# Redeal data policy — what we keep, and what we never do with it

*v1 · 2026-08-12. Canonical page: https://redeal.dev/trust/data-policy*

A trust product caught lying about retention is dead, so this policy is
written to be checkable. Where a claim can be verified in the running service,
the page says where.

## What a deal creates

| Data | Form stored | Why |
|---|---|---|
| API keys | Hash only | Rate limiting and abuse control |
| Invite tokens | Hash only; expire with the deal | Letting each party into their deal |
| Commitments | SHA-256 hashes of inputs | The sealing mechanism itself |
| Revealed inputs | Encrypted at rest (AES-256-GCM), dedicated table, own access path | QA, dispute forensics, aggregate statistics |
| Deal metadata | Plaintext: algorithm, party labels, deadlines, timestamps | Running the protocol |
| Certificates | Public by design, in the transparency log | Verification is the product |

Certificates never contain inputs, only their Merkle root. The public log is
therefore safe to be public.

## Retention

- **Default (standard class):** revealed inputs are kept, encrypted at rest,
  access-controlled, never exported; used for QA, dispute forensics, and
  aggregate statistics.
- **Purge class (opt out):** revealed inputs are destroyed after the
  certificate is issued and a 7-day verification window closes. The
  certificate records which retention class was applied.
- **Aggregates, never raw:** aggregate statistics (accept/reject rates, flake
  rates, typical split patterns) may be published or sold. Raw inputs are
  never published, in any form, to anyone.

## The never list

- Raw inputs are never sold.
- Raw inputs are never shared with third parties.
- Inputs never enter third-party telemetry: no analytics, no error trackers,
  no request-log pipelines.
- No tracking cookies, no ads, no fingerprinting, on any page.

The site runs zero third-party scripts; confirmable in a browser network tab.
The web server keeps only IP-anonymized access logs for the site; raw IP
addresses are masked at write time and never stored.

## How Redeal measures without tracking

Server-side aggregate counters (deals created per day, certificates verified
per day, uptime) plus IP-anonymized access logs for the website; no log entry
contains identifying information. The headline
growth metric is the size of the public transparency log, which anyone can
read.

## Your rights

Request a copy or deletion of personal data via privacy@redeal.dev. Two honest
caveats: certificates in the transparency log are immutable by design and
contain no inputs and no names beyond party labels chosen at deal creation;
and deals created with the purge class have their inputs destroyed
automatically, no email needed.

Operator: UK entity details to be added before any paid tier. This policy is
versioned; material changes get a new dated version and a changelog entry,
never a silent edit.