Legal
Privacy Policy
This policy covers two groups of people: founders, who have an Indiehacker Studio account, and visitors, the people who use the sites where a founder installed the Indiehacker Studio script. We keep as little as the service needs and protect what we keep.
Founders: what we store
- Your email address, when you sign up. It identifies your account and is where we send links, notifications and receipts. We store it encrypted.
- Your projects: names, domains, verification status and bubble settings.
- Your Stripe connection (Pro), if you add one: a restricted key with read-only permissions, stored encrypted and used only on our servers to read subscription data, plus the subscription and revenue figures we compute from it.
- Billing records from Stripe: your plan, when you paid and the payment status. Card details stay with Stripe; we never see them.
- A session cookie that keeps you signed in, and a readable cookie that only says whether you are signed in.
Visitors: what we process for founders
When a founder installs the script, we process visitor data on the founder’s behalf. For those visitors, the founder decides how the data is used, and we act as their processor.
- A random id kept in the browser’s localStorage, so visits and chat threads can be told apart. It is not linked to a name, an email or an IP address. The analytics set no cookies.
- Pages and events: the page address, the referrer, UTM parameters, custom events the site sends, and the time.
- Country, device, browser and operating system. The country is looked up from the IP address at the moment of the request. IP addresses are never stored; they are also used briefly for rate limiting.
- Messages and attachments a visitor sends through the bubble (chat, feedback, ratings, bug reports, screenshots, screen recordings, files), and the page, browser, viewport and, if the founder turned it on, recent console errors attached to a bug report. Message text is stored encrypted; files are kept in a private bucket.
- Details a visitor or the site gives: an email address left for a reply, or a name, email and user id the site passes with
identify. Emails and names are stored encrypted.
Visitors who want their data removed should contact the site’s owner; we help founders handle those requests. You can also write to us and we will pass it on.
What we don’t do
- We don’t sell data, use it for advertising, or follow visitors across sites.
- We don’t use founders’ or visitors’ data to train AI models.
- We don’t send visitor data to any analytics or ad provider.
How we use data
- To run the service: record analytics, deliver messages in real time, send email notifications and replies, compute revenue metrics.
- To bill founders and send account emails.
- To keep the service safe: domain verification, rate limits, spam and abuse prevention, debugging.
Providers
- Hostinger hosts the servers and the database.
- An S3-compatible storage provider keeps attachments in a private bucket.
- Stripe processes payments for Indiehacker Studio plans.
- Mailgun sends account email, notifications to founders and replies to visitors who left an email.
- Cloudflare Turnstile, when enabled, checks that a visitor’s first message comes from a person.
- indiehacker.studio’s own public pages use Indiehacker Studio itself (cookieless analytics and the support bubble), so the same rules apply to you as to your visitors. We don’t use Google Analytics. The Meta Pixel would run only after you accept a cookie banner, which appears only if we turn the pixel on; it is off today. Neither ever runs in the dashboard or on founders’ sites.
Retention
Analytics events, conversations and files are kept while the project exists. Deleting a project deletes its domains, analytics, conversations, files and revenue data right away; backups kept by our host age out on their own schedule. Disconnecting Stripe deletes the key and the revenue figures. Billing records are kept as long as tax and accounting rules require.
Your rights
Founders can delete projects from their settings. To delete your account, email support@indiehacker.studio from your account address: we cancel any subscription and delete the account and all its projects. You can also ask for a copy of your data or a correction the same way. Depending on where you live (for example the EU, UK or California) you may have further rights; we honor them.
Changes
We will update this page when the policy changes and show the date above.