Privacy Policy

• Account and contact data: name, email address, email-verification state, security events and account preferences.
• Orders and service data: products, prices, keys, entitlements, downloads, notes, warranty requests, subscription status and support conversations.
• Billing data: billing contact details, provider references, payment status, refunds, currency, tax and invoice information. Payment providers handle the payment credentials entered on their systems; iOSRED does not need your full card or UPI PIN.
• Device and certificate data: UDIDs where a device-bound product requires one, provisioning details, certificate files and passwords, app-signing jobs and certificate-health results. Sensitive values are masked in normal views and protected at rest where implemented.
• Wallet and referral data: referral attribution, earnings, ledger entries, withdrawal requests and encrypted PayPal or crypto payout destinations.
• Technical data: IP address, browser and device information, country estimate, timestamps, referrer/UTM data, click identifiers, CAPTCHA results, fraud indicators, logs and download activity.
• Files and messages you provide: IPA files, URLs submitted to the signer, Telegram imports, chat messages, correction feedback and attachments needed to deliver a requested feature.

We use information to run accounts and carts, process and reconcile payments, deliver purchases, allocate keys, provision certificates, authorise downloads, operate signing tools, manage Auto Delivery, provide support, send service emails, prevent abuse, keep financial records and improve the website.

Where relevant, processing is based on performance of a contract, your consent, our legitimate interest in operating and securing the service, or a legal obligation. Marketing consent is optional and unchecked by default.

We use technical and payment signals to detect tampering, duplicate use, bots and potentially fraudulent orders. A higher-risk paid order may be held for a person to review instead of being fulfilled immediately. You can contact support if you believe a decision is wrong.

We do not publish fraud scores or rules because doing so would make the controls easier to bypass.

Depending on the feature you use, information may be processed by payment providers such as PayPal, Paytm and MixPay; email providers such as Resend and our configured mail server; Cloudflare services including R2; Google identity or reCAPTCHA; MaxMind; Telegram; and our configured AI provider for customer chat. Exchange-rate services normally receive a server request rather than customer payment credentials.

We give a provider only the information reasonably needed for its task. Provider privacy terms also apply when you interact with that provider. We do not sell personal information.

Messages sent to the chat may be processed by the configured AI provider to prepare an answer and may be reviewed by authorised staff. Do not put license keys, private keys, certificate passwords, payout secrets or unnecessary sensitive information in a chat. Order-specific actions still require authentication and ownership checks.

We keep information only as long as reasonably needed for the purpose, security, disputes and legal accounting duties. Current operational limits include:

• normal sent-email archive records: up to 90 days;
• customer chat conversations: up to 50 days;
• custom signing inputs and outputs: normally up to 24 hours;
• customer-saved signing credentials: no more than 90 days, and possibly less after revocation;
• superseded file versions and soft-deleted media: normally 30 days before eligible cleanup.

Orders, invoices, payment records, ledger entries, audit events and dispute evidence may be retained longer where law or legitimate record-keeping requires it. An empty new account whose first verification email permanently bounces may be scheduled for deletion after 48 hours; accounts linked to customer or purchase history are preserved for review instead.

We use access controls, encryption for designated secrets, masking, audit records, short-lived download links and separation of public and private files. No system can guarantee absolute security. Please use a unique password and report unexpected account activity promptly.

Providers may process information outside your state or country. Where required, we use the provider and contractual safeguards available to support lawful transfers. Different countries can have different data-protection rules.

Depending on where you live, you may ask to access, correct, export or delete personal information, object to or restrict certain processing, withdraw consent, or complain to a data-protection authority. Some financial, security and transaction records cannot be deleted immediately.

You can unsubscribe from marketing without stopping order and security messages. Browser-storage choices are explained in the Cookie Policy.

iOSRED is not intended for children under 18. We do not knowingly offer accounts or purchases to them.

We will date material updates to this policy. To make a privacy request, email support@iosred.com. We may ask for enough information to verify the account before releasing or deleting data.