Privacy Policy

• Account data from Google when you sign in: your Google account ID, email address, name and profile photo. Your email is private: it is never shown on IndieStore and is used only for your account, receipts and important notices.
• Public X profile data when you link an X handle: X user ID, username, display name, profile photo URL, bio, follower count, account creation date and verification type. We read only what is already public on X, using a public lookup service; we never get access to your X account and never post on your behalf. To prove a handle is yours, you place a one-time code in your X bio, which you can remove right after.
• Content you provide: listings, comments, reviews, upvotes, and advertising campaign details.
• Analytics API key (optional, makers only; DataFast, Plausible, Simple Analytics or Pirsch): stored encrypted and used only to read aggregate visitor counts for your listed website.
• Session cookie (“is_session”, 30 days): keeps you signed in. Strictly necessary.
• Device cookie (“is_did”, 12 months): a random identifier used only to de-duplicate views and clicks and prevent click fraud. It is not linked to your account for any other purpose and is never shared.
• IP address and browser type, processed transiently to block bots and enforce fraud limits. We do not store raw IP addresses: we store only a one-way keyed hash that changes every day.
• Theme preference stored in your browser's local storage.
• Payment records for ad campaigns: payment ID, amount, currency, status and date. Card and bank details are handled by Dodo Payments and never reach our servers.

• To provide accounts, listings, voting, comments and campaigns (performance of our contract with you).
• To calculate fair rankings and prevent fraud, spam and abuse (our legitimate interest in a trustworthy service).
• To keep the service secure and fix problems (legitimate interest).
• To meet legal obligations, such as tax records for ad payments (legal obligation).
• Where Indian law applies, we process your data based on your consent given at sign-in and for the legitimate uses permitted under the Digital Personal Data Protection Act, 2023.

Your name, X username, profile photo and bio are shown publicly next to your listings, comments and reviews, and on your IndieStore profile page. Upvote counts are public; who upvoted is not shown publicly.

• Cloudflare, which hosts IndieStore and its database.
• Google, which handles sign-in (governed by Google's privacy policy).
• FxTwitter (a public X lookup service), which receives only the X handle you choose to link, to fetch that public profile.
• Your analytics provider (DataFast, Plausible, Simple Analytics or Pirsch), only when you connect it: we send your key to that provider to read your own site's visitor counts.
• Dodo Payments, our payment provider and merchant of record for ad payments, which receives your name, email and billing details at checkout.
• Authorities, where required by law or to protect rights and safety.

• Fraud-limit counters (hashed device and IP keys): automatically deleted after about 3 days.
• Sessions: 30 days, or until you sign out.
• Aggregate statistics (hourly view and click counts per app): kept indefinitely. They contain no personal data.
• Account, listings, comments and votes: until you delete them or ask us to delete your account.
• Ad campaign and payment records: as long as tax and accounting law requires.

Our providers may process data in countries other than yours, including outside India and the European Economic Area. Where required, we rely on appropriate safeguards such as standard contractual clauses.

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict certain processing, withdraw consent, and nominate someone to exercise your rights. Email privacy@indiestore.lol from the context of your account and we will respond within 30 days.

Grievance officer (India): complaints can be sent to privacy@indiestore.lol. If you are not satisfied, you may complain to the Data Protection Board of India or, in the EU/UK, your local data protection authority.

IndieStore accounts are for people aged 18 and over. We do not knowingly collect data from children.

We use HTTPS everywhere, store only hashes of session tokens, encrypt API keys at rest, hash IP addresses, and limit who can access production data. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

We will post updates here with a new date. Material changes will be highlighted on the site.

privacy@indiestore.lol