One profile. Your IRIS stays private.

What the profile is

Your HANS Society profile holds your HANS username, the X account you link to it, your Hansian and the wallets you add to it. HANS Society Foundation runs it and also operates IRIS. IRIS shows it in the profile pop-out only after you choose Continue with HANS and approve in a HANS Society window. Continue with HANS, in a HANS Society window, is how you log in to IRIS. Connecting a wallet alone still logs no one in.

What IRIS keeps

When you connect, HANS Society gives IRIS’s server a revocable access grant for this browser. IRIS keeps it only inside an encrypted, HttpOnly cookie in this browser; the key to open it stays on IRIS’s server. IRIS stores a login record with person and grant hashes, a view of the wallets and verified Google email shared with the active IRIS account, and security audit events. This view is bound to your HANS person and is refreshed as you use IRIS. When the pop-out needs it, IRIS’s server reads your username, X handle, Hansian, the wallets in your profile and your earned UBAI from HANS Society and shows them to you.

What HANS Society receives

With each read, IRIS sends the access grant, your IP address and a short browser label such as “Safari on iPhone”, used for security, rate limits and your list of connected apps. When a wallet is connected in IRIS, IRIS also sends its public address so HANS Society can say whether it belongs to your profile. IRIS does not send your emails, the wallets linked to your IRIS account, your security or breach results, or your plan. The separate UBAI rewards bridge is described in UBAI rewards privacy.

Your IRIS login is your HANS login

Your existing IRIS account opens only after proof of its creating wallet or Google identity, or an independent confirmation in IRIS. Linking a wallet into another account or using someone else’s browser session does not transfer ownership. IRIS asks for a separate confirmation with an IRIS-verified wallet or an emailed link when you first use a feature that needs private identity data. This is remembered on this device for up to 30 days, within the lifetime of your login. Routine refreshes preserve the original deadline; logout, account changes or an ended HANS authorization require a new confirmation.

Log out ends your IRIS login. Log out of all apps on this device ends this device’s HANS app connections. Log out everywhere ends all HANS sessions and connected-app grants; other open app tabs update on their next request or focus, within five minutes while in use. Older IRIS sessions end when the account first attaches to HANS. An unused HANS connection ends after 30 days, and each grant has a 90-day maximum. During a HANS outage, an existing IRIS login can continue for at most 24 hours after its last successful check; private-data and billing confirmations require a check within 15 minutes.

Token balances

Where the pop-out shows UBAI, HANS or sHANS balances, your browser reads them directly from the blockchain through a public node (today sepolia.base.org), which receives your IP address and the wallet address it is asked about.