Privacy Policy

1. Who Is Responsible for Your Data

indieshipped operates indieshipped.com. For the purposes of the GDPR and UK GDPR, the data controller is [LEGAL ENTITY NAME], [REGISTERED ADDRESS], [COUNTRY]. You can reach us about anything in this policy at [email protected].

This policy explains what we collect, why, who we share it with, and what you can ask us to do about it.

2. What We Collect

Account data. When you sign in with Google we receive and store your name, email address, profile picture and Google account identifier. We do not receive or store your Google password. We do not operate password-based accounts.

Content you submit. Product listings (name, description, website URL, logo, screenshots, categories, tags), comments, and upvotes. Published listings and comments are public by design.

Purchase data. If you buy a paid upgrade, we store a customer reference from our payment provider and the status of your order. We never receive or store your card or bank details — see section 4.

Communication preferences. Whether you have unsubscribed from our non-essential emails.

Technical data. Your IP address is processed briefly to rate-limit requests and block abuse. It is held in a short-lived cache, typically for minutes, and is not written to our database or used to build a profile of you.

What we do not do. We run no analytics, advertising or behavioural-tracking services on this site. We do not sell or rent personal data, and we do not use it to train AI models.

3. Why We Use It, and Our Legal Basis

• To run your account and publish your listings — performance of our contract with you.
• To process and fulfil paid upgrades — performance of a contract.
• To send service emails such as sign-in links, launch notifications and order confirmations — performance of a contract.
• To review submissions, moderate content, prevent spam and abuse, and secure the platform — our legitimate interest in running a trustworthy service.
• To send occasional non-essential updates — your consent, or our legitimate interest where permitted. Every such email carries an unsubscribe link.
• To meet accounting and legal obligations — compliance with a legal obligation.

4. Who We Share It With

We do not sell your personal data. We share it only with the service providers below, each of which processes it on our behalf for the stated purpose:

• Polar Software Inc. — payments and merchant of record. Polar sells and processes every paid upgrade as merchant of record, handling the payment, applicable VAT and sales tax, invoicing and refunds. It receives your name, email address, billing country and payment details directly. Because Polar is the seller of record it acts as its own controller for that transaction, under its privacy policy at polar.sh.
• Google — sign-in. Authentication via Google OAuth and Google One Tap.
• Resend — email delivery. Sends our sign-in links, service emails and notifications.
• UploadThing — image hosting. Stores the logos and screenshots you upload.
• AI providers — listing autofill. If you use autofill, the public content of the website URL you supply is sent to our AI provider to draft a description. Our current default provider is DeepSeek.
• Ahrefs — domain metrics. We look up public domain ratings for submitted websites. Only the domain is sent; no personal data.
• Our hosting and database providers, which store the data described in this policy on our behalf.

We may also disclose data where we are legally required to, or to establish, exercise or defend legal claims.

5. International Transfers

Some of the providers above are based outside the European Economic Area, including in the United States and, in the case of our AI provider DeepSeek, in China. Where data is transferred outside the EEA or UK we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or on your explicit consent where no other basis applies.

Autofill is optional. If you would rather no data reached an AI provider, write the listing description yourself instead of using it.

6. Cookies

We use only cookies that are strictly necessary for the site to work:

• A session cookie that keeps you signed in
• A small preference cookie remembering interface choices such as a collapsed sidebar

We set no analytics, advertising or tracking cookies, which is why you are not asked for cookie consent.

7. How Long We Keep It

• Account data — while your account is open, then deleted or anonymised when you delete it.
• Published listings and comments — retained as part of our directory record, since removing a launched listing would break the public archive. You can ask us to remove your name from it.
• Order records — kept as long as tax and accounting law requires, typically several years.
• Rate-limiting data — minutes.

8. Your Rights

If you are in the EEA or UK, you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time without affecting processing already carried out.

If you are in California or another US state with comparable law, you have the right to know what we collect, to request deletion or correction, and not to be discriminated against for exercising those rights. We do not sell or share personal data for cross-context behavioural advertising.

You can delete your account yourself from your account settings, and unsubscribe from non-essential email using the link in any such message. For anything else, email [email protected]. We reply within 30 days.

If you think we have handled your data badly, you may complain to your local data protection authority. We would appreciate the chance to put it right first.

9. Security

We protect your data with measures appropriate to the risk, including encryption in transit, restricted administrative access, and payment handling delegated entirely to our payment provider so that card details never reach our systems. No online service can be completely secure, and we cannot guarantee absolute security.

10. Children

indieshipped is not intended for anyone under 16, or under the age of digital consent in their country if that is lower. We do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this policy. If a change materially affects how we handle your data we will give notice by email or on the site before it takes effect. The date at the top shows when this version was published.

12. Contact

Questions or requests about your data: [email protected] or our contact form. See also our Terms of Service.