Privacy Policy
DRAFT — pending attorney review. Prepared with engineering tooling, not by a lawyer. Items in [[OWNER: …]] or [[ATTORNEY: …]] brackets need a decision before this is relied on.
Last updated: 2026-10-08 · Change log
This policy explains what personal data iambeep.com and the products sold through it (PolyShield, bvpn, Truth Seeker) collect, why, who sees it, how long we keep it, and how you control it. We collect as little as we can: no advertising, no analytics, no tracking cookies, no session replay, and we never sell your data.
1. Who is responsible for your data
The "controller" is Hendrix Cole Odham (an individual, Pennsylvania, USA) [[OWNER: replace with your LLC's exact legal name once formed, and add the registered mailing address or PO box: ______]].
Privacy contact: odhamhendrix@gmail.com [[OWNER: confirm or replace with a dedicated privacy address]]. You can also use the privacy request form.
[[ATTORNEY: if you knowingly offer the service to people in the EU or UK, GDPR Art. 27 / UK GDPR may require appointing a representative there. State the representative here, or record why none is needed.]]
2. What we collect, why, and the legal basis
| Data | Why we use it | Legal basis (GDPR/UK GDPR) | How long we keep it |
|---|---|---|---|
| Email address | Create and secure your account; send account emails | Contract | Until you delete your account |
| Password (stored only as an Argon2id hash), passkey public keys, authenticator-app secret (encrypted), recovery-code hashes | Sign you in securely | Contract | Until you remove them or delete your account |
| GitHub or Google account ID (and name, if shared) | Let you sign in with those providers | Contract | Until you delete your account |
| Confirmation that you are 18+ and accepted the Terms (timestamp and version) | Record eligibility and consent | Legal obligation / legitimate interests (proof) | With your account |
| One-time email links (stored hashed) | Verify your email, reset your password, confirm changes | Contract | 30 minutes, then deleted |
| Security log: event type (e.g. sign-in, password change), time, and your IP address truncated to a /24 (IPv4) or /48 (IPv6) | Detect and investigate account attacks | Legitimate interests (security) | 90 days, then deleted automatically |
| Billing: Stripe customer ID, subscription status, plan and add-ons. Your card is handled only by Stripe and never touches our servers | Provide and bill your subscription | Contract; legal obligation (tax and accounting) | While your account exists; Stripe keeps transaction records as the law requires |
| Licensing: Keygen license key and ID; your email at Keygen; a one-way device fingerprint and monthly file counts (never your source code) | Enforce quota and device limits for PolyShield | Contract | While your subscription/account exists |
| Withdrawal-right acknowledgment (timestamp) recorded at checkout | Prove you asked for immediate access | Legal obligation / legitimate interests | With the subscription record |
| Requests you send us (email, message, reference number) | Answer privacy and support requests | Legal obligation; legitimate interests | 3 years after resolution, then deleted |
| Application error logs (no request bodies, passwords or tokens) | Fix bugs and keep the service running | Legitimate interests | Up to 14 days [[OWNER: enable log rotation to match before publishing]] |
| Optional crash reports from the PolyShield desktop app (if you turn them on) | Fix crashes | Consent (you can turn it off any time) | Per Sentry's retention for our project [[OWNER: confirm Sentry retention setting]] |
We do not collect your name, phone number, date of birth, address, government ID, financial account numbers, health data, or precise location. We do not run web server access logs [[OWNER: confirm Caddy/host logging stays off or is rotated]], and we do not use your data for automated decision-making or profiling.
Providing your email is required to create an account; without it we cannot offer one. Everything else is optional or generated by using the service.
3. Where the data comes from
From you; from GitHub or Google if you choose to sign in with them (we receive the identifier and email they share under your settings with them); and from Stripe (payment status).
4. Who receives your data
We use a small number of service providers ("processors") that act on our instructions. We do not sell or share your personal data for advertising.
| Provider | What for | What they receive |
|---|---|---|
| Hetzner Online GmbH | Hosts our servers and database | Everything we store, encrypted in transit; data center [[OWNER: confirm location, e.g. Germany or Finland]] |
| Stripe, Inc. | Payments, invoices, tax records | Email, customer ID, subscription details, card details you enter directly into Stripe |
| Keygen (keygen.sh) | License keys for PolyShield | Email, license and policy IDs |
| Resend (resend.com) | Delivers our account emails | Your email address and the message |
| GitHub / Google | Only if you choose "Continue with GitHub/Google" | They see that you signed in to us |
| Sentry | Only if you enable crash reports in the desktop app | Diagnostic data (never your source code) |
| Other apps run by the same operator (Truth Seeker and other apps in the suite [[OWNER: list the public ones, and decide whether each needs its own policy]]) | Sign you in without a second account | A short-lived token containing your user ID, email and a member/admin role |
We may also disclose data when the law requires it, to protect rights or safety, or to a successor if the business is transferred (we would tell you first).
5. International transfers
We are in the United States, and our servers are rented from Hetzner [[OWNER: confirm the data-center country]]. Stripe, Keygen and Resend are US companies. If you are in the EU, EEA, UK or Switzerland, your data is therefore transferred to the US, relying on [[ATTORNEY: confirm the mechanism per provider: EU-US Data Privacy Framework certification and/or the EU Standard Contractual Clauses plus the UK Addendum]].
6. Cookies, local storage and tracking
We set only what is strictly necessary to run your signed-in session and keep the site safe — see the Cookie Notice. We do not use advertising or analytics cookies, pixels, fingerprinting, or third-party trackers, so there is nothing to opt out of and no cookie banner. Because we do not track you across sites or services, a browser "Do Not Track" or Global Privacy Control signal changes nothing — and we treat a GPC signal as a valid opt-out of sale/sharing anyway, although we never sell or share data. Fonts and scripts are served from our own domain.
7. Security
Passwords are hashed with Argon2id and checked against a list of known-breached passwords; sign-in supports passkeys and authenticator apps; connections use HTTPS with HSTS; sensitive actions require you to confirm it is you; and we log security events with truncated IPs. Database backups are encrypted [[OWNER: backups are planned, see docs/backup-plan.md — confirm in place before publishing]]. No system is perfectly secure. To report a vulnerability, see our security contact. If a breach affects you, we will tell you and the authorities as the law requires.
8. Your rights — and how to use them
We offer these rights to everyone, wherever you live, even where a particular law would not require it.
- Do it yourself: on your account page you can download your data (JSON), change your email or password, manage sign-in methods, log out everywhere, and permanently delete your account.
- Anything else: use the privacy request form or email us. We may ask you to reply from the address on the account to confirm it is you. We respond within 30 days (the shorter of GDPR's one month and CCPA's 45 days) and tell you if we need more time.
- Rights you have: access, correction, deletion, restriction, objection, portability, and withdrawing consent where we rely on it (withdrawing does not affect earlier processing). Under GDPR/UK GDPR you can also complain to your local supervisory authority (for the UK, the ICO); we would appreciate the chance to fix things first.
- California (CCPA/CPRA) and other US states: you can ask what personal information we hold, request deletion and correction, and opt out of "sale" or "sharing" — which we do not do. We collect these categories: identifiers (email, account IDs, truncated IP), commercial information (subscription records), and internet activity limited to the security log above. We do not collect sensitive personal information other than account log-in credentials (stored hashed) and we use them only to sign you in. You will not be treated differently for exercising a right. If we deny a request you can appeal by replying to our answer, and you may contact your state attorney general.
- Deletion and backups: deleting your account removes your data from our live systems immediately, cancels any subscription, and deletes your Stripe customer and Keygen license where possible. Stripe keeps the transaction records tax law requires. Encrypted backups are kept 30 days, so deleted data disappears from them within 35 days [[OWNER: confirm once the backup schedule in docs/backup-plan.md is running]].
[[ATTORNEY: confirm which laws actually apply to you today at your size. Last checked 2026-10-08: Pennsylvania's HB 78 has not been enacted; the EU Digital Omnibus changes to GDPR/cookie rules are still being negotiated; 19 US states have comprehensive privacy laws, most with revenue or consumer-count thresholds you may not meet.]]
9. Children
Our service is for adults. You must be at least 18 to create an account. We do not direct the site to children under 13 (COPPA) or knowingly collect their data; if we learn a person under 18 has an account we will close it and delete the data.
10. Automated decisions
None. We do not make decisions about you based solely on automated processing that significantly affect you.
11. Links to other sites
Some pages link to GitHub, Google, Stripe and other sites. Their practices are theirs, not ours.
12. Do not sell or share
We do not sell your personal information and we do not share it for cross-context behavioral advertising.
13. Changes to this policy
We will post changes here with a new date, and tell account holders by email if a change is material.
14. Change log
- 2026-10-08 — Full rewrite for the new account system (passkeys, authenticator apps, email verification, security log, data export/deletion, 18+ requirement, Resend and Hetzner added as processors). DRAFT.
- 2026-08-19 — Previous version.
15. Contact
Questions or requests: odhamhendrix@gmail.com [[OWNER: confirm]] · Privacy request form