Skip to main content

No cookies. No tracking. No analytics.
We don't collect anything.

Legal

Privacy &
Cookies.

What this site actually does — aligned with our code, not marketing copy.

Last updated: 29 August 2026

Summary

IronClad is a privacy toolkit. We do not run analytics, advertising trackers, or behavioural profiling. Most tools execute in your browser; sensitive operations stay client-side where the architecture allows it. We collect only what is required to operate the site securely and to deliver features you explicitly use.

Data controller

The data controller responsible for your personal data is the entity operating this service.

Entity: IronClad

Contact: Secure Channel

Data Protection Officer: Not appointed. This service does not engage in large-scale systematic monitoring of data subjects or processing of special categories of data, so a DPO is not required under Article 37 of the GDPR.

What we do not do

  • No Google Analytics, Meta Pixel, or similar marketing/analytics suites
  • No cross-site tracking or interest-based advertising
  • No sale of personal data
  • No profiling or automated decision-making
  • No search-engine or AI training data leaks: the public marketing pages and blog are indexable by Google, Bing and strategic AI answer crawlers, but archive bots and LLM-training-only scrapers are blocked by robots.txt and a UA-based 403

Legal basis for processing

We process personal data only under a valid legal basis as defined in Article 6(1) of the GDPR:

Browsing traffic, security headers, bot filtering, rate limiting

Art. 6(1)(f) — Legitimate interest (security and abuse prevention).

Authentication cookies and account data

Art. 6(1)(b) — Performance of a contract (providing the authenticated service you requested).

Contact form submissions

Art. 6(1)(f) — Legitimate interest (responding to your inquiry).

CSRF protection

Art. 6(1)(f) — Legitimate interest (preventing cross-site request forgery).

URL scan requests (sent to third-party threat databases)

Art. 6(1)(b) — Performance of a contract (the scan you explicitly requested).

CSP violation reports and security audit logs

Art. 6(1)(f) — Legitimate interest (identifying and preventing security threats).

Cookies

Only essential cookies are set. There are no optional analytics or marketing cookies to enable or disable. No consent mechanism is required because all cookies are strictly necessary for the service.

Cloudflare

Bot management and DDoS protection. __cf_bm or _cf_bm — set by our hosting provider on every visit. Expires after approximately 30 minutes.

Authentication

Set only when you log in. All are HttpOnly, Secure, SameSite=Strict.

  • sb-access-token — Supabase JWT access token (max-age: 7 days)
  • sb-refresh-token — Supabase refresh token for silent renewal (max-age: 30 days)
  • fs_auth_session — Legacy auth session, same token as above (max-age: 24 hours)
  • fs_session_active — Boolean flag indicating an active session (max-age: 24 hours)
  • fs_user_id — Authenticated user identifier (max-age: 24 hours)
CSRF protection

fs_csrf — validates state-changing requests. Secure, SameSite=Strict (max-age: 24 hours).

Localix license

fs_localix_license — set only after a verified Localix purchase, to authenticate download access. HttpOnly, Secure, SameSite=Strict (max-age: 365 days).

Browser storage

We use browser storage for ephemeral tool state, UI preferences, and performance caches. Nothing is used for tracking.

localStorage

  • ironclad_cookie_consent — your cookie preference choice (persists until cleared)
  • ironclad-threat-stats-v1 — threat counter statistics cache
  • ironclad-threat-daily-floor-v1 — threat counter animation floor
  • ironclad-threat-timeline-live-v1 — threat timeline overlay cache
  • ironclad_env_baseline — browser environment integrity fingerprint
  • ironclad_password_settings — password generator preferences
  • language — UI language preference (en, es, fr)
  • vault_{channelId} — operator channel encryption key (IndexedDB fallback only)

sessionStorage

  • ironclad_session_start — tab session timestamp for the session timer
  • ironclad_freshness_state — crypto operation counts for the freshness gauge
  • ironclad_env_pending — environment guard baseline (pending confirmation)
  • ironclad_network_baseline — network status baseline for route-change detection
  • ironclad_password_history — last 10 generated passwords (max 10, cleared on tab close)
  • ironclad_saved_identities — saved ephemeral identities for current session
  • ironclad-threat-timeline-v2:{range} — timeline data cache (1-hour TTL)
  • Various tool-specific ephemeral state (protocol drafts, scan history, pseudonyms)

IndexedDB

  • IroncladVault — encrypted PGP vault (auto-locks after 15 minutes of inactivity)
  • ironclad_channel_vault — operator channel encryption keys

Data we process

Browsing (default)

Standard HTTPS requests pass through Cloudflare. We apply security headers, bot filtering, and rate limiting. Rate-limit identifiers use hashed values in Cloudflare KV — not raw IP addresses in application logs.

Legal basis: Art. 6(1)(f) — legitimate interest (security). Retention: CSP violation reports stored 90 days in Cloudflare KV.

Contact form

Name, email, and message are PGP-encrypted in your browser before transmission. Request type and subject are sent in plaintext for routing. A one-way hashed IP (SHA-256 with salt) is stored with the submission and scheduled for deletion after 30 days.

Legal basis: Art. 6(1)(f) — legitimate interest (responding to your inquiry). Retention: 30 days, then scheduled for deletion.

Account (optional)

If you create an account, credentials and security settings (TOTP, WebAuthn) are managed via Supabase. You can export or delete your account from Account.

Legal basis: Art. 6(1)(b) — performance of a contract. Retention: until you delete your account.

Tools you actively use

Features such as URL Scanner, Beacon, Dead Drop, or Operator Channel only process data you submit. Many toolkit utilities (PGP Vault, Privacy Scanner, pseudonym tools) run entirely in your browser. Server-backed tools store encrypted or minimal operational data with defined expiry.

Legal basis: Art. 6(1)(b) — performance of a contract (the tool you requested). Retention: ephemeral unless stated otherwise.

URL Scanner

When you scan a URL, our server submits it through our API to third-party threat databases (VirusTotal, URLhaus, AlienVault OTX, urlscan.io). Those services maintain their own records of every link queried. The URL leaves your browser only because you requested the scan.

Legal basis: Art. 6(1)(b) — performance of a contract. Retention: ephemeral on our end; third parties retain per their own policies.

Link Cleaner

Link Cleaner traces redirects and strips tracking parameters through our server proxy only. Links are not submitted to third-party threat APIs — only direct HTTP exploration from our infrastructure.

Legal basis: Art. 6(1)(b) — performance of a contract. Retention: ephemeral.

Deep Scan

Deep Scan runs the standard threat-intelligence query plus Qualys SSL Labs and Mozilla Observatory through our API. SSL Labs caches hostname assessments on Qualys infrastructure (not published to public boards by default). Mozilla Observatory stores scan results and may display a public report on MDN.

Legal basis: Art. 6(1)(b) — performance of a contract. Retention: ephemeral on our end; third parties retain per their own policies.

Security logs

Authentication events, CSP violation reports, and error reports may be stored temporarily for abuse prevention — not for profiling. CSP violations are stored in Cloudflare KV for 90 days. Error logs are stored in Supabase with no automatic expiry.

Legal basis: Art. 6(1)(f) — legitimate interest (security). Retention: CSP 90 days; error logs retained until audit review.

Security measures

We implement technical and organisational measures appropriate to the risk, as required by Article 32 of the GDPR:

  • TLS encryption for all data in transit
  • AES-256-GCM encryption for tool-level data (Dead Drop, Beacon, PGP Vault)
  • PGP end-to-end encryption for contact form submissions
  • HttpOnly, Secure, SameSite=Strict flags on authentication cookies
  • One-way SHA-256 hashing with salt for IP addresses (rate limiting and contact form)
  • Client-side processing by default — data never leaves your browser unless you explicitly use a server-backed tool
  • Automatic session lockout after 15 minutes of inactivity (PGP Vault)

Infrastructure & subprocessors

We use the following third-party processors to operate this service. Each processes data on our behalf under written agreements:

Cloudflare — hosting, CDN, bot protection, KV storage. Data may be processed in Cloudflare data centres in multiple regions.

Supabase — authentication and operational database (accounts, beacons, dead drops, contact queue, error logs). Project hosted in the EU (Frankfurt).

Resend — delivers contact-form notifications and Beacon activation emails (encrypted payload). US-based. Contact form payloads are PGP-encrypted before transmission, so Resend processes ciphertext only.

Threat-intelligence APIs — VirusTotal, URLhaus, AlienVault OTX, urlscan.io. US-based. Only URLs you explicitly submit are transmitted.

International data transfers

Some of our subprocessors operate outside the EU/EEA. Where personal data is transferred to a third country, we rely on the following safeguards under Chapter V of the GDPR:

  • Supabase — hosted in the EU (Frankfurt). No transfer outside the EU/EEA for authentication and database operations.
  • Cloudflare — global CDN. Transfers may occur for DDoS and bot management. Cloudflare participates in the EU-US Data Privacy Framework.
  • Resend — US-based. Contact form payloads are PGP-encrypted end-to-end; Resend processes only ciphertext. Transfer under Standard Contractual Clauses.
  • Threat-intelligence APIs — US-based. Only URLs are transmitted (no personal data beyond the URL you chose to scan). Transfer under Art. 49(1)(d) — transfer necessary for important reasons of public interest, or Art. 49(1)(b) — transfer necessary for performance of a contract.

Your rights

Under the GDPR and applicable data protection law, you have the following rights regarding your personal data:

  • Right of access (Art. 15) — request a copy of the personal data we hold about you
  • Right to rectification (Art. 16) — request correction of inaccurate data
  • Right to erasure (Art. 17) — request deletion of your personal data
  • Right to restriction (Art. 18) — request restriction of processing in certain circumstances
  • Right to data portability (Art. 20) — receive your personal data in a structured, commonly used, machine-readable format (JSON)
  • Right to object (Art. 21) — object to processing based on legitimate interest, including for security logging

Account holders: use Delete Account for immediate erasure, or contact us for data export.

Contact submissions: auto-deleted on schedule; email us for early removal.

We will respond to all requests within one month. In complex cases, this period may be extended by two further months, with prior notification.

Data breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by Article 33 of the GDPR. Where the breach poses a high risk, we will also notify affected individuals without undue delay, as required by Article 34.

Complaints

You have the right to lodge a complaint with a supervisory authority under Article 77 of the GDPR if you believe your data protection rights have been infringed. You may also seek a judicial remedy under Article 79.

Questions

For privacy requests or clarifications, use our secure channel.

Contact us