Privacy Policy

Last updated: September 30, 2026

This Privacy Policy explains what information Ironclad ("Ironclad", "we", "us") collects when you use the Ironclad mobile application (the "App"), how we use it, and the choices you have. By using the App, you agree to the collection and use of information in accordance with this policy.

Ironclad is operated from Australia, and this policy is written to meet the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) — see Section 6 for your rights and how to make a complaint, whichever country you're in.

1. Information we collect

We collect only what the App needs to function:

• Account information. Your email address, and if you sign in with Apple or Google, the identifier those providers give us to authenticate you.
• Profile information. An optional display name and avatar image you choose to set.
• Daily logs. The times, hours and categories you log each day, and the labels you write for your own productive categories, health goals, habits and penalties. Some of these labels may reflect personal or sensitive information you choose to record — they are visible only to you.
• Day notes. Free text you optionally write about a day. It is saved with that day and synced to your account like the rest of your daily log, and it is never shown to other users — not on leaderboards, not in a friend's view of your log, and not in the share image. It is included if you export your data.
• Settings. Your configured wake/bed targets, pillar weights, goals, habits and notification preferences.
• Purchase and subscription status. Whether you hold an active Ironclad Pro subscription, and its renewal date, as reported to us by Apple, Google or RevenueCat. We do not receive or store your payment card details.
• Device and diagnostic information. Basic technical information (such as platform and app version) needed to keep the App running correctly.

2. How we use your information

We use the information above to:

• Provide and operate the App, including calculating your daily score and rank;
• Sync your data across your devices when you're signed in;
• Operate leaderboard features you choose to participate in (see Section 4);
• Process subscription purchases and verify entitlement to Ironclad Pro;
• Send you transactional emails (such as account confirmation or password reset) and, if you opt in, local notifications about your own wake/bed targets;
• Maintain the security and integrity of the App.

We do not sell your information, and we do not use it for advertising. Ironclad has no third-party advertising or analytics trackers.

3. Who we share information with

We share information only with the service providers that help us run Ironclad, each bound to process it only for that purpose:

• Supabase — our database, authentication and file storage provider. All of the information described in Section 1 is stored with Supabase.
• RevenueCat — manages and verifies in-app purchases and subscriptions.
• Apple and Google — process sign-in (if you choose Sign in with Apple or Google) and billing for subscriptions purchased through their app stores.
• Resend — delivers transactional emails on our behalf (account confirmation, password reset).
• OpenAI — automatically checks your display name and profile photo for offensive content before they're shown to other users. Only the name or photo being checked is sent, nothing else about you, and OpenAI does not use it to train its models.

We do not share your information with any other third party, except where required to comply with the law, enforce our Terms of Service, or protect the rights, property or safety of Ironclad, our users, or others.

4. Leaderboards

Ironclad's leaderboards work differently depending on who is looking:

• Friends you've connected with (by exchanging an invite code) always see your real display name, avatar, and a percentage of your own baseline score — never your raw daily data or the labels you've written.
• Strangers on the global leaderboard see a randomly generated alias and a generic avatar in your place by default. You may choose, in the App's Profile settings, to show your real display name and avatar to strangers instead.

No leaderboard row ever exposes your raw scores, the specific goals or habits you've set, or whether any particular penalty or bonus applied to you on a given day.

5. Data retention and deletion

We retain your information for as long as your account is active. You can delete your account at any time from within the App (Profile → Account → Delete account), or by emailing us — see our Account and Data Deletion page for the exact steps. Deleting your account removes your data from our active systems immediately; residual copies in routine backups are purged within 30 days. If you signed in with Apple, we also ask Apple to revoke Ironclad's access to your Apple ID.

Data that never leaves your device (an installation not signed into an account) is never sent to us at all, and is removed simply by uninstalling the App.

6. Your rights, and how to complain

Under the Australian Privacy Principles, you have the right to ask what personal information we hold about you, to access it, and to have it corrected if it's wrong. You can do most of this yourself, directly within the App (Profile → Account); for anything else — including a full export or a question about what we hold — email us at the address in Section 10.

If you're unhappy with how we've handled your personal information, contact us first at the address in Section 10 and we'll do our best to resolve it. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you're located outside Australia, you may also have rights to access, correct, export or delete your information, and to object to or restrict certain processing, under your own local law — the same contact details apply.

7. Children's privacy

Ironclad is not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.

8. Data storage and overseas disclosure

Your information is stored on servers operated by our infrastructure provider, Supabase, located in the United States; Resend (email), RevenueCat (subscription verification) and OpenAI (checking display names and profile photos) may also process information overseas. Under Australian Privacy Principle 8, we take reasonable steps to ensure these overseas recipients handle your information consistently with the Australian Privacy Principles before we disclose it to them, including through our contracts with them. By using the App, you understand your information will be transferred to and processed outside Australia, which may have different data protection laws than your country of residence.

9. Security and data breaches

We use industry-standard measures — including encryption in transit, database-level access controls (Row Level Security), and restricted service credentials — to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we experience a data breach likely to result in serious harm, we'll notify affected individuals and the OAIC in line with the Notifiable Data Breaches scheme under the Privacy Act.

10. Contact us

If you have questions about this Privacy Policy or how we handle your information, contact us at support@getironclad.app.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Governing law: this policy is governed by the laws of Australia.