What we keep, and what we never do with it
A trust product caught lying about retention is dead, so this page is written to be checkable. Where a claim can be verified in the public repo or the running service, we say where.
What a deal creates
| Data | Form we store | Why |
|---|---|---|
| API keys | Hash only | Rate limiting and abuse control |
| Invite tokens | Hash only; expire with the deal | Letting each party into their deal |
| Commitments | SHA-256 hashes of inputs | The sealing mechanism itself |
| Revealed inputs | Encrypted at rest (AES-256-GCM), dedicated table, own access path | QA, dispute forensics, aggregate statistics |
| Deal metadata | Plaintext: algorithm, party labels, deadlines, timestamps | Running the protocol |
| Certificates | Public by design, in the transparency log | Verification is the product |
Certificates never contain inputs, only their Merkle root. The public log is therefore safe to be public.
- Default: we keep revealed inputs
-
Deals are created with retention: "standard" unless the initiator says otherwise. Revealed inputs stay encrypted at rest, are access-controlled, and are never exported. We use them for three things: quality assurance, dispute forensics, and building aggregate statistics.
- Opt out: purge class
-
Deals created with retention: "purge" have their revealed inputs destroyed after the certificate is issued and a 7-day verification window closes. The certificate records which retention class was applied, so the choice itself is on the record.
- Aggregates, never raw
-
We may publish or later sell aggregate statistics: accept and reject rates on declared value functions, flake rates by deal type, typical split patterns. Aggregates describe populations, not people. Raw inputs are never published, in any form, to anyone.
The never list
- Raw inputs are never sold.
- Raw inputs are never shared with third parties.
- Inputs never enter third-party telemetry: no analytics, no error trackers, no request-log pipelines.
- No tracking cookies, no ads, no fingerprinting, on any page.
The telemetry rule is enforced in code, not just in prose: a logging lint in CI rejects any change that routes input data into logs, and code review treats it as a release blocker. The site you are reading runs zero third-party scripts, which you can confirm in your browser's network tab.
Our own analytics diet
We keep server-side aggregate counters (deals created per day, certificates verified per day, uptime) plus IP-anonymized access logs for the website; no log entry contains identifying information. Our headline growth metric is one we cannot fudge, because you can read it too: the size of the public transparency log.
Access, deletion, questions
You can request a copy or deletion of personal data we hold about you by emailing privacy@redeal.dev. Two honest caveats. First, certificates in the transparency log are immutable by design; they contain no inputs and no names beyond party labels chosen at deal creation, so choose labels you are comfortable being public. Second, if deletion matters to you, create deals with the purge class and the inputs are destroyed automatically, no email needed.
Operator: [UK entity details to be added before any paid tier]. This policy is versioned; material changes get a new dated version and a changelog entry, never a silent edit.