Privacy Policy

What we collect

• Your account: your email address, a hash of your password (never the password itself), an optional username and display name, and, if you sign in with them, your Google or Apple account id, name, email and picture, or your Solana wallet address.
• Plan and payments: your plan, credits and their use, your checkouts (amount, currency, address, and the blockchain transaction that paid it), and your API keys (only a hash of each key and its first characters).
• Requests: for each request to the API, the time, the page or endpoint, the wallet address analysed, how it went, your browser and system type, and your IP address shortened to its network (the last part removed) with the approximate country and city it points to. Full IP addresses are used briefly, in memory, to stop abuse (rate limits), and not stored.
• Explorer projects: the boards you save (their wallets, notes and layout), their name, and whether they're shared. A shared project can be opened by anyone with its link, and shows your display name or username (never your email).
• Emails: the account emails we send you (confirming your address, resetting your password).

The wallets you analyse are public blockchain data. Iris doesn't try to link them to a named person, and its reports only use public information.

Why, and on what basis

• To run your account, your plan and your payments: the contract between us (the terms).
• To keep Iris secure, stop abuse and understand how it is used (with shortened IP addresses only): our legitimate interest.
• To keep records of payments: our legal obligations (accounting).

We don't sell your data, show ads, or use advertising or analytics trackers.

How long we keep it

• Your account and projects: until you delete them (deleting the account deletes its projects).
• The request log: 90 days.
• Payment records: as long as accounting law requires (up to 10 years in France), even after the account is deleted.
• Backups: 14 days, then overwritten.
• Email links: they stop working after 24 hours (confirmation) or 1 hour (password reset).

Who handles it for us

• Vultr (The Constant Company, LLC) hosts Iris and its database, on servers in Frankfurt, Germany.
• Resend sends the account emails, so it receives your address and the email.
• Helius provides Solana blockchain data: it receives the public wallet addresses Iris analyses, not who asked.
• Google and Apple, only if you sign in with them.

Some of these companies are based in the United States. Transfers there rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Cookies and storage

Iris only uses cookies it needs to work: your session, protection against forged requests, and the one-time code of a wallet sign-in. They need no consent, and there are no advertising or analytics cookies. The board you haven't saved as a project is kept in your browser only.

Your rights

You can access, correct, export or delete your data, object to its use, or ask us to limit it. Most of it you can change or delete yourself from your account settings; deleting the account removes it, revokes your API keys and drops your credits. For anything else, write to [contact email]: we answer within a month.

You can also complain to the CNIL (cnil.fr), or to the data protection authority where you live.

Security

Connections are encrypted (HTTPS), passwords are hashed with scrypt, API keys and email links are stored only as hashes, and access to the server is limited to key-based logins.

Changes

We'll update this page when what we collect or how we use it changes, with the date at the top, and tell account holders of significant changes.