Your data
stays yours.

Ironbark is operated by Bagadi LLC. Contact us at hello@getironbark.app.

Ironbark is a lifestyle companion. We collect what we need to run the app and nothing more. No advertising, no data brokers, no surprise resales.

What we collect

• Account basics: email, a username you pick, and a hashed password — or, if you choose phone sign-in, your phone number. If you choose Google sign-in, Google may also provide a profile name, which we use as your display name.
• Date of birth: required at signup so we can enforce the 18+ minimum. We store the date for audit; we don't display your age back to anyone.
• Avatar: we assign one from a small set. You can swap it.
• What you write in the app: check-ins, journal entries, identity statements, goals, habit plans, if-then plans, environment notes, future-self letters, restructuring entries, coping logs, community posts, and partner messages. All visible only to you (or your partner / cohort, where the feature explicitly shows it).
• How you use the tools: which breathing / grounding / journaling tools you complete, lesson progress, quote favorites.
• Subscription state: whether you have Ironbark Pro active. Sent to us by RevenueCat; we don't see your card details.
• Device basics: a push token if you opt in to notifications, your timezone (so reminders land at sane hours), and standard server logs (IP at login, user-agent, error traces) for reliability.
• App interactions and diagnostics: when telemetry is enabled, we collect bounded events such as app/session starts, onboarding and subscription-screen actions, startup time, frame-jank and hang summaries, crash signals, sync health, and non-sensitive error-context labels. Usage events are linked to your signed-in account; bounded error reports may also be sent before sign-in. Reports include the app version and platform, and never include journal entries, messages, check-in text, advertising identifiers, or precise location. Updated app versions provide a Share usage and diagnostics switch in Settings. If your version does not show it, update the app when that version becomes available.
• Consent record: when you accepted this Privacy Policy and the Terms of Use.

What we do with it

• Your check-ins and journal power your own Resilience Score and weekly pattern report — shown only to you.
• Your timezone anchors notifications and weekly scoring to your local calendar.
• Community posts and reactions are visible to people in your cohort under your pseudonymous username + avatar — not your email, not your real name.
• If you opt in to proactive nudges, we look at your check-in patterns to send the occasional supportive push at a useful moment. You can turn this off (Settings → Notifications), and the analysis stops the moment you do.
• We do not sell your data, run ads, train AI models on it, or share it with data brokers.

Where your data lives

Our servers and database run on infrastructure in the United States. A few specific things flow through trusted vendors:

• RevenueCat — handles your Ironbark Pro subscription state. We send a user ID; we don't send your name, billing email, card number, or country.
• Firebase (Google) — verifies phone sign-in and delivers push notifications when you opt in. Notification bodies are generic ("Time for a check-in", "Your buddy needs support") — we never put your journal or check-in content into a notification.
• Apple and Google — verify your Sign-in with Apple / Sign-in with Google tokens, when you sign in or reauthorize a sensitive action. For Apple sign-in, we retain an encrypted authorization token so we can revoke access when you delete your account.
• Twilio — sends a one-time SMS code when the phone-sign-in fallback is used.
• SendGrid (Twilio) — sends transactional email (password reset, email-change confirmation, account-deletion confirmation). No marketing email.

How entries are protected

Identity-log entries are encrypted in the local app database and encrypted at rest on our servers. The service decrypts them when returning them to your authenticated account. This is not end-to-end encryption, and we control the server encryption keys. Your entries are not shared with your cohort or walking partner. Values, focus and onboarding preferences are also saved to your account; they are not device-only data.

What your partner and cohort see

If you pair with an accountability buddy, they see your username and the short check-ins and commitments you choose to share — not your journal, not your raw check-ins, not your scores. If you send an SOS, the buddy gets a push that says "Your buddy needs support." No context, no transcript.

In a cohort (community feed), people see your username, avatar, posts, and reactions. Real name, email, date of birth, and everything you write outside the feed stay private.

With a walking partner (Pro), 1:1 messages are encrypted at rest on our servers and only visible to the two of you — and to authorized moderators reviewing reports or automated safety alerts. The app can show crisis resources on your device before you send a message. Our server also checks sent messages for abuse or promotion of harm and may retain a limited excerpt for moderator review. Messages are not end-to-end encrypted.

Your rights

• Export — Settings → Your data → Download my data. You get a JSON file with everything we have on you.
• Delete — Settings → Your data → Delete my account. We immediately strip identifying fields and purge the rows after 90 days. Deletion removes your sign-in identifiers and cannot be undone through the app. Residual records are retained for up to 90 days for fraud and abuse handling before the scheduled purge. For Apple accounts created with an older app version, also stop using Sign in with Apple for Ironbark in your Apple Account settings to revoke any authorization that the older app did not provide to us.
• Edit — change your email, password, username, avatar, and notification preferences any time.
• Opt out of algorithmic processing — Settings → Privacy → Pause personalized recommendations. Proactive nudges and weekly pattern analysis stop; your own Resilience Score still computes.
• Block — block any other user from a profile or post; they vanish from your view immediately.

Security basics

Passwords are hashed with Argon2id (OWASP-recommended parameters); any legacy bcrypt hashes are transparently upgraded to Argon2id on next sign-in. Sessions use short-lived access tokens and rotating refresh tokens. TLS in transit. The mobile app pins the API certificate in release builds. We operate Postgres on our cloud infrastructure with daily backups. Protected disaster-recovery backups expire separately from the active-database deletion process; they are not a user account-recovery feature.

If something goes wrong, email hello@getironbark.app and we'll triage.

If you're under 18

Don't use Ironbark. The app is for adults. We don't knowingly collect data from minors; if we discover an under-18 account, we delete it.

Changes

We publish updates on this page and update the date above. When a change requires renewed consent, we will request that consent before the affected processing.

Contact

hello@getironbark.app. We read every message.