Privacy & your data

Scope, requests and your choices

Indiedex uses account information to provide your account and chosen public page, operate moderation and security, respond to support requests and measure use as described below. Depending on applicable law, you may have rights to access, correction, deletion, restriction, objection or portability, and to complain to the relevant data-protection authority. Contact info@zyvrus.com so we can identify the applicable request and verify it proportionately. No claim is made that this notice alone establishes compliance in every jurisdiction.

Accounts are intended for adults aged 18 or older. Report suspected child accounts or publication of a child’s private information to support. We do not sell account email lists. Public page information can be indexed or copied by others; unpublishing does not automatically erase third-party caches.

Your account and public page

We store your email, a password hash, session records and the profile information, uploads and links you submit. Passwords are hashed rather than stored in readable form. Your email is used for account access and is not shown as a public profile field. Information you publish on your page is public. Creator directory participation is optional; unpublished pages are excluded.

Cookies and preferences

A secure, HTTP-only session cookie keeps you signed in; sessions normally last up to 30 days and may refresh with use. Theme preferences are stored in your browser. Password resets invalidate existing sessions. Email verification and reset tokens are stored as hashes and expire after 24 hours and 30 minutes respectively.

Optional writing assistant

When a signed-in account holder requests a bio draft, the supplied bio text is sent to our Microsoft Azure AI deployment to produce a suggestion. This operation is optional, uses bounded request limits and is separate from optional analytics consent. We request no application response storage from the model API; provider security and abuse-monitoring processing may still apply. Review the draft before applying it, then save to publish. Do not submit private or sensitive information. We do not send your password, email or other profile fields as part of this bio request.

First-party analytics

Anonymous aggregate counts are always recorded for page views and link clicks: the event type, page or link, time, referring website host, a coarse device class (mobile, tablet or desktop) and any campaign tag in the link (such as ?utm_source=instagram). No cookie, IP address, user-agent string or visitor identifier is stored for these counts, and page owners see only totals. Optional unique-visitor, search-interest, signup-attribution and sponsored-event measurement is off until you choose Allow measurement. Choose Essential only or change the preference using Privacy choices below. GPC and Do Not Track signals override a saved grant. Security and abuse-prevention processing remains necessary to operate the service. Daily hashes are pseudonymous identifiers, not a guarantee of anonymity.

We record profile/product views and outbound clicks, their target IDs, timestamps, referring hostnames and a daily changing visitor hash. The analytics table does not store raw IP addresses, raw user-agent strings, referrer paths or query strings. IP and user-agent information are processed to form that hash and apply abuse limits. Visitor-day counts do not identify unique people across multiple days. Counts may include missed or synthetic events; they are not independent audits or confirmed sales.

First-party event retention is 90 days. Expired authentication data, old rate-limit buckets and older events are removed by a maintenance job. In a local or unscheduled installation, an operator must run that job; scheduling is a deployment requirement. Account deletion also removes events tied to that page and its owned links/submitted products.

Search interest and page referrals

To show popular topics on Indiedex, we store an allowed topic label, the country selected for research, a UTC day and a daily visitor hash. We do not store the original search phrase in this table. A topic appears publicly only after activity from at least three visitor-days in the past week. The selected country is a research market, not your location. These records expire after 30 days when maintenance runs.

A first-party, HTTP-only indiedex_visit cookie lasts up to 24 hours and connects a public landing visit or an optional Page credit link to a completed signup. We store the landing path without its query string, a broad referral channel, a daily visitor hash and, when a conversion occurs, the new account ID. We do not store the referring search phrase or URL in this table. Attribution records expire after 30 days. These are session-based observations, not proof that a referral caused a signup. Page owners may hide the credit in their editor; owner reports show aggregates.

Service providers and external destinations

Configured hosting, database and storage providers process information needed to run the service. If account email delivery is configured, Resend receives the destination email and account-email content. Ordinary outbound links lead to other services with their own policies; we do not receive their purchase data simply because you clicked a link.

YouTube-powered features, when configured, use public API data and link back to YouTube. See Google's privacy policy and YouTube's terms. Current public API records are refreshed or removed within 29 days when the provider job runs. No social OAuth or payment-provider connection is active in this installation.

Games, votes and optional video previews

Game launch votes and moderated feedback are tied to signed-in accounts. Abuse review uses a salted network fingerprint, not a raw IP address. Play Now records at most one outbound referral per game/network/day; it does not prove a play, purchase or download. Referrals expire after 90 days when the Arena maintenance job runs. Moderation and competition history may be retained for integrity and appeals. YouTube previews load only when you choose them and then connect to YouTube's privacy-enhanced player. Original links remain available if embedding is disabled.

Community discussions

When you choose to vote or comment, we store your account ID, the source-linked topic, vote or comment text and time. Votes are counted separately from provider metrics. Comments are public; an author’s name links to a public profile only while that profile is published. You can withdraw your vote or delete your own comment. Moderators can hide reported content and retain review/audit records where justified. Account deletion removes account-linked votes and comments. These user-requested actions do not require optional analytics consent.

Images, entertainment and sponsorship

Cover images, posters and thumbnails may load directly from Steam, Apple, Wikimedia, YouTube or another displayed provider. Those hosts receive ordinary network request information, including an IP address and browser headers, and have their own policies. Movie, show and anime topic cards reuse public Google search and Wikipedia reading observations. They do not transmit your watch history or create a viewing profile. Dedicated entertainment-provider imports are retired; retained legacy snapshots are purged by maintenance.

Sponsored-placement impressions and clicks store a campaign ID, event type, daily visitor hash and time. These are pseudonymous observations, not anonymous people or confirmed purchases. Events expire after 90 days when maintenance runs. Campaign review, invoicing and dispute records may be retained separately for operational or legal needs. Account deletion and support may leave limited audit or dispute records where justified.

Correction, unpublishing and deletion

Manage your profile visibility in the editor, opt out of discovery, remove links, or delete your account in Settings. Imported public product records are distinct from user accounts and may remain unclaimed after an account is deleted. Use the report controls or contact support to request a correction or removal of public-source records. Moderation and audit records may be retained to handle abuse and disputes. Infrastructure backups may persist according to the deployment operator's backup policy.