1. What we collect
- Account details: your email address, your name if you give one and a scrambled (hashed) version of your password. If you sign in with Google, we receive your Google account’s email, name and an ID from Google.
- Your setup: the role, niches, stores, countries, time zone and digest time you choose.
- What you track: apps you save, developers you follow, saved views and email alerts.
- Plan details: which plan you have, its status and renewal date, and the customer and subscription IDs from our payment partner. We never receive your card number.
- Messages: what you send through the Contact form, and waitlist sign-ups.
- Technical data: your IP address and browser details in short-lived server logs, used for security and to limit abuse, and the time you last opened your dashboard.
2. Cookies
We set one essential cookie when you sign in, to keep you signed in for up to 30 days, and a short-lived one during Google sign-in. We do not use advertising cookies, tracking pixels or third-party analytics.
3. What we use it for
- to run your account and show you the launches, niches and developers you asked for;
- to send emails you asked for: sign-in codes, the daily digest and alerts. Every digest and alert has an unsubscribe link;
- to take payment for paid plans and give you the right plan;
- to answer your messages, keep the service secure and fix problems.
We do not sell your data or use it for advertising.
4. Who we share it with
Only the companies that help us run the service, and only what each one needs:
- Dodo Payments (payments, taxes, invoices): your email, name and billing details you enter at checkout.
- Resend (sending email): your email address and the content of the emails we send you.
- Railway (hosting and database, in the United States): all account data is stored on their servers.
- Google: only if you choose “Continue with Google”. Pages also load fonts from Google Fonts, which shows Google your IP address.
App icons and screenshots load directly from Apple’s and Google’s servers. We may also share data if the law requires it.
5. How long we keep it
We keep your account data while you have an account. When you ask us to delete your account, we delete it and what you tracked within 30 days; copies in our backups are overwritten within 35 days. Payment records are kept by Dodo Payments for as long as tax law requires. Server logs are kept for a short time only.
6. Your choices and rights
- Change your name, niches and preferences on your Profile page.
- Turn the digest and alerts off from Tracking or with the link in any email.
- Ask for a copy of your data, a correction, or deletion of your account through Contact. We answer within 30 days.
Depending on where you live, you may have further rights under laws such as the GDPR, including the right to complain to your data protection authority.
7. Security
Connections are encrypted (HTTPS), passwords are stored only as hashes, sign-in sessions are stored as hashes, and payment details never reach our servers. No system is perfectly secure; if a breach affects you, we will tell you.
8. Children
IndieTower is for people who build or study apps. It is not meant for anyone under 16, and we do not knowingly collect their data.
9. Changes and contact
If we change this policy in a way that matters, we will email account holders. Questions or requests: use the Contact page and choose “Privacy or my data”.