Privacy Policy

1. Introduction and Identity

This Privacy Policy describes how IronOS ("IronOS," "we," "us," or "our") collects, uses, stores, and shares personal information when you use our platform at ironos.dev.

IronOS is an AI-powered growth platform for powerlifting and strength sport coaches. It is operated by:

By creating an account or using IronOS, you agree to the collection and use of information in accordance with this policy. If you do not agree, do not use IronOS.

When coaches use IronOS to collect lead data through capture pages, IronOS acts as a data processor. The coach is the data controller for their leads.

2. Trademark Disclaimer

IronOS (ironos.dev) is a coaching software platform operated by Mustafa Hadi. It is not affiliated with, endorsed by, or related to the IronOS open source firmware project (github.com/Ralim/IronOS), which is a separate product for soldering equipment.

3. What Data We Collect

We collect three categories of personal data:

3.1 Account Data (provided by you)

3.2 Business Data (generated through use)

3.3 Technical Data (collected automatically)

4. Why We Collect It (Legal Basis)

Under GDPR and similar data protection laws, we must have a legal basis for processing your personal data. Here is how each basis applies:

5. How Long We Keep It

We retain data only as long as necessary for the purposes described. After your account is cancelled:

You may export your data at any time from Dashboard > Settings before or after cancellation during the 90-day retention window.

6. Sub-Processors

We share data with the following service providers (sub-processors). Each has been selected for their security practices and compliance posture. We do not sell your data to any of them.

We will notify you at least 14 days before adding a new sub-processor that handles personal data.

7. Your Rights

7.1 EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation:

• Right of access — Request a copy of all personal data we hold about you
• Right to rectification — Request correction of inaccurate or incomplete data
• Right to erasure— Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing — Request that we limit how we use your data
• Right to data portability — Receive your data in a structured, machine-readable format (JSON export)
• Right to object — Object to processing based on legitimate interest, including profiling
• Right to withdraw consent — Withdraw consent at any time for processing based on consent (e.g., analytics)
• Right to lodge a complaint — File a complaint with your local Data Protection Authority

To exercise any GDPR right, email legal@ironos.dev with the subject line "GDPR Request." We will respond within 30 days.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by CPRA) gives you additional rights:

• Right to know — Request what personal information we collect, use, and disclose
• Right to delete — Request deletion of your personal information
• Right to correct — Request correction of inaccurate personal information
• Right to opt out of sale/sharing — We do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of.
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights

We do not sell personal information. We have never sold personal information and have no plans to do so.

To exercise any CCPA right, email legal@ironos.dev with the subject line "CCPA Request." We will respond within 45 days.

7.3 UK Residents (UK GDPR)

If you are located in the United Kingdom, you have equivalent rights under the UK General Data Protection Regulation (UK GDPR) as listed in section 7.1 above. Your supervisory authority is the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies and Tracking

We use a minimal set of cookies: essential (Clerk authentication), analytics (PostHog, opt-out available), and security (Cloudflare Turnstile on public forms). We do not use advertising cookies.

For full details, see our Cookie Policy.

9. Children's Privacy

IronOS is a business platform for coaching professionals. It is not directed at individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we discover that a child under 16 has provided personal data, we will delete it within 72 hours. If you believe a child has submitted data to IronOS, please contact us immediately at legal@ironos.dev.

10. International Data Transfers

IronOS is operated from the United States. If you are accessing IronOS from outside the US, your data will be transferred to and processed in the United States.

For transfers from the EU/EEA and UK, we rely on:

• Standard Contractual Clauses (SCCs) — We use EU-approved SCCs with sub-processors that handle EU personal data
• Sub-processor safeguards — All major sub-processors (Clerk, Supabase, Stripe, Vercel, Cloudflare) maintain their own GDPR compliance programs and offer DPAs

If you require a signed Data Processing Agreement for your use of IronOS, contact legal@ironos.dev.

11. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Article 33)
• We will notify affected users without undue delay if the breach is likely to result in a high risk to their rights
• Notification will include: the nature of the breach, the data involved, likely consequences, and measures taken to address it

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will notify you via email at least 14 days before the changes take effect
• We will update the version number and effective date at the top of this page
• Previous versions will remain available upon request

Your continued use of IronOS after the effective date constitutes acceptance of the updated policy. If you disagree with any changes, you may cancel your account before the new effective date.

13. Contact

If you have questions about this Privacy Policy, want to exercise your data rights, or need to report a privacy concern, contact us at:

We aim to respond to all privacy inquiries within 30 days.