Privacy Policy

Awesome Indie is a directory of trending micro startups and indie products at awesomeindie.com. It is an independent project, run by its founder, Diogo Capela, not a company with a privacy department, which is why this document is written in sentences rather than in clauses borrowed from someone else's policy.

For data-protection purposes the controller of the personal data described here is Diogo Capela. Reach us at [email protected] for anything in this document. We have not appointed a data protection officer, as a project of this size is not required to; the same address reaches the person who decides.

This covers the website at awesomeindie.com, the API at api.awesomeindie.com that serves it, the MCP server that lets an AI assistant act for you, the Awesome Indie app for iOS and Android, and the emails and push notifications we send you. The app is the same service in a different shell: it uses the same account, talks to the same API, and everything in this document applies to it. Where the app does something the website cannot, such as a push notification or a photo taken from your phone, clause 12 says so.

It does not cover the products listed in the directory: those are other people's websites, and once you click through you are on their terms and their privacy policy, not ours.

It also does not cover what you choose to publish. A bio, a product description or a comment is public the moment you save it. See clause 06.

Sign-in and account

You sign in with Google, Apple, X or GitHub, or with your email address and a password. With a provider, we receive from it your name, email address, a profile picture URL and an account identifier, plus the access and refresh tokens that keep the connection working. We copy the picture to our own storage so your avatar is served from our domain, and we generate a username for you.

With an email address, we hold the name and address you give us and your password, stored only as a salted hash that cannot be turned back into the password. We email a link to confirm the address before the account can be used, and again whenever you ask to reset the password or it changes.

Sign in with Apple is a little different. Apple sends no picture, sends your name only the first time, and lets you hide your address behind a private relay: we then hold a @privaterelay.appleid.com address instead of your real one, and anything we email you passes through Apple on its way to you. Turning the relay off, or stopping using Apple ID with us, is done in your Apple account settings.

The profile you write

Anything you fill in on Settings → Profile: display name, username, bio, country, location, links to X, Instagram, Facebook, GitHub, LinkedIn, Threads, Pinterest, Bluesky, YouTube and TikTok, whether the account is a business account, and whether you appear on the makers map. Some accounts also carry approximate coordinates: a city-level point, never a precise location, used only for that map pin.

What you do here

Products you submit, upvotes, comments, community posts and articles, likes and reposts, challenges you enter, who you follow and who follows you, who you have blocked, the launches you asked to be reminded of, the days you were active (which is what the streaks and the leaderboard are built from), and how many times your profile and your products have been viewed, in total and per day.

AI assistants you connect

If you connect an AI assistant to your account through our MCP server, we store the app's registration, the permissions you granted it and the access tokens it holds, and we record what it does the same way as anything you do yourself. Its tokens expire on their own; to cut it off sooner, remove it in the assistant itself or ask us at [email protected]. Deleting the account ends its access at once.

Requests, sessions and devices

Each sign-in creates a session row holding a session token, the IP address the request came from and your browser's user-agent string, so signing out really ends the session and so we can spot a stolen one. Our web server and Cloudflare also keep short-lived request logs. Separately, a random identifier in a cookie (_dh) lets us count a view once per device instead of once per refresh, and tell fifty submissions from one browser apart from fifty people. It is generated in your browser and holds nothing about you, but it is stored next to a product you submit from that browser, so treat it as linked to your account from then on.

Push notifications

If you turn notifications on in the app, or in a browser that supports them, we store one subscription per device: the delivery address the platform issues for it (an Expo push token on a phone, a push endpoint and its encryption keys in a browser), a short label such as "iPhone" or "Chrome on macOS" so you can recognise it in Settings, and when it was last used. A token identifies an installation of our app on one device; it is not a device identifier in the advertising sense and cannot be used to find you outside our service. The list of events you have muted is stored on your account, so a preference set on the phone applies in the browser too. Turning notifications off on a device deletes its subscription; so does uninstalling the app, after the platform reports the token dead.

Photos from your phone

The app asks for access to your photos only when you tap to change your profile picture, and only receives the single image you pick, which we resize and store as your avatar in the same place as everyone else's. We never read your photo library, its metadata or the location embedded in a picture, and the app requests no camera, contacts, location or microphone permission at all.

Submissions and reports

A submitted product carries everything on its listing (title, tagline, description, website, categories, maker credits, video and social links — whether you wrote them or our AI drafted them from your website) along with the device identifier above, which is how we notice fifty submissions arriving from one browser. Reporting a product does not need an account: a report stores the reason, your notes, the IP address it came from and, if you are not signed in and choose to give one, an email address so we can reply.

Payments

Buying a paid launch, Awesome Indie Pro or a sponsorship happens on Polar, which is the merchant of record: your card details go to them and never reach our server. What we keep is the record of the sale: which account and, for a launch, which product it was for, Polar's order, checkout and subscription identifiers, the amount, the currency, and whether it is active, has been redeemed, launched, cancelled or refunded. Your invoices and payment methods live in Settings → Billing, which is Polar's own portal. If you have Pro, the verified badge on your profile shows it publicly.

Newsletter and email to us

A new account receives the weekly newsletter, as the sign-up screen says, and you can switch it off in Settings → Notifications or from the link at the foot of any issue. Subscribing without an account stores your email address and nothing else. If you write to us, we keep the correspondence for as long as it takes to sort out and a reasonable while after.

We also keep a log of every email the site sends you: the address it went to, the subject, the date and the message itself, so that "did that arrive, and what did it say" is answerable without guessing. The one-time links in a sign-in or email-change message are stripped out of the copy we keep.

The support chat

The chat bubble in the corner is Crisp. It loads on every page, and what you type into it is stored by Crisp on our behalf: your messages and any file you attach, plus the IP address and browser you wrote from and the page you were on. If you are signed in we also hand Crisp your email address, your username, your avatar and a link to your profile, so a conversation reaches us with a name on it instead of an anonymous visitor number.

Crisp keeps the IP address of anyone who actually starts a conversation indefinitely, and discards it about thirty minutes after the visit for anyone who opens the chatbox but never writes. Treat the chat like email rather than something private to your browser: it is not the place for a card number, a password to one of your own accounts, or anything else you would not put in writing to us.

Under the GDPR every use of personal data needs a lawful basis. Ours are below. "Contract" means we cannot run the account you asked for without it; "legitimate interests" means we judged our reason to outweigh the intrusion, and you can object at any time under clause 10.

We do not build advertising profiles, we run no ad network, and we do not sell or rent personal data to anyone. Nothing here is used to make decisions about you outside Awesome Indie itself.

What you post here is checked by a large language model, hourly, and that check can act on its own, so this clause sets out exactly how far it goes. What you wrote is sent through OpenRouter to a model: a product's details together with the copy and images of the page it links to, a comment, a community post together with the openings of your recent posts, an article, or the name, bio, location, social links and avatar on a profile. No email addresses, IP addresses, payment details or tokens are sent. A profile check also returns a guess at whether the account represents a business rather than a person, which shows as a "Business" badge on the profile, and at what the avatar shows (a face, a logo, an illustration), which is used in ordering some lists of people. If either guess about you is wrong, tell us and a person will set it.

This is the whole of what that check may do without a person:

• A product waiting for review, which nobody but you can see, may be accepted, which books its launch day and emails you the date, or refused. It may only refuse on a short list of grounds: a website that does not load, a broken link in the website field, placeholder or gibberish copy, impersonating somebody else's brand, trading on another product's name, something that is not a software product, and relaunching the same product too soon. A refusal is not emailed to you; the reason is written on the product in My Products, and fixing what it names and resubmitting puts you back in the queue. A paid launch is never refused by it.
• A comment or a community post may be hidden for adult or illegal content, spam or advertising, a phishing or malware link, harassment, gibberish, mention spam, or posting links at volume to farm backlinks. Hiding is reversible and deletes nothing. If three of your posts are hidden within fourteen days, starting a new post is paused for a while; replying to other people is not.
• An article may be hidden for the same reasons, or for keyword stuffing; an article the check is unsure about stays readable at its link but is not listed until a person has looked at it.
• A product already on the site is re-checked whenever you edit it and can never be taken down automatically, and a profile is never restricted automatically. Apart from the posting pause above, nothing about your account, whether a ban, a spam mark, being hidden from the map or the leaderboards, is ever automatic.

Every other conclusion, however confident the model sounded, is handed to a person together with the reason it gave.

Where something was decided automatically you have the right to have a person decide it instead, to say why you think it is wrong, and to contest the outcome. Write to [email protected] and a human will look at it themselves and tell you what they concluded.

Awesome Indie is a public directory, so most of what you add is meant to be seen. Publicly visible, to anyone and to search engines:

• Your profile: avatar, username, display name, bio, country, location, social links and join date, and the badges it carries (Pro, Business, a verified domain)
• Your view count, your streak numbers and your position on the leaderboards
• Products you submitted, products you upvoted, your comments, posts, articles, likes and reposts, challenges you entered, and who you follow and who follows you
• An approximate pin on the makers map, if your account has coordinates and you have left the pin switched on

Your email address is never published, and neither are IP addresses, sessions, support chats, reports you file, who you have blocked, or anything we hold for moderation.

Off the site

When a product is featured we announce it automatically on our own social accounts (X, Bluesky and Mastodon), which normally means the product name, tagline, link, image and any maker handle credited on the submission. Listings also appear in our RSS feed, our sitemap and the newsletter. The Open Analytics page publishes site-wide totals only, never anything about an identifiable person.

Turning it down

Clear a field in Settings → Profile and it stops being shown; switch off the map pin there too. Delete a comment or a product and it goes. Deleting your account removes the lot. See clause 09. What has already been posted to a social network or crawled by a search engine is outside our control, though we will remove our own posts on request.

We keep the list of companies with access to this data as short as we can. Each one acts on our instructions, for the purpose named, and no more.

Beyond these, we disclose personal data only when the law requires it, when we need it to establish or defend a legal claim, or to protect someone's safety. If the project ever changes hands you will be told before your data moves.

The database and the application live on one server in France, and the images and the backups in Cloudflare R2 buckets held under its EU jurisdiction, so all of them stay inside the EU. The processors marked "United States" in clause 07 mean some data leaves the EEA: analytics events, an email we send you, a payment, a screening prompt.

The support chat is the one worth spelling out, because it is EU-hosted but not only EU-hosted. Crisp is a French company and holds the conversations themselves in the Netherlands, with its own add-on data in Germany. It also routes the chatbox through relay servers in the United States, the United Kingdom and Singapore to keep it responsive. Those relays store no messages, only connection logs: an IP address, a timestamp, a browser user-agent and the site you were on.

Those transfers rest on the European Commission's Standard Contractual Clauses in each provider's data processing agreement, and on the EU–US Data Privacy Framework where the provider is certified under it. Ask us at [email protected] and we will tell you which applies to which.

If you are in the EU or the UK, the GDPR gives you the right to:

• Get a copy of the personal data we hold about you, and know where it came from
• Correct anything wrong or incomplete
• Delete it, where we have no overriding reason to keep it
• Restrict or object to a use of it that rests on our legitimate interests
• Withdraw consent you gave for the newsletter, or for analytics
• Take it elsewhere in a portable, machine-readable form
• Have a person decide anything that was decided automatically, as clause 05 sets out
• Complain to a data protection authority, in the country where you live or work. You do not have to come to us first, though we would like the chance to fix it

Most of this is faster to do yourself: edit or clear any field in Settings → Profile, change what we email you in Settings → Notifications, and change your email address, connect or disconnect a sign-in provider, or delete the account outright in Settings → Account. The app has the same Settings, including Delete account.

For anything else, email [email protected]. We answer within one month, free (the GDPR allows two more for a complicated request, and we would tell you why within the first), and we will only ask you to prove who you are if the request does not come from the address on the account.

We set as few cookies as the site can work with, and none for analytics until they are allowed. These are all of them.

Analytics, and when they load

If you visit from the EU, the rest of the EEA, the UK or Switzerland, or from anywhere we cannot place, a small banner asks first, and Google Analytics and Microsoft Clarity do not load, set a cookie or receive anything until you press Accept. Reject is the same size, in the same place, and the site works exactly the same either way. We work out the region from the country Cloudflare attaches to your request; the country is not stored, and only the yes-or-no answer is kept in your browser for the rest of the visit.

Everywhere else, the two analytics tools load on arrival without asking, as the law there allows. Wherever you are, Cookie Settings at the foot of every page reopens the choice: saying no there deletes the analytics cookies and stops both tools straight away, and is remembered.

Session replay

Microsoft Clarity records how pages are used (pointer movement, scrolling, clicks) and plays it back to us as a heatmap or a replay. It is aimed at layouts and broken flows, not at people. Clarity masks text input by default, so what you type into a form should not appear in a recording, but treat any recorded page as something we could see.

Purchases

When you pay for a launch or for Pro, Polar tells our server, and our server reports the purchase to Google Analytics: the amount, the currency, what was bought and the order number, together with the identifiers from your _ga cookie, if you have one, which are copied into the checkout when you start it so the purchase counts towards the visit it came from. Your name, email address and payment details are never sent. Without that cookie, because you said no or Google Analytics is blocked, the purchase is still counted, just not tied to you or to any visit.

The support chat

The Crisp chatbox loads on every page, without waiting for the banner, because it is how you reach us. Its cookie is what lets a conversation survive you moving to another page or coming back a week later, and it is not used to follow you around the site or to build a profile of you. Clause 03 covers what goes into a chat and clause 09 how long it stays. Blocking client.crisp.chat with a content blocker removes the bubble; then [email protected] still reaches us.

Clearing it all

Clearing cookies in your browser deletes ours as well: the banner will ask again, and the sign-in cookie going means you will need to sign in again. A content blocker that stops googletagmanager.com and clarity.ms keeps analytics off whatever the banner says.

The Awesome Indie app for iOS and Android, from the App Store and Google Play, is a client of the same API the website uses. It holds nothing of its own beyond your session and a cache of what you last looked at, both kept in the phone's secure storage and cleared when you sign out. What follows is the complete list of things the app does that the website does not.

• Push notifications, only after you turn them on, delivered through Expo to Apple or Google as clause 03 describes, and muted per event in Settings → Notifications
• Your profile picture can come from the phone's photo library; we receive the one image you pick and nothing else
• Sign in with Apple is offered on iPhone, with the relay address described in clause 03
• Deleting your account works from Settings inside the app, with the same immediate effect as on the website

The app contains no advertising, no analytics SDK and no tracking of any kind: Google Analytics and Microsoft Clarity run on the website only. The app store listings describe the same data this policy does; where a store's form forces a coarser label than the truth, this document is the accurate one.

Traffic is encrypted end to end and sits behind Cloudflare's firewall. The database is not exposed to the internet. Passwords, for the accounts that have one, are kept only as salted hashes, never in a readable form. Administrative access is limited to accounts that need it, backups run regularly, and privileged actions are logged.

None of that is a guarantee. This is one server run by a small project, and no service can promise perfect security. If a breach ever puts your rights at risk we will tell you and the supervisory authority within the deadlines the GDPR sets. If you find a vulnerability, please report it to [email protected] before making it public. We will credit you if you would like.

Awesome Indie is for people aged 16 and over, and we do not knowingly collect anything from anyone younger. If you are a parent or guardian and believe your child has an account here, write to [email protected] and we will delete it.

When our practices change, this page changes with them. If a change matters to you, such as a new processor, a new purpose or a new kind of data, we will say so on the site and, where the law requires consent, ask for it before the change applies to you. Earlier versions are available on request at [email protected].

Privacy questions, requests and complaints: [email protected]. Anything technical or account-related: [email protected].

Also worth reading: the Terms of Use, which cover what you may submit and what we may do with it.