Responsible use

Privacy-pool tracing is for incidents

We follow money through privacy pools, CoinJoins and swap services when it was stolen: a drain, an exploit, a scam. That's what the feature is for, and what we use it for ourselves.

Using a privacy tool is not suspicious, and it's not a reason to trace someone. Don't use Iris to find out who is behind a private wallet out of curiosity, to track a person, or to expose them. Our terms forbid using Iris to harass, dox or stalk anyone, and we close accounts that do it.

We don't name private users

• When we write about a privacy pool, we publish how the leaks work and how often they happen, not who its users are.
• A link Iris finds is a lead, not proof of who controls a wallet. Our methodology says how sure each kind of link is and where it goes wrong.
• In a theft case we name wallets, never people. Only an exchange or an issuer can say who holds an account, and they answer to law enforcement, not to us.

How we disclose to privacy projects

When we find that a pool's users leak through amounts and timing, we write to its team before we publish, and give them time to answer. We say what we measured, and we add their response if they send one. None of it is a flaw in their cryptography: it comes from how the pool is used, and the advice we publish is for users: wait, withdraw a different amount, and keep the two ends apart.

If you run a privacy protocol, we'll measure how much your users leak, privately and for free. Write to bleed@iriscan.app.

For victims

Iris is not a recovery service. We never charge victims upfront, never message them first, and never ask for keys or a seed phrase. Anyone who does in our name is not us. When funds can still be frozen, we prepare the evidence pack and route it to the issuer, the exchange and law enforcement. They decide whether to freeze.

Report abuse or a mistake

Write to bleed@iriscan.app if someone is using Iris to target a person, if a wallet is labeled wrongly, or if you want your address removed from a public case. We read every message and correct what's wrong.

Security issues

If you find a vulnerability in Iris, tell us privately at bleed@iriscan.app with the steps to reproduce it, and give us time to fix it before you publish. Don't access other people's data or disrupt the service while testing. We won't take action against good-faith reports, and we'll credit you if you want.