This Privacy Policy explains how IndieTools, operated by Cengiz YILMAZ, collects, uses, shares and retains personal data when you browse the site, create an account, publish content, contact another member, subscribe to email, check a website badge or buy a paid service.
1. Who controls your data
Cengiz YILMAZ, operating IndieTools, is the data controller for the personal data described in this policy unless a provider acts as an independent controller for its own service. Privacy questions and rights requests can be submitted securely through the contact page.
2. Data we collect
Account and sign-in data
When you create or use an account, we may process your name, email address, profile image, internal account identifier, email-verification state, role and session information. If you use email and password, the password is stored as a one-way hash, not in readable or reversibly encrypted form. If you choose a connected sign-in provider such as Google, we receive the account information and provider identifiers needed to authenticate you.
Profiles, products and public contributions
We process the information you submit for founder profiles, products, technologies, screenshots, logos, links, social posts, comments, reactions, follows, reports and other public contributions. This can include names, biographies, locations, social handles, product domains, descriptions, pricing, categories, repository information and media. The fields shown as public are intentionally available to visitors and search engines.
Messages and private uploads
Direct messages, message requests, their participants, timestamps, delivery state and attachments are available only to the intended participants and authorised operators when access is necessary for security, abuse review or support. Private attachments are delivered through short-lived authenticated links. Do not send sensitive personal data through messages unless it is necessary.
Website badge data
When you choose Check badge, we process the product's public website, badge and link observations, check status and timestamps. We monitor an accepted reciprocal badge while it grants a followed-link benefit. Product-domain checks using work email or DNS are no longer offered. Historical records may remain for support, audit and abuse review. Account email verification is separate and remains part of sign-in security. The verified product marker identifies an active Pro or Authority plan, not domain ownership or an identity check.
AI-assisted product and article drafts
When enabled, our self-hosted Ollama service uses product information you provide, public product and founder information, your SEO settings, your article brief and text retrieved from the product's public website to suggest listing fields or prepare an article draft. The generation context excludes account credentials, private messages and private product tags. We store draft content and generation status so you can review the result. An AI-written Authority article requires your approval and editorial review before publication.
Purchases, advertising and affiliate data
If you apply to our affiliate programme, we store your verified account email, programme connection, promotion website or social profile, proposed promotion plan, and the policy and time you accepted. We share the application information needed for programme administration with Affonso. Review and connection-recovery actions are recorded in our audit log. Commissions, payout instructions and tax onboarding remain in the provider systems. You can request access to or deletion of application data through our contact page, subject to applicable retention requirements.
For Pro, Authority, advertising and historical Premium, Featured or newsletter-sponsorship purchases, we keep the order, product or campaign, amount, currency, status, provider identifiers, entitlement and fulfilment history needed to deliver and support the purchase. Dodo Payments collects and processes checkout, billing, tax and payment-method information as merchant of record. IndieTools does not receive or store complete card numbers or card security codes.
If optional affiliate attribution is enabled and you allow it, we may process an opaque referral identifier and pass it with eligible checkout metadata so Affonso can attribute a settled purchase, calculate commission and account for refunds or disputes.
Newsletter, contact and service communications
Our newsletter is published on Substack. Subscription links take you to Substack, where you enter your address and manage your subscription; the IndieTools website does not collect newsletter addresses or embed a subscription tracker. As publisher, we can access subscriber information there to deliver and manage the publication. See Substack's privacy policy for its own processing. Historical self-hosted subscription and consent records are held in a restricted archive, not automatically imported or used to resume sending. We also retain the information you provide in contact, feedback, correction, takedown, support and rights requests. Transactional messages such as account verification, security, product review, billing and domain-verification notices are sent when needed to provide or protect the service.
Usage and security data
Our first-party discovery measurement records qualified product-card views, product-page clicks and views, founder-profile clicks and views, and outbound product-website clicks. A card must be at least half visible for one second to qualify. We use a keyed, daily network identifier to deduplicate each target and event type, not a cookie or persistent browser identifier. Raw IP addresses, account IDs and browsing histories are not saved in these measurement tables. Signed-in team activity, obvious bots and administrator previews are excluded; Do Not Track and Global Privacy Control disable this measurement.
Daily deduplication records become eligible for deletion after seven days; aggregate daily counters and dated ranking editions after 400 days. Bounded background sweeps remove expired records. Product teams can see their aggregated counters, not visitor identities. Published Top 100 editions show organic card views and product-page clicks for a completed five-day window. Advertising traffic and the leaderboard's own views and clicks do not determine the ranking. Counts are approximate activity measures, not exact individual visitor totals.
When you run a free domain, SEO, certificate or email-DNS tool, the domains and optional DKIM selector are sent to our server. The check contacts the relevant public website, DNS resolver, RDAP registry or Ahrefs service. Public results may be cached for up to one hour and are not attached to your account. We do not publish your query history or display domain-owner contact details. FAQ generation, URL slug generation and word counting process input in your browser. Do not enter secrets or private network addresses.
Our systems and security providers may process IP address, request time, route, referring source, browser and device information, approximate region, session identifiers, bot-detection signals, rate-limit outcomes and security or moderation events. DataFast is used for journeys, goals and revenue attribution; authenticated areas may identify a visit by internal user ID and public profile properties, but not by email address. Google Analytics 4 is used for aggregate traffic measurement and is not given an IndieTools user ID or email address by our implementation.
3. Why we use data
- To perform a contract: create and secure accounts, publish and manage listings, deliver messages, provide purchased services and support transactions.
- For legitimate interests: operate and improve the directory, measure how it is used, prevent fraud and abuse, enforce rules, protect members, maintain records and understand acquisition.
- With consent: send newsletters and, where enabled, run optional affiliate attribution. You can withdraw consent without affecting processing already carried out lawfully.
- To meet legal obligations and establish or defend claims: maintain required financial, tax, security, complaint and dispute records and respond to lawful requests.
Where local law requires a different legal basis for a particular activity, we use that basis. We do not use solely automated decisions that produce legal or similarly significant effects for members.
4. Public content and machine access
Published product, founder, technology, article and social content is public by design. It may be indexed by search engines and exposed through IndieTools's public API, CLI, MCP server and machine-readable catalogues. Third parties may retain cached or archived copies after content changes or is removed. Private messages, account credentials, unpublished submissions and administrative records are not part of those public interfaces.
5. Cookies and browser storage
We use essential cookies or local browser storage for sign-in sessions, security, preferences and interface state. Blocking essential storage may sign you out or prevent a feature from working.
When configured, DataFast may use first-party visitor and session identifiers, including datafast_visitor_id and related session cookies. Google Analytics 4 may set _ga and a property-specific _ga_* cookie to distinguish visitors and sessions. These services receive sanitised page paths: token-bearing newsletter URLs and other capability values are not deliberately included in analytics pageview payloads.
Optional affiliate attribution does not load Affonso until you choose Allow. If allowed, indietools_affiliate_consent remembers the choice for up to 180 days, while affonso_referral and affonso_data may retain an eligible referral for up to 30 days. You can reopen the optional-cookie control from the footer, withdraw that choice and remove those provider cookies. Browser controls can clear or block other cookies and local storage, although doing so may reduce measurement or functionality.
6. Who receives data
We disclose only what is reasonably necessary to operate the service, complete a transaction, comply with law or protect rights. The current material service categories are:
| Provider or category | Purpose | Typical data |
|---|---|---|
| Dodo Payments | Merchant of record, checkout, payment, tax, fraud, refund and dispute handling | Buyer, billing and transaction data collected at checkout; order metadata from IndieTools |
| Cloudinary | Public media delivery and authenticated private attachments | Uploaded files, technical metadata and access requests |
| Microsoft Graph / Microsoft 365 | Transactional email delivery | Recipient address, subject, message body and delivery metadata |
| Substack | Hosted newsletter publication and subscription management | Information you provide on Substack, subscription preferences and delivery information available to the publisher |
| DataFast and Google Analytics | Product analytics, aggregate traffic and attribution | Page and event data, browser/device data, identifiers and approximate region |
| Affonso | Optional referral attribution and partner commission administration | Referral, conversion, fraud-review and payout-related data |
| Cloudflare Turnstile | Bot and abuse detection on protected forms | IP address, user-agent, TLS and challenge signals |
| Infrastructure providers | Hosting, PostgreSQL database, cache, queues, monitoring and backups | Data stored or transmitted through the service and operational logs |
Providers process data under their own terms and privacy notices where they act as independent controllers. Relevant notices include Dodo Payments, Cloudinary, DataFast, Google, Affonso, Microsoft and Cloudflare's Turnstile Privacy Addendum.
We do not sell personal data. We may disclose information to professional advisers, authorities or other parties when required by law, necessary to protect rights or safety, or as part of a merger, acquisition or transfer of the service, subject to appropriate safeguards.
7. International transfers
IndieTools is available internationally, and some providers or their subprocessors operate in other countries. This can involve transferring data outside your country, Türkiye, the EEA or the United Kingdom. Where required, we rely on recognised safeguards such as adequacy decisions, standard contractual clauses or another lawful transfer mechanism.
8. How long we keep data
- Account and profile data is generally kept while the account is active and for the time needed to complete deletion, resolve disputes and meet legal obligations.
- Published content remains until it is removed, unpublished or the account is deleted, subject to moderation evidence, backups and public caches.
- An accepted reciprocal website badge is monitored while it grants an active link benefit. Historical product-verification records are retained only as needed for support, audit and abuse review; they do not enable a current domain-verification flow.
- Current newsletter subscriptions are managed on Substack. Historical self-hosted records are retained only as needed to honour consent, suppression, support and lawful record-keeping obligations, not as an active sending list.
- Payment, refund, tax and accounting records are retained for the periods required by applicable law and provider obligations.
- Security and abuse events use category-specific retention periods. Legal holds suspend deletion where evidence is needed for an investigation or claim.
When a fixed period is not appropriate, we use the purpose, sensitivity, risk, legal requirements and whether an account or dispute remains active to decide retention. Data is deleted or anonymised when the reason for keeping it ends, subject to lawful exceptions.
9. Security
We use measures intended to protect personal data, including access controls, hashed passwords, encryption for selected credentials and protected fields, transport encryption, short-lived private-media links, rate limits, audit records and challenge verification. No internet service can guarantee absolute security. Use a unique password and tell us promptly if you believe your account or data has been compromised.
10. Your choices and rights
Depending on where you live, you may have rights to access, correct, receive a copy of, delete, restrict or object to processing of your personal data; withdraw consent; and complain to a competent data-protection authority. In Türkiye, relevant rights arise under Article 11 of Law No. 6698. EEA residents may also have the rights provided by the EU General Data Protection Regulation, and UK residents by applicable UK data-protection law.
You can edit much of your account and public content in the product, manage newsletter preferences on Substack or through its email links, unsubscribe at any time and change optional affiliate-cookie choices from the footer. For a formal request, use the contact page from the address associated with the account where possible. We may ask for proportionate information to verify the request, and lawful retention or third-party rights may limit what can be deleted.
11. Children
IndieTools is designed for people who can lawfully operate, submit or purchase products and is not directed to children. We do not knowingly seek children's personal data. A parent or guardian who believes a child provided personal data should contact us so we can review and take appropriate action.
12. Changes and contact
We may update this policy when the service, providers or law changes. The date at the top identifies the published version. Material changes will be communicated through the service or by email when appropriate.
For questions, complaints or rights requests, use the contact page.