Privacy

Effective 9 October 2026.

Iron Roots Supply runs ironroots.us and the store at ironroots.store. This page says what they keep about you and where it goes. In short: we keep what you choose to give us, and what your account, your order or the law needs. Cloudflare, which hosts both sites, sees every visit, as any host must. Our pages carry no counter of any kind, so from 8 October 2026 the only visit numbers we get are Cloudflare's. Nothing on our pages tracks you for advertising or follows you to other sites, and we don't sell your information.

Lumen, at lumen.ironroots.us, has its own privacy notes inside the app. Nexus, on ironroots.world, opens to signed-in accounts, and what it keeps isn't covered here yet, nor are its older pages that still open at ironroots.us addresses. War Chief's download isn't public yet, so this page doesn't cover the program either.

What we keep

Your Iron Roots account, made on ironroots.us: your email, and a password kept by Supabase, the account service Iron Roots uses. Supabase keeps the password scrambled, and we never see it. Each time you sign in, Supabase records that sign-in with your IP address and which browser you used; signing out on ironroots.us deletes the record, and one you never sign out of stays. If your account gets a membership (a paid tier, or the War Chief's free trial), we keep its tier, the date a paid tier runs to and when the trial began. An email service sends the message that confirms your account, and any password-reset link you ask for.

Your order, once the store takes payments (it doesn't yet): you pay on PayPal's own page, and PayPal tells us your name, email address and shipping address, what you bought and what you paid. We keep that to ship your order and keep our books. Your card or bank details stay with PayPal; we never see them.

A pack you seal. Until payments open, sealing a pack keeps it, with the name and email you give, on your device only. It reaches us only if you send the email the store writes for you, to info@ironroots.us, from your own email app.

Email you send us, such as that pack, a Bug·Bane waitlist note or a question: we keep what you wrote and your email address, so we can write back.

A suggestion from the box on ironroots.us's front page: our server sends only the words you typed to our inbox, with no name, email address or account, and passes on nothing else about you, so we can't write back. We keep it in our inbox. Resend, the email service that carries it, keeps a copy for 30 days. When the box can't send by itself, it says so and its button writes the email in your own email app instead; that email comes from your address, like any other you send us.

A skin-reaction report: we keep it, with your order number and what you told us, for six years. Federal law (21 U.S.C. 364a(e)) requires three or six years, depending on a business's size and products, and we keep the longer. If the reaction is serious, the same law requires us to report it to the U.S. Food and Drug Administration (FDA) within 15 business days.

What Cloudflare sees

Cloudflare runs the servers both sites answer from, so it sees every request: your IP address, the page asked for and your browser. From that it shows us totals, robots included: requests, visitors (each IP address counts as one) and the countries they come from. Its security view also lets us see a sample of single requests from the last 31 days, each with its IP address, page and browser. None of this needs anything added to our pages.

Until 9 October 2026, Cloudflare added one small thing of its own. A note in each answer asked your browser, for 7 days after each visit, to tell Cloudflare when a request to our sites failed: the address it tried, what went wrong and how long it took, and the site that sent you. Nothing was reported while pages loaded normally. We took that note off our sites on 9 October 2026, but a browser that visited before then may go on reporting failures to Cloudflare until 16 October 2026, and none after that. Cloudflare says it uses your IP address only to find your network and rough location, and drops it as soon as the report is handled.

Kept on your device

Signing in on ironroots.us keeps you signed in with a cookie called sv_session, for up to 30 days at a time, shared with Lumen on the same browser so it opens signed in too. It holds your sign-in's keys, your account's ID and your email, and your browser sends it only to ironroots.us addresses, Lumen's among them. The front page also keeps your tier in your browser's storage, to show it straight away. Signing out on the front page deletes both.

The store keeps your pack, and the name and email you give when you seal it, in your browser's storage; it reaches us only if you email it. A browser that visited while our old counter ran, from 5 to 8 October 2026, may still hold its notes there: the day's date, and a ?count=off choice if you made one. Nothing reads them now.

Where it goes

We don't sell your information or share it for advertising. To ask us never to sell yours, email info@ironroots.us. These services handle it so the sites work, each under its own privacy policy:

• Cloudflare hosts the sites (above), and Supabase runs our accounts, database and server code. Supabase sees your IP address with every request that reaches it, and keeps it in its logs for a time.
• PayPal takes your payment on its own page, once payments open.
• The label service and carrier we ship with get your name and address, to deliver your order.
• An email service sends the emails we send you, such as the one that confirms your account.
• Resend carries each suggestion from the front page's box to our inbox, and keeps a copy for 30 days.
• The FDA receives a report of a serious skin reaction, because federal law requires it.

Tracking across other sites

We don't follow you across other sites, and nothing on our pages lets another company do it. PayPal may collect information about you under its own policy when you pay on its page. Nothing on our pages collects what you do on other sites, so Do Not Track and Global Privacy Control have nothing to switch off here; Cloudflare, as the host, doesn't read them.

Seeing, fixing or deleting what we hold

Email info@ironroots.us. We'll tell you what we hold about you, fix what's wrong, and delete your account if you ask; that deletes its sign-in records and membership with it. A paid order stays in our books as long as tax law requires us to keep business records, and a skin-reaction report stays for its six years, because federal law requires that too.

Children

Our sites aren't meant for children under 13, and we don't knowingly collect their information. If you think a child has given us some, email us and we'll delete it.

Changes

When this page changes, the new version goes up here with its new date at the top.