What we collect, and what we can't
IronSeal is built so that we — ConnectDevs — physically cannot read your messages. This page describes the small amount of metadata we do collect, why we collect it, how long we keep it, and how to make us delete it.
The 30-second version
- ✓Your messages are end-to-end encrypted. We see ciphertext only.
- ✓We collect your email, display name, and an avatar if you upload one — that's the account.
- ✓We log who/when for security (login times, IP for rate-limiting) but never message content.
- ✓We don't use advertising, third-party trackers, or analytics that follow you across sites.
- ✓We don't sell or rent your data. Ever.
1. Who we are
IronSeal is operated by ConnectDevs(“we”, “us”, “our”). We are the data controller for personal information processed through this service. For privacy questions or to exercise your rights described below, contact us at privacy@ironseal.app.
2. Data we collect
Every field below is necessary for IronSeal to function. We don't collect anything “just in case”.
| Field | Why we need it |
|---|---|
| Email address (optional, encrypted) | If you provide one. Stored as Fernet (AES-128-CBC + HMAC) ciphertext — server staff can't read it without the encryption key. Used only for security alerts you opt into and for the data-export password |
| Display name | Shown to your contacts so they know who they're talking to |
| Avatar (optional) | If you upload one. Stored as a static file on our servers |
| ECDH public key(s) | Required for end-to-end encryption — published publicly per device |
| Encrypted private-key backup (optional) | If you set a recovery passphrase. Stored as ciphertext only — unreadable to us |
| WebAuthn credential ID | Lets your device's biometric (Face ID / fingerprint) unlock decryption |
| TOTP secret (if enabled) | For two-factor authentication. Stored encrypted at rest |
| Conversation membership | Which users are in which conversations / groups (the “social graph”) |
| Message ciphertext + IV + ephemeral key | The encrypted message itself. We cannot decrypt this. Plaintext never reaches our server |
| Message timestamps + delivery flags | When a message was sent, delivered, read. Required for ordering and read receipts |
| Audit log entries | Login/logout, key uploads, biometric failures, tamper events. Used for your own security view in Settings |
| IP address (transient) | Used only for rate-limiting and abuse detection. Not retained in long-term logs |
3. What we don't collect
- ✕Message content. Encrypted in your browser before transmission; the server only ever holds ciphertext.
- ✕Your private keys. Generated and stored locally on your device (in IndexedDB).
- ✕Your passphrase. Used locally to derive an encryption key — never transmitted.
- ✕Your contacts list from your phone or email. We never read your address book.
- ✕Location data. No GPS, no IP-based location tracking.
- ✕Behavioural analytics. No Google Analytics, no Meta Pixel, no Hotjar, no session-replay.
- ✕Advertising IDs. We don't advertise; we have no use for them.
4. How we use the data
We process the data above only to:
- →Authenticate you and keep your session secure
- →Relay encrypted messages between participants
- →Show contact requests, presence (online/offline), and read receipts
- →Detect and rate-limit abuse (brute-force logins, message spam)
- →Send transactional email — password resets, contact-request notifications
- →Comply with legal obligations (court orders, tax law)
We do not use your data to train AI models, build advertising profiles, or sell to data brokers.
5. Legal bases for processing
For users in the UK, EEA, or other GDPR-equivalent jurisdictions, our legal bases are:
- CONTRACTOperating your account, relaying messages, and providing the service you signed up for.
- LEGITIMATESecurity logging, rate-limiting, abuse prevention, and minimal product analytics.
- CONSENTOptional features such as encrypted private-key backup, biometric registration, and TOTP setup.
- LEGALCompliance with applicable laws — court orders, tax records, anti-fraud rules.
6. Sub-processors we use
We rely on the following third-party services. None of them ever receive plaintext messages.
| Provider | Purpose | Data shared |
|---|---|---|
| Railway | Application + database hosting | Account data, ciphertext, audit logs (encrypted at rest) |
| Vercel | Frontend hosting / CDN | HTTP request logs (IP, path) for short-term debugging |
| Cloudflare | DNS + DDoS protection | IP address at the edge — not retained by us |
| Resend (or equivalent SMTP) | Transactional email | Email address + the message body of password-reset / notification emails |
All sub-processors are bound by data processing agreements. We'll update this list 30 days before adding any new sub-processor that handles personal data.
7. How long we keep things
| Account data (email, display name) | Until you delete your account, then purged within 30 days |
| Encrypted messages | Until the recipient's configured TTL expires, the sender deletes them, or the conversation is deleted |
| One-time-view messages | Auto-deleted within 10 seconds of being viewed |
| Public keys | Until you revoke the device or delete your account |
| Audit logs | 90 days, then automatically purged |
| IP addresses (rate-limit cache) | Up to 15 minutes |
| JWT refresh tokens | 7 days, rotated on every use |
8. Your rights
Depending on where you live, you have the right to:
- →Access — request a copy of the personal data we hold about you
- →Rectify — correct any inaccurate information
- →Delete — close your account and have your data purged. You can do this yourself in Settings → Account → Delete account
- →Export — download your account data as an AES-256 password-protected archive. You can do this yourself in Settings → Account → Export your data; the unlock password is emailed to you
- →Object — to processing based on legitimate interests
- →Withdraw consent — for any feature that requires it (biometrics, key backup, TOTP)
- →Lodge a complaint — with your local data protection authority
Email privacy@ironseal.appto exercise these rights. We'll respond within 30 days.
Important: by design, we cannot recover the contents of your messages. If you lose your device and your recovery passphrase, your past messages are unrecoverable — even by us. This is a feature, not a bug.
9. California residents (CCPA/CPRA)
If you live in California, you have additional rights under the CCPA/CPRA:
- →The right to know what personal information we collect (covered in §2 above)
- →The right to delete it (covered in §8 above)
- →The right to correct inaccurate information
- →The right to opt out of “sale” or “sharing” of personal information — we do neither, so this is not applicable, but the right exists
- →The right to non-discrimination for exercising any of the above
10. Children
IronSeal is not directed at children under 13 (or 16 in the EEA / UK). We do not knowingly collect personal data from children. If you believe a child has created an account, contact us at privacy@ironseal.app and we will delete the account promptly.
11. International data transfers
Our servers are hosted in the United States. If you are accessing IronSeal from outside the U.S., your data will be transferred to and processed in the U.S. Where required, we rely on Standard Contractual Clauses or equivalent safeguards. Because message content is end-to-end encrypted, transferring ciphertext across borders carries no additional disclosure risk — the U.S. server sees the same encrypted bytes as everyone else.
12. Security
Beyond the end-to-end encryption that's the entire point of IronSeal, we apply standard industry safeguards on the server side:
- →HTTPS / TLS 1.3 for all transport
- →HSTS, CSP, and modern security headers
- →Database encryption at rest
- →Short-lived JWT access tokens (30 minutes) with rotation + blacklisting
- →Rate limiting (20 req/min anonymous, 120 req/min authenticated)
- →3-strike lockout on biometric / PIN failures
- →Optional TOTP two-factor authentication
See our Security Whitepaper for the full cryptographic specification.
13. Breach notification
If we ever suffer a data breach affecting your personal data, we will notify affected users and the relevant data-protection authority within 72 hours of discovery, where feasible. The notification will describe what happened, what data was affected, and the steps we're taking. Because messages are end-to-end encrypted, a server-side breach would expose ciphertext only — not message content.
14. Changes to this policy
If we make material changes, we'll email you (and post a banner in-app) at least 14 days before they take effect. The “Effective” date at the top of this page always reflects the most recent version. Past versions are kept on request — email privacy@ironseal.app.
15. Governing law & contact
This Privacy Policy is governed by the laws of the State of Delaware, United States, without regard to conflict-of-law principles.
Privacy questions, data-subject requests, or anything else: privacy@ironseal.app