Privacy is the product.
So this page can afford to be specific. Here is everything we hold, everything we refuse to hold, and everything you can make us do about it.
Who "we" is
Liir is built and run by Siliroid LLC d/b/a Liir, an Oregon limited liability company, in the United States, on hardware we own, not in someone else's cloud. This policy covers liir.net, thiir.net, and the apps they serve: mail, your page, the Shelf, the Vault. Liir is offered from and for the United States, and data you give us lives here; if you are somewhere else, it travels here. Writing to hello@liir.net reaches a person.
Cookies · exactly two, and only if you sign in
Browsing this site sets no cookies at all. Signing in sets two, both
ours, both locked to liir.net over HTTPS:
__Host-liirsess: your session, a random token that signs you in.
Page scripts can never read it, and the registry stores only a hash of it.
It lives 30 days, or until you sign out.
__Host-liirin: the word “1”, nothing else. It lets our
own pages show the signed-in header without asking the server first. It
identifies nobody.
There is no cookie banner because consent rules apply to cookies that are
not strictly necessary for a service you asked for. You asked to be
signed in; both of these exist only to deliver that signed-in state, and
no one else's cookies exist here.
Traffic, counted without you
We count visits on our own server: the page asked for, the moment, and the page that linked here. The counter never records your IP address, and cookies are stripped before a line is written: the traffic log cannot hold your session even by accident. To avoid counting you twice in one day, the server briefly mixes your connection's address with a key that lives only in memory and dies at midnight. The mixed value stays in memory too: it never reaches disk, and once the day's key is gone it cannot be tied to anyone. What disk holds is arithmetic: how many, never who. No analytics service, no pixels, nothing loaded from anyone else's servers. The examples on /hub are drawn entirely in your browser: nothing you do there is sent anywhere.
The ledger · what we actually hold, system by system
The registry: the name you claimed, the public half of your passkey
(useless without the private half, which never leaves your device), and
whatever facets you chose to publish, each behind the dial you set. We hold
these to perform the contract you made with us: to be Liir for you.
The Shelf and hosted mail: your files, and your letters if you
claimed a mailbox. Both are encrypted at rest on our hardware, and here the
honest sentence is different from the Vault's: Liir holds the encryption
key for Shelf and hosted mail and can technically access their contents.
We do not inspect them as a business model. Access is limited to operating
and securing the service, responding to your request, investigating
credible abuse reports, or complying with valid legal process. File names,
sizes, and folders are plain metadata we can see. Everything on the Shelf
starts private to you; sharing lanes are coming, and nothing is shared until
you set a dial. Mail custody has its own honest page:
what we hold, for how long, and who can read it while we
do.
Doors: for each door you mint, its address, the label you gave
it, the company it is bound to, whether it is open or closed, and the
dates. Also the true name’s dial, and the senders you opened a
knock for or refused. Never the letters, which live with hosted mail
above.
The Vault: the sealed tier, and the contrast to everything above.
Etchings are sealed in your browser before they reach us, under a root key
that only your own key or two of your three recovery cards can unwrap. What we
hold is scrambled bytes, the room they sit in (letter, file, cash…), their
size, and a wrapped root we cannot open. We cannot read a byte of it; the label itself is
sealed. We count your etchings; we cannot open one.
The heart: if you choose to light your heart, age verification runs
through an outside provider, xident, under its own privacy policy. It
is never required for ordinary use. We keep the tier you proved and whether
the check passed, never your age and never a document. xident answers one question, pass or fail, at the threshold we ask for. Liir keeps that answer, never the document. What xident holds on its own side is governed by its data terms, and we will state the retention period here in plain words once it is confirmed in writing.
Billing: if you subscribe, Stripe, our outside payment
provider, holds your card; they never tell us the number. We keep your
plan, its status, and Stripe's reference IDs. For fraud prevention and
its own legal duties Stripe also handles payment data as a controller in
its own right, under its own privacy
policy.
Invitations: a hash of each invite, who minted it, who used it.
The notary: a public chain of salted fingerprints, deliberately
containing no names and no content. It is built so a fingerprint
cannot be tied back to a person, and we never try. If you can show us one
that identifies you, the rights below apply to it like anything else.
Operations: service logs that follow one law, no IP addresses in
anything persistent.
The legal bases, named
For readers in places, like the EU, where each use of data must name its legal ground: the registry, the Shelf, the Vault, and mail are processed to perform our contract with you. Billing is that contract plus our legal obligations (tax and accounting). Security and the service logs above are our legitimate interest in keeping the doors standing. Anything optional asks first and runs on consent, which you can take back; the one thing that starts on is feature news, which the Notices box below explains and one click stops. Recipients: the providers named on this page, no others. Retention: the “how long things live” box below. Where your data lives: the United States, as the top of this page says.
What we never hold
No passwords: none exist here, and no mail password is ever made for you. No private keys: your daily key lives in your device's secure hardware. No recovery cards: the three cards minted at your ceremony are printed or saved by you, held by you, and never reach us. Any two of them are read back by camera, or from a saved image or PDF, and the Vault's root key is unwrapped in your page for the life of a tab and nowhere else. No faces. No identity documents. No card numbers. No browsing profiles, of you or anyone. No map of who writes to whom: a door names one company and one Liir, and relationship doors name nobody. We cannot be compelled to produce what we do not hold: that is not bravery, it is inventory.
Your rights · everyone's, not just where the law insists
See it: ask, and we will show you everything we hold on your name,
which is mostly sealed bytes we cannot read, plus the list above.
Take it: your sealed files, your mail, your facets: downloadable, yours,
including on the way out. The law calls this portability; the files come
in formats another service can read.
Fix it: your facets are yours to edit at will; the rest, ask.
Pause it: ask us to restrict a use of your data, or object to one,
and we stop while we sort it out (restriction and objection, by their
legal names).
Erase it: deleting your things yourself puts them in a 90-day rest
(that window is your ransomware protection: nothing, including us, can
hurry it). A formal erasure request is different: verify it is
really you, and we will purge inside the legal clock: within a month,
not ninety days.
Appeal it: if we refuse a request, we say why in writing, and you
can appeal that refusal itself; a different set of eyes answers. Oregon
residents: this is the appeal your privacy law promises, and the
Oregon
Department of Justice hears you if ours disappoints.
Complain: to us first, we hope (hello@liir.net),
and to your local data authority always, if we disappoint you.
We answer within a month, stricter than most clocks the law sets, and we
answer as people.
How long things live
Sessions: 30 days, or until you sign out; signing out deletes on the spot. Deleted etchings: 90 days resting, then gone for good, on schedule. Deleted Shelf files: in the trash until the purge date the Shelf shows you, then gone for good. Mail: for as long as you keep the mailbox; the terms say what happens if a subscription lapses (a grace period, then frozen, never quietly deleted). Doors: a closed door keeps its row for good, so its name is never struck twice; a refused knock is gone the moment you refuse it. Traffic counts: kept as numbers with nobody in them. The notary chain: permanent, and permanently about no one.
Children
Liir is not for children under 13. Making a Liir asks you to confirm you are 13 or older, and we do not check further; if we learn an account belongs to a child under 13, we remove the account and its personal information. Under 18, your heart stays unlit and the adult doors stay closed. Doors that require being an adult are separately and explicitly gated.
Notices · how we reach you
Two kinds of letter come from us, both to your Liir mailbox if you claimed one and always to a card on your account page, so a Liir with no mailbox still hears. Administrative notices (a change to these pages, a security matter, a change to the service) go to every account and cannot be turned off while you hold a Liir. Feature news is on when you make a Liir and stops with one click: the link at the foot of every such letter, or the switch on your account page. Both come from admin@liir.net or features@liir.net, and a reply reaches a person at hello@liir.net. We never mail anyone who does not hold a Liir.
If something goes wrong
If a breach ever touches something of yours, we tell you: plainly, and with what it actually means for you. We aim to notify affected people within 72 hours once we determine notification is warranted, except where law prohibits or delays notice. Oregon law, which governs us, sets 45 days as the outside limit; that is the floor, not our aim. The architecture is built so that for the Vault the honest answer is “they got ciphertext”, and for the Shelf and mail it depends on whether the key went with it: here is exactly what an attacker can and cannot get. Copyright notices, intimate images shared without consent, and anything that exploits a child have their own door: /report.
Never
No ads. No trackers. No data brokers. No selling, renting, or “sharing with partners.” You're the customer, not the product: Liir answers to the people who use it, no one else.
Questions
Write to hello@liir.net. A person reads it.
This page is the policy. Three named companions carry detail it already summarizes: mail custody, the terms (what happens when a subscription lapses), and the report door. Nothing else is incorporated, and there is no smaller print. If it changes, this date changes and the change is named here, not slipped in: September 1, 2026: added the Shelf; said plainly that the Shelf and hosted mail are in our custody and the Vault is not; named the verification provider; replaced vault words with recovery cards; reworded the breach promise; named how notices and feature news reach you.