Legal
Privacy Policy
Last updated: July 18, 2026
IronRecord (“IronRecord,” “we,” “us”) is a civil rights incident-tracking service operated by Resolute Media LLC. You use it to document discrimination and store evidence, which is some of the most sensitive information a person can hold. We treat it that way.
The short version: the records and evidence you create are yours. We don’t sell them, we don’t advertise against them, and we don’t share them with anyone unless you tell us to or the law forces us to. This page explains what we collect, why, who processes it on our behalf, and how you stay in control.
Information you give us
- Account details. Your email address and password (passwords are hashed by our authentication provider — we never see them), and an optional display name.
- Incident records. Everything you enter when you log an incident: the category, title, description, date, location, the names, roles, and organizations of people involved, badge numbers, witness names, and any notes. Enter only what you choose to.
- Evidence files. Photos, audio, video, and documents you upload to an incident. These are stored in a private bucket protected by row-level security, reachable only through your authenticated account or a share link you create.
- Billing information. If you subscribe to Premium, our payment processor collects your payment details. We receive a customer ID and subscription status — we never see or store your full card number.
Information collected automatically
We keep basic operational logs (timestamps, error diagnostics, and the general request data any web host records) to keep the service running and secure. We do not run third-party advertising trackers, and we do not build advertising profiles about you.
How we use your information
- To provide the service — store your records, calculate filing deadlines, generate PDF reports, and let you share with an attorney.
- To send you account and service email, including deadline reminders you’ve enabled and receipts for payments.
- To secure the service, prevent abuse, and debug problems.
- To comply with the law when we are legally required to.
We do not use the contents of your incidents or evidence for marketing, and we do not use them to train machine-learning models.
When we share information
We share your information only in these situations:
- When you ask us to. When you create an attorney share link, the person who has that link can view the records you shared for as long as the link is active. You can revoke it at any time, and you can see how many times it has been viewed.
- Service providers (subprocessors). Vendors that run the infrastructure beneath IronRecord process data on our behalf under contract, only to deliver the service:
- Supabase — database, authentication, and encrypted file storage
- Stripe — payment processing for Premium subscriptions
- Resend — transactional and reminder email delivery
- Vercel — application hosting
- Organizations. If you use IronRecord under an organization license and choose to share an incident with your organization, its administrators can view what you shared.
- Legal requirements. If we are compelled by valid legal process, we may disclose information. Where we are lawfully able to, we will tell you first.
We never sell your personal information.
How your data is protected
Records and files are isolated per user through row-level security, so one account cannot read another’s data. Evidence lives in a private storage bucket that is not publicly accessible. Traffic is encrypted in transit. No system is perfectly secure, but the product is built so that your records are visible only to you and the people you deliberately share them with.
Data retention and deletion
Your records stay until you delete them. You can delete individual incidents and evidence at any time from your dashboard. You can also delete your entire account from Settings — this removes your profile, incidents, evidence files, and share links. Backups and logs age out on a rolling basis after deletion. We may retain the minimum billing records we are legally required to keep.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. IronRecord is built so you can exercise most of these yourself from the dashboard. For anything else, email us at the address below and we’ll help. We will not discriminate against you for exercising these rights.
Children
IronRecord is intended for adults. It is not directed to children under 13, and we do not knowingly collect their information.
Changes to this policy
If we make a material change, we’ll update the date at the top of this page and, where appropriate, notify you by email. Continuing to use IronRecord after a change means you accept the updated policy.
Contact
Questions about your privacy or this policy? Email hello@ironrecord.org. IronRecord is operated by Resolute Media LLC.