Privacy notice

Information Indie collects

• Your account. Your name, email address and password (stored only as a hash), optional two-factor settings, workspace memberships and roles, and preferences such as time zone, sounds, quiet hours, notification previews and email choices.
• Your projects and monitoring. Project names, the addresses and heartbeats you ask Indie to check, check results, incidents, maintenance windows and status page content.
• Sales and customers. Purchases and refunds that you send through the Events API or a Stripe webhook, or that Indie reads after you connect Stripe: amounts, currencies, transaction identifiers, and customer names and email addresses. Indie does not keep card numbers, bank details, billing addresses, payment methods or the complete charge record from Stripe.
• Custom events. The titles, messages and metadata your server sends. Indie stores what you send, so leave out passwords, keys, card numbers and anything else that does not belong in an operations dashboard.
• Your phone. A push notification token for each device you enable, so alerts reach it. The app and widgets keep a recent summary on the phone so they can show it quickly. Indie does not collect your location, contacts or an advertising identifier.
• Bug reports. When a website owner enables the feedback widget, reports can include a title, description, reproduction steps, page address, app version, browser information, an optional contact email and an optional screenshot. Reports and internal notes are private to the authorized workspace.
• Your Indie subscription. Your plan, subscription status and billing dates, and the Stripe customer and subscription identifiers that link them. Stripe handles your card details; Indie never receives them.
• Technical details. Our hosting receives request details such as IP addresses and browser or device information when you use Indie. Indie uses them briefly to deliver the service and to limit abuse; they are not stored in your account records.

When you send Indie information about your own customers, you decide what to send and are responsible for having the right to share it. Indie processes it only to provide the service to you.

How information is used

To run Indie for you: sign-in and account security, monitoring, incidents, sales history, notifications, widgets, billing, exports and support. To operate and protect the service, including investigating problems and preventing abuse. To send the emails the service depends on, such as verification, password and security notices, and billing messages. Other emails, such as product updates, are sent only if you turn them on, and every one has a way to stop them.

Indie does not sell your information, show advertising, or use third-party trackers or behavioral analytics in the web app, the iPhone or Android app or this website. Your data is not used to train AI models.

Services that process information

• Hostinger hosts the servers and database that run Indie, in the United States.
• Stripe processes payments for Indie subscriptions. If you connect Stripe, Indie also uses read-only permissions to read charges, refunds, customer names and email addresses, and the events that announce them. Indie cannot create charges, issue refunds or change your Stripe account.
• Inbound sends Indie’s account, security and billing emails, and receives mail sent to Indie’s support address.
• Google Firebase When Android push is configured and enabled, Firebase Cloud Messaging handles device registration identifiers and notification delivery. Notification detail follows your preview preference.
• Apple delivers notifications to your iPhone. A notification includes the project name. With previews turned on, it also includes details such as the sale amount or the event text; with previews off, it uses general wording.

These providers handle information under their own privacy policies. Links you follow from Indie, including links to your own apps, lead to sites with their own practices.

Storage, cookies and security

Indie stores your records on its hosted servers. The web app uses one sign-in cookie, needed to keep you signed in; it does not use advertising or analytics cookies. The iPhone app keeps its sign-in credentials in the iOS Keychain. Android credentials are encrypted with a key held in Android Keystore.

Indie uses HTTPS, password hashing, optional two-factor authentication, scoped project keys and a read-only widget credential. Stripe access tokens are stored encrypted. No system is perfectly secure, so keep your password and project keys private and revoke a key you no longer use.

Keeping and removing information

Indie keeps your records while your account and workspace exist. Individual check results are kept for 30 days and daily monitoring summaries for 12 months. Sales, customers, events and incidents stay until you delete the workspace or your account. Records of email delivery are removed after 30 days.

You can delete your account from Settings in the web app or either companion app. This removes your account and the workspaces only you belong to, with their projects, sales and monitoring history. A shared workspace stays with its remaining members, and text that other people wrote there can still mention you. An active subscription has to be cancelled before its workspace can be deleted.

Disconnecting Stripe removes Indie’s stored access and stops new syncing; purchase history already recorded stays until you delete it with the workspace. To revoke Indie at Stripe as well, remove it from your installed Stripe apps.

Backup copies are kept for up to about eight weeks and then deleted, so deleted information can remain in a backup for that long. Operational logs are overwritten as they grow. Stripe and Apple keep their own records under their own policies.

Your choices and requests

• Export. Download a copy of the workspaces you own from Settings → Your data in the web app.
• Correct. Change your name and preferences in Settings. To change your email address, email us.
• Limit. Turn off notification previews, sounds or optional emails, and pause or remove monitors.
• Delete. Delete your account from Settings, or ask us to.

Depending on where you live, you may have rights to access, correct, delete or move your information, or to object to some uses of it. Email hello@heyindie.io for any request. We may need to confirm that the account is yours before acting on it. Do not send passwords, project keys or card details by email.

Who Indie is for

Indie is a tool for adults running apps and online businesses. It is not directed to children, and we do not knowingly collect information from anyone under 16.

Updates to this notice

When this notice changes, the date at the top changes. If a change materially affects how your information is used, we will tell you in Indie or by email before it applies.

Contact

Indie is operated by MVP Labs. Questions or requests about privacy: hello@heyindie.io.