies).
• Anthropic runs the optional AI deep analysis. It only runs when you ask for it, and then we send Anthropic the run's statistics and findings, run names, build names, part names and any notes you've written on the build. We don't send your name, email address or username.
• Stripe processes your payment, only if you buy a paid plan. Stripe handles your card details under its own privacy policy. We receive your plan, its status, its renewal date if it has one, and Stripe's reference numbers for your purchase, never your full card number.

We may also disclose information when the law requires it, or when it's needed to protect our users or the service. We don't sell your personal data.

Where it's processed

Our servers are in the United States, so your data is stored and processed there. The providers above may also process it in the United States or other countries. If you use Unthrottled from outside the US, your data is transferred to the US, where data protection law may differ from the law where you live.

How long we may keep it

These are the longest we keep each kind of data. They're limits, not promises: Unthrottled isn't a storage or backup service, and we may delete data sooner, for example when it's old, when a feature changes or ends, or if Unthrottled closes. Keep your own copies of anything you want to keep.

• Your account, runs and their log files, builds, ratings, messages and Arena entries: for as long as your account exists, at most. You can delete runs and builds before then, and deleting a run deletes its log file too.
• Your age band: for as long as your account exists, at most. It's deleted with it.
• Records of what you agreed to, hardware-risk acknowledgments and agent download records: while your account exists, and for up to 3 years after you delete it. After deletion they're kept apart from the deleted account, with the username, email address, IP address and browser details recorded with them, so we can show what was agreed if there's a dispute. After 3 years at the most they're deleted, and download records are anonymized (we keep only the count). The one exception is an account that told us its owner is under 13: its records are deleted with it.
• Sign-in records: up to 180 days, and no longer than your account exists.
• IP addresses kept to limit repeat attempts: up to 7 days.
• Agent upload diagnostics (agent version, run length, how many readings a run had and whether the upload worked): up to 90 days.
• Password reset and email verification links: reset links expire after an hour and verification links after 7 days. We only store a hash of each link.
• Bug reports and their attachments: until we delete them. Reports you sent while signed in are deleted with your account.
• Contact messages, advertising inquiries and notifications: these stay in our email inbox and Discord, not in our database, for as long as we need them to deal with your message.
• Visit counter records: currently kept with no end date. We're working on a shorter limit.
• The ad tag on your account: for as long as your account exists, at most. It's deleted with it. The daily count of sign-ups per ad isn't linked to anyone, so there's nothing in it to delete.
• Web server logs: deleted automatically after about two weeks.
• Backups: we may keep backup copies of our database, each for up to 90 days, so something you delete can stay in a backup until that copy is deleted. Backups are only for recovering from a failure. We don't promise that a backup exists, or that anything can be restored from one.

When you delete your account we also keep one anonymous record: how many runs and builds you had, how old the account was, whether it was a paid account, and the reason you picked for leaving, if any. It holds no name, email address or files.

Ads and cookies

Unthrottled is free to use and supported by ads. Ads we sell directly are served from our own server. We count how many times each one is shown and clicked, as daily totals, without recording who saw or clicked it. Every ad, whether we sold it or Google filled the space, carries a visible "Advertisement" label. We don't use affiliate links, so we aren't paid when you buy a part we mention.

These are the cookies we set ourselves. None of them are used for advertising or analytics:

• Session (PHPSESSID): lets you sign in and stay signed in as you move between pages, and protects our forms against cross-site request forgery. Lasts up to 30 days.
• Keep me signed in (ut_remember): set only if you sign in with Keep me signed in ticked. Lasts up to a year. Signing out removes it.
• Your cookie choice (ut_consent): remembers your answer to the cookie banner for a year.
• Closed ad strip (ut_slot_dismissed): if you close the ad strip at the bottom of the app, this keeps it closed for 24 hours.
• Age check (ut_hold): set only if the age question is answered with an age under 13, so the same browser can't simply answer again straight away. Lasts 24 hours.

If you choose Accept all, we also load Google AdSense to fill ad space we haven't sold. Google sets its own cookies, typically __gads and __gpi, to show ads, limit how often you see the same one and measure them. Google and other ad companies may use cookies to show you ads based on your visits to this and other sites. Read how Google uses information from sites that use its services. You can turn off personalized ads in Google's Ads Settings and opt out with many other ad companies at aboutads.info/choices. Opting out doesn't remove ads. It stops them being personalized.

If you're in the European Economic Area, the UK or Switzerland, Google may then show its own consent message, which asks for your choices about personalized ads and keeps your answer in its own cookies. While it applies to you, Ad choices in the footer reopens that message so you can change your answer.

If you choose Essential only, no Google code loads on our pages, our visit counter skips you, and no ad tag is kept if you sign up. Before you choose, the visit counter runs but Google's code doesn't load. You can change your answer at any time with Cookie settings in the footer of every page.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat that visit as Essential only, whatever you chose in the banner: no Google code loads, our visit counter skips you, and no ad tag is kept if you sign up.

Your theme and sidebar preferences are kept in your browser's local storage, not in cookies, and aren't sent to us.

Download, correct or delete your data

• Download it. Download my data on your account page gives you a zip file of spreadsheets (CSV) plus one JSON file, covering your profile, builds, runs and their results, ratings, messages, bug reports, linked devices, sign-in history, agent downloads, and your records of what you agreed to and acknowledged. Passwords and security tokens are left out. You can download the original log for any run from that run's page.
• Correct it. Change your email address and name on your account page, and edit your runs and builds in the app. Usernames can't be changed.
• Delete it. Delete any run or build whenever you like. Delete account on your account page is immediate and permanent: it removes your profile, builds, runs and their log files, ratings, messages, Arena entries, linked devices and settings. Your records of what you agreed to and acknowledged, and your agent download records, may be kept for up to 3 years afterwards, as explained under How long we may keep it.
• Unlink a device. Unlink an agent device on your Agent page and its token stops working straight away.
• Stop contributing to comparisons. Switch off community comparisons under Privacy & data on your account page.

Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it
• have it corrected if it's wrong
• have it deleted. Records we keep to establish or defend legal claims, such as what you agreed to, may be kept for the period above even after you ask
• receive it in a portable format, which is what Download my data gives you
• object to how we use it, including where we rely on legitimate interests
• withdraw any consent you've given, at any time. This doesn't affect what we did before you withdrew it.
• complain to a data protection authority. In the EU, the UK or Switzerland, that's the authority where you live or work.

You can do most of this yourself from your account page. For anything else, including withdrawing from marketing email, send us a message through our contact form. We may ask you to write from the email address on your account so we know it's you, and we'll reply within one month.

If you live in California

California law gives residents rights over their personal information. Whether or not that law applies to a service of our size, we offer the same rights to everyone: to know what personal information we collect, use and disclose (this policy sets it out, and Download my data shows what we hold about you), to have it deleted or corrected, and to opt out of its "sale" or "sharing". We don't sell personal information. If you choose Accept all, Google receives your IP address and the page you're on so it can choose an ad, which California law may count as "sharing" for advertising. Choose Essential only, through Cookie settings in the footer, to opt out. A Global Privacy Control signal from your browser opts you out as well. We won't treat you differently for using any of these rights.

Security

Connections to Unthrottled use HTTPS. Passwords are stored only as bcrypt hashes, and agent device tokens, password reset links and verification links only as one-way hashes. No service can promise perfect security, but if a breach affects your personal data, we'll tell you as the law requires.

Children

Unthrottled isn't meant for children under 13. You must be at least 13 to use it, or older if the law where you live sets a higher age, and we check this with a month and year of birth. If an account answers that it's under 13, we stop showing its results and review it. If we learn that a child under 13 has given us personal data, we'll delete it. If you think that has happened, please contact us. Accounts of people under 18 don't show detailed tuning steps.

Changes to this policy

When we change this policy, we publish the new version here with a new date and version number, and earlier versions stay available. If a change makes a real difference to how we handle your data, we'll also tell you by email or with a notice on the site.

Contact

Questions about privacy, or a request about your data? Send us a message through our contact form.

All versions: 2026-10-19.3 (current), 2026-10-19.2, 2026-10-19, 2026-10-18.3, 2026-10-18.2, 2026-10-18.