Privacy Policy

This Privacy Policy describes how Ironlake Software LLC ("we", "us") collects, uses, and protects information when you use the Ironlake application and website at ironlake.co (the "Service").

1. Information we collect

Account information: your email address, password credentials (held by our authentication provider, never stored by us in plain form), optional name, and two-factor enrollment status.

Financial information you enter: the Service is manual-first. Entities, accounts, balances, holdings, tax lots, plans, journal entries, documents you register, and encrypted vault notes exist because you typed or imported them. We do not connect to your brokerage or bank.

Usage and technical information: standard server logs (IP address, browser type, timestamps), and page-view analytics on the public marketing site only. The signed-in application carries performance telemetry but no behavioral tracking; the details, including how to verify this, are published at ironlake.co/trust.

Contact requests: if you submit the access-request or contact form, we collect the details you provide (name, email, phone if provided, and any message).

2. How we use information

To operate the Service: authenticate you, store and display your household's information, run the calculations you request, and send transactional email (confirmation, security, and service notices). To secure the Service: rate limiting, abuse detection, and audit records of sensitive actions. To improve the Service: aggregate, non-identifying usage measurements. We do not sell personal information, and we do not use your financial data for advertising.

3. Service providers

We use a small set of processors to run the Service: Supabase (database, authentication, and storage), Vercel (application hosting), Resend (transactional email), Inngest (background jobs), Cloudflare (DNS), and HubSpot (contact and access-request management for the marketing site). Each receives only what its function requires and is bound by its own data-processing terms. The current list is also published at ironlake.co/trust.

4. Encryption and security

All traffic is encrypted in transit. Data is encrypted at rest by our infrastructure providers. Vault notes are additionally encrypted at the application level with AES-256-GCM before storage, and sensitive access is protected by re-authentication when a second factor is enrolled. No system is perfectly secure; report suspected vulnerabilities to security@ironlake.co.

5. Retention and deletion

We retain your information while your account is open. You can close your account from Settings or by contacting privacy@ironlake.co. When you close your account, we deactivate access immediately and retain your data for sixty days in case the closure was unintended, then permanently delete your household's records, including holdings, journal entries, plans, registered documents, and vault ciphertext, from the live systems within the following day. During the sixty-day window you can ask us to reverse the closure at privacy@ironlake.co. Backups age out on our providers' standard schedules. We may retain minimal records where the law requires it, and acknowledgment records of the legal versions you accepted.

6. Your choices and rights

You can access and correct the information in your account from within the Service, and you can generate the reports and export bundles the Service provides. To request a copy of your account information beyond those exports, or to close your account and request deletion, use the closure control in Settings or contact privacy@ironlake.co. If you are a California resident, you have rights under the CCPA to know, delete, and not be sold personal information; we do not sell personal information. If you are in a region covered by the GDPR, you may have rights of access, rectification, erasure, portability, and objection; the Service is currently offered to a US audience, and we will honor verified requests at privacy@ironlake.co.

7. Cookies

The Service uses cookies required for sign-in sessions and security. The public marketing site sets a first-party cookie to remember which public tool referred a visitor and uses page-view analytics. We do not use third-party advertising cookies.

8. Children

The Service is not directed to anyone under 18, and we do not knowingly collect information from children.

9. Changes to this policy

We version this policy. When a new version takes effect, we will present it in the Service and ask you to acknowledge it before continuing; the current version is always available at ironlake.co/privacy.

10. Contact

Ironlake Software LLC, hello@ironlake.co.