v0.20.0Iris says what it checked. A verdict tells a pass from a check that never ran, names who recorded the evidence it judged, and cannot be replaced by the agent it judges→

Privacy Policy

Last updated: October 3, 2026

Overview

Iris (“we,” “us,” or “our”) is an open-source MCP server for AI agent evaluation and observability. This privacy policy explains how we handle data across our website (iris-eval.com) and the Iris software.

What we collect

Website (iris-eval.com)

  • Waitlist email address: The site had a waitlist form for a hosted version until October 2026. The form is removed and no new addresses are collected. If you joined while it was open, we still hold the email address you gave, and nothing else about you.
  • Playground text: What you paste into the live playground is sent to our server, scored and returned. It is not stored and not logged.
  • Hashed IP address: For rate limiting only. We store a one-way SHA-256 hash of your IP — we cannot reverse this to identify you.
  • Analytics: We use Vercel Web Analytics, which collects anonymous page view data. No cookies, no personal data, no cross-site tracking.

Self-hosted Iris software

  • Nothing leaves your machine unless you turn one of these on: an OpenTelemetry endpoint (IRIS_OTEL_ENDPOINT), which exports traces to the collector you name; the LLM judge with your own key, which sends the text it judges to that provider, and whose citation check fetches the pages an output cites; or a webhook, which posts ids, the verdict and rule names, never the text, to the address you set. The self-hosted version stores traces, evaluations, and metrics in a local SQLite database. No data is sent to us or any third party by default; the OpenTelemetry exporter, when you configure it, sends traces to the collector you name.
  • We do not collect telemetry, usage data, or analytics from the self-hosted software.

How we use your data

  • Waitlist emails: Solely to tell you if a hosted version is offered. We do not sell, share, or use your email for any other purpose, and we delete it when you ask.
  • IP hashes: Solely for rate limiting to prevent abuse. Automatically expire after 1 hour.

Data storage and security

  • Waitlist data is stored in Upstash Redis (encrypted at rest, served over TLS).
  • We use CORS restrictions, rate limiting, and input validation to protect the site’s API routes.
  • We do not store passwords, payment information, or sensitive credentials.

Your rights

You have the right to:

  • Access: Request a copy of any data we hold about you.
  • Deletion: Request deletion of your waitlist email at any time.
  • Correction: Request correction of inaccurate data.
  • Portability: Request your data in a machine-readable format.

To exercise any of these rights, email hello@iris-eval.com. We will respond within 30 days.

Third-party services

Cookies

We do not use cookies. Vercel Web Analytics is cookie-free. No tracking pixels, no fingerprinting, no cross-site tracking.

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Continued use of the website after changes constitutes acceptance of the updated policy.

Contact

Questions about this privacy policy? Email hello@iris-eval.com.