Privacy Policy - IAM Roadmap

Overview

IAM Roadmap ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website (iamroadmap.com) and iOS application.

Key Point: Everything on IAM Roadmap works without an account, and we collect as little as possible. All IAM tools run entirely in your browser or on your device - your sensitive data (tokens, passwords, keys) never leaves your device. If you choose to sign in, we store only the minimal account information described below, and we never store passwords.

Information We Do NOT Collect

Passwords - sign-in uses OpenID Connect or a one-time email link, so there is no password to store
JWT tokens, passwords, API keys, or any data you input into our tools
SAML assertions, certificates, or cryptographic keys
Payment or financial information
Precise location data
Your name, email address or account details, unless you sign in or include them in a feedback message

Information We Collect

Account Information (only if you sign in)

Signing in is optional. If you sign in with an identity provider (Google or GitHub) or with an email link, we receive and store:

Your email address
Your display name and profile photo, if the identity provider shares them
Which sign-in method you used, and the dates you created your account and last signed in
Items you choose to save (favorites) and certification progress you choose to track

We use this information solely to operate your account and sync your saved items and progress across devices. We do not sell it, use it for advertising, or share it with third parties except the service providers listed below. Account data is stored with Firebase (Google Cloud) in the United States and is only accessible to you.

Analytics Data

We use three analytics services to understand which pages are useful. None of them receives what you type into our tools, and none is linked to your account, email, or name.

Google Analytics 4: page views, the referring site, device and browser type, and an approximate location that Google derives from your IP address. Google Analytics tells visitors apart with cookies named _ga and _ga_<id>, which last up to two years. If your device is set to a European time zone, these cookies are not set unless you choose "Allow analytics" in the banner. Elsewhere they are set by default. You can change your choice at any time with the "Cookie settings" link at the bottom of every page; declining also removes the cookies.
Cloudflare Web Analytics: aggregate page views and page load performance, measured by our hosting provider. It does not use cookies.
TelemetryDeck: page views and navigation patterns, anonymized device type and operating system, app version, and country-level location. It does not use cookies. It uses a random identifier that is kept in your browser only where analytics storage is allowed; if your device is in a European time zone and you have not allowed analytics, or you have declined, the identifier lasts for a single page view and nothing is stored on your device. Learn more at TelemetryDeck's Privacy Policy.

Feedback Submissions

If you voluntarily submit feedback through our feedback form, we receive the message you write, the page you sent it from, your browser type (user agent), your IP address, and your email address if you choose to enter one. The message is delivered to our team by email. Your IP address is also kept for up to 24 hours to limit how often the form can be submitted. An email address is not required.

Your Rights and Choices

Access: Your saved items, progress and account details are visible on your account page after signing in.
Deletion: You can permanently delete your account and all associated data at any time from the Settings tab of your account page. Deletion takes effect immediately.
Sign out: Signing out removes the session from your device; your data remains until you delete your account.
Analytics cookies: Use the "Cookie settings" link at the bottom of any page to allow or decline Google Analytics cookies.
Questions: Contact us at the address below for any other request about your data, including requests under GDPR or CCPA.

Client-Side Processing

All IAM tools (JWT Decoder, SAML Decoder, Password Hash Generator, etc.) process data entirely on your device:

Web Application: All processing happens in your browser using JavaScript
iOS Application: All processing happens on your device using native Swift code
No tool input is transmitted to our servers
No tool data is stored after you close the tool

Third-Party Services

We use the following third-party services:

Cloudflare: Website hosting, DDoS protection and cookieless Web Analytics
Google Analytics: Usage analytics, with cookies subject to your choice as described above
Firebase Authentication and Cloud Firestore (Google): Sign-in and storage of account data for users who choose to sign in
Identity providers you choose (Google or GitHub): When you sign in with a provider, that provider's own privacy policy governs the data it processes
Resend: Delivery of sign-in link emails and feedback notifications
TelemetryDeck: Privacy-focused analytics
Apple App Store: iOS app distribution (for the iOS app)

Data Security

We minimize the data we hold, and we never store passwords. Account data is protected by per-user access rules, so only you can read or write your own records. Our website uses HTTPS encryption for all connections. The iOS app uses Apple's App Transport Security (ATS) for secure network communications.

Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect information from children under 13. If you believe a child has created an account, contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: [email protected]