Privacy Policy

IndieSignal is operated by ArkandSoft ("we", "us", "our"). This policy explains what data we collect from you when you use indiesignal.app (the "Service"), why we collect it, and the choices you have.

Account information: your email address and password when you sign up. Passwords are handled by our authentication provider (Supabase Auth) and are never stored or visible to us in plain text.

Billing information: when you subscribe, our payment processor (Stripe) collects and stores your card details directly — we never see or store your full card number. We keep only your Stripe customer/subscription IDs and plan status, so we know what you're entitled to see.

Usage data tied to your account: which catalog ideas you've saved, and which full analyses you've unlocked (free pick or paid unlock). This is what lets your saved list and unlocks persist across sessions.

Technical data: we briefly process your IP address to enforce rate limits (preventing abuse of search and other endpoints) and to run bot-protection (Cloudflare Turnstile) on sign-up/login. This is used transiently and is not stored long-term or linked to your account profile.

We do not run any analytics, advertising, or cross-site tracking scripts on the Service. We don't sell, rent, or share your personal data with third parties for marketing purposes.

To create and secure your account, process your subscription and payments, remember your saved ideas and unlocks, send you transactional emails (sign-up confirmation, password reset, billing receipts), enforce fair-use rate limits, and respond to support requests you send us.

We rely on a small number of specialized providers to run the Service, each acting under their own privacy/security commitments: Supabase (database and authentication), Stripe (payment processing), Vercel (hosting), Upstash (short-lived rate-limit data), Cloudflare (bot-protection widget), and Brevo (delivery of transactional emails). We only share the minimum data each provider needs to perform its function — none of them are authorized to use your data for their own marketing.

We use only essential cookies: one to keep you signed in (set by Supabase Auth) and none for advertising or cross-site tracking. Disabling cookies in your browser will prevent you from staying logged in but won't otherwise be tracked against you.

We keep your account data for as long as your account is active. If you delete your account or ask us to, we will delete your personal data within a reasonable timeframe, except where we're required to retain billing records for legal or tax purposes.

We apply industry-standard safeguards: encrypted connections (HTTPS/TLS) everywhere, database-level access control (Row Level Security) so your data is only reachable through our authenticated application logic, and no plaintext storage of passwords or card numbers. No system is perfectly secure, but we take reasonable, ongoing steps to protect your information, including periodic security reviews.

You can access, correct, or delete your personal data at any time. Most of this you can do yourself from your account page (saved ideas, subscription, unlocks); for anything else — including full account deletion — email hello@indiesignal.app and we'll handle it promptly.

The Service is intended for business and professional use and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Our service providers operate infrastructure in multiple countries (including the United States and the European Union). By using the Service, you understand your data may be processed outside your own country, by providers who maintain their own compliance and security safeguards.

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "last modified" date on this page. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

Questions about this Privacy Policy, or requests regarding your data, can be sent to hello@indiesignal.app.