Contents — 19 sections
- Scope and definitions
- 1. How to read this page
- 2. How the product is shaped, and why that matters for security
- 3. Encryption in transit
- 4. Where your data is stored
- 5. Access control
- 6. One user's data is not exposed to another
- 7. What our analytics deliberately does not collect
- 8. What our LLM tracing does collect
- 9. Payments
- 10. Backups
- 11. Breach notification
- 12. What we do not have yet
- 13. Reporting a vulnerability
- 14. Data deletion
- 15. Third parties
- 16. Changes to this overview
- 17. Contact
- Contact
Scope and definitions
In this overview, "we", "us" and "our" mean IX Labs. "You" and "your" mean the person using our product.
Our product is Ingy, a Telegram bot that drafts social media posts from a link, a video, or plain instructions. Our website is ingy.app and the bot is @IngyAppBot.
This overview stands on its own. You do not need to read any other document to understand what is written here.
1. How to read this page
1.1 This page describes what is true today, in plain English. It is not a statement of ambition.
1.2 We are a small company. We have deliberately written this modestly rather than dressing it up, and section 12 lists what we do not have. We would rather you trusted a short honest page than a long impressive one.
1.3 Where something is planned rather than in place, it is marked PLANNED. Nothing on this page is claimed unless it is in place.
2. How the product is shaped, and why that matters for security
2.1 Ingy runs entirely as a Telegram conversation. Your account is your Telegram account. There is no separate login, no password we store, and no password for an attacker to steal from us.
2.2 Authentication is handled by Telegram. Your Telegram account security — including two-factor authentication on that account — is in your hands, and it is worth setting up, because whoever controls your Telegram account controls your Ingy account.
2.3 Ingy never publishes anything. It cannot post to any channel, page or feed, and holds no posting credentials for any social platform. Publishing is manual: Ingy gives you plain text, and you decide what to do with it. This meaningfully limits the damage anyone could do with access to the product.
3. Encryption in transit
3.1 All connections to and from our systems use TLS. This covers traffic between our servers and Telegram, between our servers and every third-party provider we use, and any connection to our website.
3.2 Traffic between you and Telegram is secured by Telegram, under Telegram's own arrangements, which we do not control.
4. Where your data is stored
4.1 Your data is stored on servers provided by Hetzner Online GmbH, in Germany.
4.2 The database is PostgreSQL, managed by us, on that infrastructure. We are responsible for its configuration, its access control and its backups. Hetzner provides the physical infrastructure and the data centre; Hetzner publishes its own security and certification information at hetzner.com.
4.3 What we store: your account record, your posts and their saved versions, your style profile, and your entitlements (plan and quota).
5. Access control
5.1 Access to production data is restricted to authorised personnel on a need-to-know basis.
5.2 Being honest about scale: we are a small team. The number of people with production access is very small, and access is granted because a specific job requires it, not by default. We are not going to describe a large formal access-review programme, because we do not run one.
5.3 Administrative access to our infrastructure and third-party provider accounts is protected by two-factor authentication where the provider supports it.
6. One user's data is not exposed to another
6.1 Every data access path in the application is scoped to the requesting user. Queries are constrained by the user's own identity, at the point of access, not by hiding things in the interface.
6.2 In practice this means your posts, your saved versions, your style profile and your entitlements are not reachable by another user of the product.
6.3 Your style profile is learned only from your own finalised posts. It is never shared with another user and never applied to another user's drafts.
7. What our analytics deliberately does not collect
7.1 We use PostHog for product analytics. It tells us which features are used and where things fail.
7.2 PostHog receives no user content. No prompts, no drafts, no transcripts, no style profile, no message text. It receives counts, category values, and durations.
7.3 URLs are reduced to the hostname before they are sent. We record that a source came from bbc.co.uk; we do not record which article.
7.4 IP-based geolocation is disabled in our product analytics configuration. Our separate website-analytics project does derive an approximate location from the visitor's IP address.
7.5 PostHog is hosted in the United States.
8. What our LLM tracing does collect
We are stating this plainly rather than burying it, because it is the least flattering fact on this page.
8.1 We use Langfuse for LLM tracing and cost analysis. It lets us debug bad drafts and understand what the product costs to run.
8.2 Langfuse traces do contain prompt and output content, keyed to a user ID. This is real content, not metrics.
8.3 Langfuse is hosted in the EU.
8.4 Access to tracing data is restricted on the same need-to-know basis as production data, under section 5.
9. Payments
9.1 Creem is the Merchant of Record for purchases, and is the contracting seller for the payment transaction. Creem is operated by Armitage Labs OÜ (registry code 16977866, Estonia). Creem processes payments and pays out the refunds we approve.
9.2 We never receive or store full card details. Card data goes to Creem, is handled by Creem, and never reaches our systems. There is no card data in our database to lose.
9.3 Creem handles payment data under its own terms and security arrangements, at creem.io.
10. Backups
10.1 We take regular backups of the production PostgreSQL database.
10.2 Backups are encrypted.
10.3 Backups are subject to the same access restrictions as production data.
11. Breach notification
11.1 If there is a personal data breach affecting you, we will notify affected users without undue delay, and we will tell you what happened, what data was involved, and what we are doing about it.
11.2 Where legally required, we will report the breach to the Information Commissioner's Office (ICO), the UK data protection regulator, within the timeframe the law requires.
11.3 Separately, Telegram's Bot Developer Terms require us to alert users in the event of a data breach, and we will do so.
11.4 We would rather tell you early and imprecisely than late and neatly.
12. What we do not have yet
This section is unusual on a page like this. It is here on purpose. It is more credible than silence, and it stops us implying things that are not true.
12.1 We do not have SOC 2 — no Type I, no Type II, and no audit under way.
12.2 We do not have ISO 27001 certification.
12.3 We have not had a third-party penetration test.
12.4 We do not run a bug bounty programme, and there is no payment for security reports (see section 13).
12.5 We hold no other security certification or attestation. If a certification is not named on this page, we do not have it.
12.6 If you are evaluating Ingy for an organisation with a formal vendor security requirement, this is the honest position, and you should weigh it. We would rather lose that sale than misrepresent it.
13. Reporting a vulnerability
13.1 If you believe you have found a security vulnerability in Ingy, please tell us: [email protected].
13.2 Please include:
- what you found, described clearly;
- the steps to reproduce it;
- the impact you believe it has;
- any proof-of-concept, logs or screenshots; and
- how you would like to be credited, if you would like to be.
13.3 We will acknowledge your report within 5 business days. We will keep you updated on what we are doing about it.
13.4 Please do not publicly disclose the issue before we have had a reasonable opportunity to fix it. Contact us first and give us a chance to put it right.
13.5 Please do not access, modify or delete data belonging to other users, degrade the service for others, or run automated scanning that affects availability, while testing. Test against your own account.
13.6 There is no paid bounty programme. We do not pay for security reports. We will credit researchers who want it, and we will be genuinely grateful, but we are not going to imply money that does not exist.
13.7 We will not pursue legal action against researchers who report in good faith, follow section 13.4 and 13.5, and give us a reasonable chance to fix the issue.
14. Data deletion
14.1 You can ask us to delete your account by emailing [email protected].
14.2 On account deletion we delete: your posts, your saved versions, and your learned style profile. This is permanent and we cannot recover it afterwards. If you want to keep any drafts, copy them out of Telegram first.
14.3 We retain financial and transaction records for 6 years, because UK law requires us to. This applies even after your account is deleted.
14.4 Deletion from live systems happens first; residual copies in encrypted backups age out on the normal backup cycle.
15. Third parties
15.1 Ingy relies on third-party providers to function, including for AI generation, transcription, hosting, analytics and payments. Each is named, with what it receives, on our Sub-processors page.
15.2 We select these providers and we can change them, but we do not control their internal security, and this page does not make claims on their behalf. Each publishes its own security information.
16. Changes to this overview
16.1 We may update this overview as the product and our practices change. The version number and effective date at the top will change.
16.2 If we gain a certification listed in section 12, we will move it out of that section — and not before.
17. Contact
17.1 Security reports: [email protected].
17.2 General questions, including about this page: [email protected].
17.3 Formal legal notices: [email protected], or IX Labs, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.
17.4 This overview is governed by the law of England and Wales.
Contact
IX Labs
27 Old Gloucester Street, London, WC1N 3AX, United Kingdom
General enquiries: [email protected]
Legal notices: [email protected]