PALO ALTO, Calif. — In what legal scholars are calling the most transparent disclosure in the history of consumer technology, Torchwise Inc., maker of the free flashlight app of the same name, on Wednesday replaced its 22,880-word privacy policy with a revised document that reads, in its entirety, “lol. lmao even.”
The update took effect at 12:01 a.m. and was announced in an email with the subject line “We’ve updated our Privacy Policy,” which was opened by 0.4 percent of recipients. By dawn, all 141 million of the app’s users had accepted the new terms, an acceptance rate the company said matched the old policy’s exactly.
“Our users told us loud and clear that they wanted a privacy policy they could actually read,” said Torchwise chief trust officer Brennan Holt-Vasquez, standing in front of a slide that showed the old policy as a 31-foot scroll and the new one as a sticky note. “So we listened. We also listened to some other things. That’s covered in the policy.”
Holt-Vasquez stressed that the new version is “materially identical” to the one it replaces. “Nothing about how we collect, use, share, retain, infer, license or monetize your information has changed,” he said. “We just stopped making you scroll for it.”
The change answers a long-standing complaint. Researchers who analyzed more than 50,000 privacy policies spanning a quarter century found that they had grown steadily longer and harder to read. A NordVPN study estimated that reading the policies of the 96 websites a person visits in a typical month would take 46.6 hours. Torchwise’s new policy scores 120.7 on the Flesch Reading Ease test, higher than most picture books, and takes an estimated 0.8 seconds to read, or 1.4 seconds for users who go back over it to make sure.
For a product that turns on a light, Torchwise has always needed a great deal of information. Its previous policy disclosed the collection of precise location, contacts, microphone audio “for ambient brightness calibration” and a category it called “inferred emotional luminance.” The genre has a history. In 2013, the Federal Trade Commission settled with the maker of the Brightest Flashlight Free app over charges that it passed users’ locations and device identifiers to advertisers without telling them. “Every flashlight eventually asks itself what it is really illuminating,” Holt-Vasquez said. “The answer is you.”
Torchwise’s general counsel, who asked not to be named because “it’s in the policy,” walked reporters through how a three-word document legally contains all 22,880 words of its predecessor. “Lol” covers collection. “Lmao” covers sharing with “partners, affiliates, successors and any entity that acquires us in a bankruptcy proceeding.” The spaces between the words govern retention. And “even,” she said, covers “the thing you are thinking of right now. Yes. That too.”
The Policy Decompressor
Tap any part of the new policy to see the legally binding text it stands for. The spaces count. Everything counts.
Clause text is binding in all jurisdictions, including the one you are in, the one you are thinking of moving to and international waters. Reading time assumes 238 words per minute and no breaks for despair.
Privacy advocates were, for once, unsure what to object to. “For twenty years we have said these documents are written to be unread. Now somebody has written one that cannot be misread,” said Dr. Priya Ramaswamy, director of the Center for Informed Consent Studies, whose own research consent form runs 41 pages. “I have never felt so respected and so robbed at the same time.”
The trend lines had pointed this way for some time. In February 2025, Mozilla removed a line from its Firefox FAQ saying it would never sell users’ data, citing broad legal definitions of “sale.” In January, Starlink updated its policy to let third-party collaborators use personal information to train AI models. And in 2025, the DNA of millions of 23andMe customers went up for sale in bankruptcy court along with the office furniture. “Everyone else is still writing it out longhand,” Holt-Vasquez said. “We’re early adopters of brevity.”
Regulators moved quickly. Within hours, a state attorney general’s office sent Torchwise a letter requesting “clarification of the scope and meaning of ‘lmao,’ ” to which the company replied with a 40-page supplemental disclosure that reads “rofl” on every page. The European version of the policy has been expanded, as the General Data Protection Regulation requires, to “lol. lmao even. (Art. 6(1)(f), legitimate interests).” California users now see a footer link reading “Do Not Sell or Share My lol.” It goes to the homepage. The Federal Trade Commission did not respond to a request for comment, a silence Torchwise’s legal team has entered into the record as “lol (regulatory).”
Competitors are already following. A regional bank shortened its terms of service to “k.” A smart-mattress company adopted a single shrug emoji, setting off a legal dispute over whether a shrug counts as notice. A fitness app tested a policy reading “we know” but dropped it after focus groups called it “too warm.”
Users keep all their rights under state and federal law. Torchwise’s privacy center still accepts every type of data request, each handled by an automated privacy assistant within the statutory 45 days, or immediately, whichever produces the same answer.
Torchwise Privacy Rights Request Center
Choose the right you would like to exercise. Our privacy assistant, Lumen, reviews every request personally and in good faith, as defined in the policy.
Submitting a request confirms your identity, your location, your interest in privacy and your household income bracket. Your request has been shared with our partners so they can respect it.
Some users said they appreciated the candor. “I read it. All of it,” said Denise Furlong, 52, of Tempe, Ariz. “It’s the first contract I’ve ever understood, and what I understood is that I’ve been had since 2014.” Furlong said she then tapped “I Agree,” because the flashlight would not turn on otherwise and she was trying to find her keys.
At press time, Torchwise had pushed one more update, adding a fourth word to the policy in response to user feedback. The company would not say what the word was, noting only that readers who had made it to the end of this article had already agreed to it.
Reader Comments (1,412)