Questions, answered

A small, provably fair gambling site for Torn players. You wager Xanax — the in-game item — on two games:

• Drug Pack Duel — head-to-head. Both players ante, both open ten drug packs, highest Xanax count wins the pot minus rake.
• Mug Run — single-player crash. Multiplier climbs; cash out before the round busts.

Xan in, Xan out. No fiat, no crypto, no payment processor touches the site. The wagering token is the same Xanax you already trade in-game.

Sign-in is the only thing your key is used for. We read it once per sign-in to confirm you own the Torn account that’s signing in, then store an encrypted copy so you can sign in again later. The key is never used for anything else and never leaves our server.

Per Torn’s API terms we’re required to clearly disclose how a service handles your key. Here’s the full picture:

Key access level required

Public is enough. We never need a Limited, Minimal, or Full key.

What we read

One Torn API call per sign-in with selections=basic,profile. We use your Torn player ID, display name, profile image URL, and faction membership (id + name). Nothing else from the response is stored.

When the key is used

Only at sign-in. Once you’re signed in, the stored key is never read or sent anywhere. We do not poll the Torn API on your behalf, do not pull your inventory, events, or messages, and do not share your key with any other service.

Key storage & sharing

Encrypted at rest with AES-256-GCM. The encryption key lives in our server environment, not in the database, so a database leak alone does not expose your API key. We never share your key with third parties, vendors, partners, or other users.

Data storage

Persistent. Your Torn ID, display name, profile image URL, and faction membership are kept for as long as your account exists on this site, alongside your wagering history (rounds, transactions, withdrawal requests). Ask the operator to delete your account and we will.

Data sharing

Your Torn name, ID, and profile image are visible to other players on this site (lobbies, round results, leaderboards) — the same way they’re public on torn.com. We do not sell, syndicate, or otherwise share your data with third parties.

Purpose of use

Identifying you, displaying your account on this site, and (during the alpha test) checking that your faction is on the allow list. Personal-gain / community-tool category — this is a gambling site, not a stats or analytics service.

Rotating or revoking

You can revoke the key any time at torn.com/preferences.php#tab=api. That immediately invalidates the copy we hold. To rotate, sign in again with the new key — we overwrite the previous one. Old keys are not retained.

If you’d rather not paste a key, you can’t sign in — there’s no email/password fallback. The key is the entire identity proof.

Before each round we generate a 32-byte random server_seed and publish only its SHA-256 hash. You contribute (or accept the default) client_seed. Each random outcome in the round is HMAC_SHA256(server_seed, "{client_seed}:{nonce}:{i}").

When the round settles, the server seed is revealed. Hash it yourself and compare to the hash that was published before the round started. If they match, we couldn’t have changed the outcome after seeing your move.

The verifier runs the exact same code the server runs at settlement. Paste any settled round’s seeds and reproduce the result locally — no trust required.

Deposits are a single in-game send. There’s no form to fill in on this site first — your Torn ID is the account identifier.

1. Open your Deposit page to see the operator’s Torn account name and the current keyword list.
2. In Torn, send the Xanax to that account. In the in-game transfer message, include any one of the listed keywords (case-insensitive). That keyword is what tells our poller this is a deposit and not some other transfer.
3. A poller reads the operator’s Torn event log every ~30 seconds. When it sees a Xanax receive whose message contains a keyword, it credits the sender’s Torn ID for the exact quantity received.

Typical credit time: under a minute from when the transfer lands in Torn. If you sent before signing up, the credit is waiting on your Torn ID — sign in any time and your balance will reflect it.

If the keyword is missing or misspelled, the poller skips the event and we’ll need to credit by hand — PM the operator with the send timestamp and we’ll sort it out.

Withdrawals are manual on our side. When you request one, we immediately debit your balance (so the same Xan can’t back two requests), ping the operator on Discord, and a human sends you the Xanax in-game and marks the request sent.

Typical turnaround: minutes to a few hours, depending on when the operator is at the keyboard. We aim to clear requests on the same day. Automation is on the roadmap once volume justifies it.

Torn can only transfer whole Xanax, so if your balance has a fractional component (it can — see the rake question below), the remainder stays on your account until your next withdrawal.

• Drug Pack Duel: 3% of the pot, taken at settlement. On a tie, both players get their ante back minus their share of the rake (we floor/ ceil the split so the totals reconcile to the cent).
• Mug Run: ~3% house edge baked into the bust curve. There’s no visible “rake” line — instead, the bust point is drawn from a distribution whose expected return to the player is about 0.97. Verifiable on the verifier.

Rake math is integer-only at the milli-Xan (1/1000 Xan) level internally; the user-facing currency is still “Xan” and balances always show as decimal Xan.

Third-party Xan-wagering sites operate in a tolerated grey area. Torn staff have historically allowed sites that don’t violate API terms, don’t facilitate scams, and don’t touch fiat or crypto. We use only the public/limited-access API key flow, never store full-access keys, and never accept or pay out non-Xan currency.

We’re writing up our compliance posture in detail. Until that’s published: if a Torn staff member ever tells us to change something, we will, and we’ll write about what changed.

Drug Pack Duel: your ante is debited when the round is created. Settlement runs server-side the moment your opponent joins — there is no client-side dependency. If your tab dies, the round still settles, you just see the result on next page load. Cancelled (un-joined) challenges are refunded in full.

Mug Run: the multiplier is computed server-side from elapsed wall time, not from a client tick. If you disconnect during an active round and can’t reach the cashout endpoint, the round will bust at its (already committed) bust point and you lose the wager. We’re flagging this honestly: a slow network costs you a sliver of EV. Rounds in the “ready” state (pre-Go) auto-cancel after 60 seconds and refund the wager, so closing the tab before pressing Go is safe.

The site is run by a single Torn player operating under one Torn account. The operator’s name is shown on your Deposit page once you sign in — that’s also the account to PM for support.

A community Discord is on the way for soft launch; we’ll link it here when it’s up. For now, in-game PM is the fastest channel.