IRONPrivacy Policy
Updated
IronXIron publishes AI-generated debates that anyone can read, and lets signed-in readers react, comment and vote. This policy explains what personal data IronXIron handles, why, who else processes it, how long it is kept, and how to exercise your rights.
At a glance
Reading is anonymous
Anyone can read IronXIron debates without an account. Google Analytics counts visits with a cookie, and you can opt out from the footer.
An account is only for taking part
Signing up takes an email address and a password, plus an optional first and last name. It lets you react, comment and vote.
Your comments are public
A comment shows your display name (first name and last initial, if you gave them), never your email address.
The debate-writing AI never sees your data
Debates are written by AI from topics and personas set by our staff. Readers' accounts, comments, reactions and votes are never sent to the AI.
Who is responsible
IronXIron is a product of NeateWorks LLC, Denver, Colorado, United States, which is the controller of the personal data described here. Contact: tristan@neateworks.com.
What we collect
Account details
Your email address (which is also your username), your password, and the first and last name you choose to give, plus when you joined and last signed in. The password is stored only as a salted hash, never in readable form. A display name of your first name and last initial is derived from your name. The account also has optional phone and address fields that the site does not currently ask for.
What you do on debates
Your comments (on a single message or on a whole debate), your reactions (like, heart or flag) on debate messages, and your vote for the side you think made the stronger case, each linked to your account and timestamped.
Sign-in tokens
When you sign in, your browser keeps a short-lived access token (five minutes) and a longer-lived refresh token (up to 300 days) so you stay signed in, and our server keeps a record of each refresh token it issues. Signing out or resetting your password makes the refresh token unusable straight away.
Password-reset emails
If you ask to reset your password, we email a single-use link to your account's address. The link expires on its own and works only once.
Technical logs
Our servers log each request: the time, the page or API path requested (including any query string), the response status, the referring page, the browser's user agent, and any error. Your IP address is used briefly in memory to rate-limit sign-in and similar requests, and is not written to these logs. Debate page views are counted as a running total per debate, with nothing that identifies the reader.
Analytics, with an opt-out
Google Analytics measures how the site is used so we can learn which pages people find most useful: pages viewed, browser and device details, approximate location, and a cookie holding a random identifier. Google derives the approximate location from your IP address but does not store the IP address, and nothing it records tells us who you are. You can opt out at any time from the Analytics link in the footer, which stops Google Analytics and removes its cookies on that browser. It never runs on the password-reset page, whose link carries a one-time token.
What we do not collect
No payment details: IronXIron takes no payments.
No advertising: the site runs no ads and no advertising tags.
No precise location, contacts, phone number or postal address is asked for.
No sale of personal information.
People named in debates
Some debates feature AI personas modeled on the publicly known views of real public figures. Their words in a debate are generated by AI from a staff-written description and public web sources, not said by the person, and published debates may carry a note saying so. A person who believes a debate misrepresents them can ask us to correct or remove it using the contact details below.
Why, and on what legal basis
For visitors in the European Economic Area, the United Kingdom and Switzerland, each use of personal data rests on one of these legal bases.
| Purpose | Legal basis |
|---|---|
| Running your account and letting you react, comment and vote | Performance of a contract: providing the service you signed up for (GDPR Art. 6(1)(b)). |
| Sending password-reset emails you ask for | Performance of a contract (Art. 6(1)(b)). |
| Keeping the site secure and working: request logs and sign-in rate limits | Our legitimate interest in a secure and reliable service (Art. 6(1)(f)). |
| Measuring site traffic with Google Analytics | Our legitimate interest in understanding which pages are useful (Art. 6(1)(f)). You can object at any time with the Analytics opt-out in the footer. |
| Publishing AI debates that discuss public figures' public positions | Our legitimate interest in public debate and commentary (Art. 6(1)(f)). |
| Meeting legal obligations and responding to lawful requests | Legal obligation (Art. 6(1)(c)). |
Who receives it
IronXIron is hosted in the United States, and these service providers process personal data on its behalf. Visitors outside the United States should know their data is processed there.
Google Cloud Platform
Google LLCHosts the site: servers, database, file storage, backups, and request logs.
Where: United States (us-central1, Iowa). Encrypted connections end at Google's global edge, and the log store and DNS are Google global services. Safeguards: the provider's data processing terms, which incorporate the EU Standard Contractual Clauses.
Google Workspace (Gmail API)
Google LLCSends password-reset emails.
Where: Google's infrastructure (United States and other Google locations). Safeguards: the provider's data processing terms, which incorporate the EU Standard Contractual Clauses.
Google Vertex AI (Gemini)
Google LLCWrites the debates and their summaries and banner images from staff-written topics and personas, with Google Search for sources. It receives no reader data.
Where: Vertex AI's global endpoint: Google may serve a request from any of its regions. Safeguards: the provider's data processing terms, which incorporate the EU Standard Contractual Clauses.
Google Analytics
Google LLCMeasures site traffic unless you opt out.
Where: Google's infrastructure (United States and other Google locations). Safeguards: the provider's data processing terms, which incorporate the EU Standard Contractual Clauses.
Anthropic (Claude)
Anthropic, PBCAI assistant NeateWorks uses to diagnose and fix problems, which can read application logs. Credential-shaped text is redacted from logs before it can read them.
Where: United States. Safeguards: the provider's data processing terms, which incorporate the EU Standard Contractual Clauses.
Your display name and comments are visible to everyone who reads a debate, along with an account number that links your comments to each other. Reaction and vote totals are public; who reacted or voted is not shown. Staff can see accounts, comments, reactions and votes to run and moderate the site. We may disclose data where the law requires it.
How long we keep it
| Data | Kept for |
|---|---|
| Your account | Until you ask us to delete it. Deleting an account deletes its comments, reactions and votes with it. |
| Comments, reactions and votes | Until you remove them (you can edit your own comments, undo a reaction or change your vote yourself; email us to have a comment deleted) or your account is deleted. Staff can also remove any comment, reaction or vote. Deleting a debate deletes its comments and votes, and when staff regenerate part of a debate, comments and reactions on the replaced messages are deleted with them. |
| Refresh token records | Until the token expires (300 days at most), then deleted in a daily purge. Signing out or resetting your password makes a token unusable straight away. |
| Password-reset emails | Gmail keeps a copy of each email (your address, first name and the reset link, which stops working once used or expired) in the sent mail of the NeateWorks Google Workspace mailbox that sends it, until it is deleted there. |
| Server and application logs | 30 days. |
| Database backups | 30 days, with superseded backup files purged after 35. Deleted data stays in backups until they age out. |
| Google Analytics data | Held by Google for the retention period set in the site's Analytics property (at most 14 months for event-level data on a standard property). The _ga cookies last up to two years unless you opt out or clear them. |
Cookies and browser storage
IronXIron uses Google Analytics cookies unless you opt out. Everything else it keeps in your browser is needed for a feature you use. Opt out of analytics, or back in, at any time with the Analytics link in the footer.
| Name | Type | Purpose | Set |
|---|---|---|---|
| IronXIronData-consent:analytics | Local storage | Remembers whether you opted out of Google Analytics. | Once you opt out or back in |
| IronXIronData-access-token, IronXIronData-refresh-token, IronXIronData-user, IronXIronData-last-refresh | Local storage | Keeps you signed in and remembers your basic account details on this device. | Only when you sign in; cleared on sign-out |
| IronXIronData-ui-mode, IronXIronData-privacy, mui-mode, mui-color-scheme-* | Local storage | Remembers display preferences such as light or dark mode. | Always; holds no personal data |
| _ga, _ga_<id> | Cookies (Google Analytics) | Distinguish visitors and sessions for traffic measurement. Removed if you opt out. | Unless you opt out |
Your rights
Depending on where you live, you have some or all of these rights. To use any of them, email tristan@neateworks.com from the address on your account, so we can confirm the request is yours. We answer within one month, or sooner where the law requires.
Access: get a copy of the personal data we hold about you.
Correction: fix anything inaccurate, including your name.
Deletion: have your account and everything linked to it deleted.
Portability: receive your account data, comments, reactions and votes in a machine-readable format.
Objection and restriction: object to processing based on legitimate interests, or ask us to limit it.
Opting out of analytics: use the Analytics link in the footer at any time. This does not affect measurement already done.
Complaint: lodge a complaint with your local data protection authority (in the UK, the ICO).
United States residents
Residents of U.S. states with consumer privacy laws, such as California (CCPA/CPRA) and Colorado (Colorado Privacy Act), may have similar rights to know, access, correct and delete their personal information, and to opt out of its sale, targeted advertising or profiling, to the extent those laws apply to IronXIron. IronXIron does not sell personal information, does not use it for targeted advertising, and does not profile people in ways that produce legal or similarly significant effects. We will not treat you differently for exercising any of these rights.
Children
IronXIron is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
We will update this page when what we collect or how we use it changes, and change the date at the top. A change to how analytics is used will be described here before it takes effect.