Where your data actually lives
Everything you import sits in this browser's IndexedDB. Nothing is uploaded, and there is no server behind this site beyond static file hosting. Good for privacy. It also means your data is exactly as durable as one browser profile. Clear site data or reinstall the browser and it's gone. Safari can manage it for you: leave the site inactive long enough and its automatic eviction of inactive sites fires. Either way there is no copy anywhere to recover from.
So export a backup from the Data page regularly. If it's been more than two weeks since your last one, the site nags you with a banner. Re-importing a backup restores everything, settings included.
The Data page also offers Export CSV, a spreadsheet-friendly one-row-per-match file for your own analysis. It can't be re-imported, so don't rely on it as a backup.
The file formats
There are two, and both are plain JSON underneath (open one in a text editor if
you're curious). A full profile downloads as .ironfistinsightsprofile; a
match-data file, which carries the games and nothing describing you, downloads
as .ironfistinsights. Import works off what a file contains, not what it is
called, so renaming one changes nothing about how it is read.
Both carry the same two things layered on:
- A
schemaVersion. If the data format ever changes in a way that demands it, old files get rejected with a clear message asking you to re-export, never silently misread. - A SHA-256 checksum, computed over the match data with the browser's built-in Web Crypto API and stored in the file itself. On import the site recomputes it and compares. A mismatch means the file was truncated, corrupted in transit, or hand-edited after export, and the import is blocked by default. You can override the block explicitly if you know the file is fine — you edited it yourself on purpose, say.
Backups from before this extension was renamed end in .hifi instead of
.ironfistinsights. Nothing about the format changed, only the name on disk —
older .hifi backups still import exactly the same way, and always will.
Since format version 3, exports also carry a per-character ratings snapshot: the μ (rating) and σ² (variance) figures from your wavu page's header, which drive the ticker and the Matchups page's ratings table. Older version-2 files still import normally, they just carry no ratings. Import several files and the most recently captured snapshot wins, so pulling in an old export never rolls your ratings display backward. The checksum still covers only the match data.
Since format version 4, backups also carry your personal notes and match tags — see the match log. Wavu exports don't, being always a fresh scrape. Older version-2 and version-3 backups still import normally, again with nothing attached.
Version 5 added your trainer progress — every drill's streak and pass record — so a restored profile picks up execution training exactly where it left off.
Version 6 widened the file from a handful of named settings to every setting on the site: your reading font, your text size, your sample-size floors, your tilt thresholds, your remembered theme and screen filter, your controller and keyboard bindings, your quiz schedule, and your saved profiles. Restoring an older backup still works — it simply carries none of that, and every setting it doesn't mention falls back to whatever the browser already had, the same way an absent field always has.
What the checksum does not do
It's only an integrity check: it proves a file's contents match what was hashed into it. It cannot prove the file genuinely came from this site's export script, because that would need a secret key held somewhere the file itself can't reach, and this is a client-only app with no server to hold one. Anyone with a text editor and the same hashing code can produce a file with a "valid" checksum over whatever contents they like. Only import export/backup files from people and sources you actually trust. The checksum protects you from corruption, not from a file someone crafted to hurt you.
Site visit counter
The site counts visits on its own origin: one row per UTC day holding a date and a number, written by a small serverless function. No IP address, no user agent, no cookie, no path, no session id. Nothing derived from you, and no third party involved. No match data is touched, and nothing about your imported files leaves your browser.
Feedback form
The footer's feedback form goes through a small serverless function that files the subject and description you typed on a private tracker. No match data is involved. Beyond that, the only server contact on the whole site is the footer's visit counter, which records that a visit happened and nothing else.