Privacy Policy

Last updated: 2026-05-07

What we collect

• Account info: name, email, password (hashed), profile photo, bio.
• Artist info: Stripe Connect account ID + status. Stripe collects KYC data on our behalf — we don't see it.
• Purchase data: what you bought, when, how much, payment intent ID. Card data is handled by Stripe; we never see card numbers.
• Usage analytics: page views, plays, downloads, basic device info, country (derived from billing). Used to operate the Service and improve recommendations.
• Communications: support tickets, in-app notifications, fan-following lists.

How we use it

• Provide the Service, process purchases, deliver music to buyers.
• Pay artists via Stripe Connect.
• Send transactional emails (receipts, password resets, important account notices).
• Send marketing emails (subscription renewals, new releases from artists you follow) — only if you've opted in.
• Detect fraud and abuse.
• Comply with legal obligations (subpoenas, tax reporting).

Who we share with

• Stripe — payment processing, including any Connect account onboarding.
• Cloudflare R2 — storage of music files and cover art.
• Supabase — database + auth hosting.
• Email service (Zoho / ZeptoMail / Resend) — transactional + marketing email delivery.
• Law enforcement — only when legally required.

We do not sell your personal data. We do not share your data with advertisers.

Cookies + tracking

We use first-party cookies for authentication (Supabase session). We use localStorage to remember dismissed banners + your app-conversion preferences. We do not use third-party advertising trackers.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data, and to opt out of marketing communications. Emailsupport@indiecrave.com to exercise any of these rights.

EU residents: GDPR applies. CA residents: CCPA applies. We honor verifiable consumer requests within 30 days.

Data retention

We keep your data while your account is active and for a reasonable period afterward to comply with legal obligations (typically 7 years for tax records).

Security

We use industry-standard encryption in transit and at rest. No system is perfectly secure; promptly notify support@indiecrave.com if you suspect unauthorized access to your account.

Children

The Service is not directed to children under 13. We do not knowingly collect data from children under 13.

Changes

Material changes will be announced 30 days in advance via email and an in-app notice. Continued use after changes take effect constitutes acceptance.

Contact

support@indiecrave.com.