privacy notice.
What the site and an iResolved account collect, and how to remove it.
Overview
This notice covers the corporate website at iresolvedllc.com and the iResolved account service at auth.iresolvedllc.com, oauth.iresolvedllc.com, and api.auth.iresolvedllc.com.
The corporate site
The corporate site is built to work without analytics services, advertising pixels, or tracking cookies. It does not set cookies and does not run a third-party analytics product. The site is served through Cloudflare, which processes standard request information — such as an IP address, user agent, requested page, and timestamp — to deliver the site, prevent abuse, and keep it available. Cloudflare acts as our hosting and infrastructure provider.
Fonts are served from this domain. The site does not request typefaces or other assets from third-party font or advertising networks.
An iResolved account
When you create an account, we store your name, email address, a password hash, whether the email is verified, the time you accepted the terms, and the version you accepted. We also store sessions (with IP address and user agent), OAuth applications you authorize, the permissions you grant, and security audit events such as sign-in, password reset, and consent decisions.
The account service sets session and authorization cookies scoped to .iresolvedllc.com (or localhost in development). They are HttpOnly, Secure in production, and SameSite Lax. They are used only to keep you signed in and to complete an authorization request; they are not advertising or analytics cookies.
Email verification and password reset are delivered by Resend. Rate limits are stored in Upstash Redis. Account data is stored in Neon Postgres. Errors may be reported to Sentry with request bodies and user identity disabled. These providers process data on our behalf and do not receive it for advertising.
If you email us, we receive your email address and the contents of your message. We use that information to respond and to manage the conversation. We do not sell it, and we do not add it to a marketing list without your request. Account email is used for verification, password reset, and security notices only.
Links to other sites
This site links to external services, including GitHub. Those services have their own privacy notices, and this notice does not apply once you leave this domain.
Retention
Correspondence is kept only as long as needed to respond and to maintain a record of the work discussed. Account data remains until you delete the account. Expired sessions, verification and reset tokens, and OAuth tokens are removed automatically. Security audit events are kept for up to one year. Request logs are retained by our infrastructure provider for the periods used to operate and protect the service.
Your choices
From the account page you can review and revoke application access, sign out other sessions, change the password, and delete the account. Deleting the account removes the profile, sessions, and authorized applications. To ask what data we hold about you, request a copy, or ask a question, write to hello@iresolvedllc.com and we will respond within a reasonable period.
Changes
If this notice changes, the revised version will be posted here with a new effective date.