Privacy Policy

Last updated: November 6, 2026

The Indie Index (“we”, “the site”) is a curated catalog of indie games available at https://theindieindex.pages.dev. Developers can sign in with their Google account and submit a link to their game's page on itch.io or Steam, which is then reviewed and listed in the public catalog. This policy explains what data the site handles and why.

1. Data we collect

Google user data (Google Sign-In)

When you click “Sign in with Google” we receive, from Google, your name, email address, profile picture URL and your Google account identifier. We request no other permission and no access to your Gmail, Drive, contacts or any other Google service.

• Your name and profile picture are used only to show who is signed in, in the page header. They are kept only inside your session cookie, not in our database.
• Your email address and account identifier are stored in our database next to each game you submit, so that you can manage or delete your own submissions, so that daily submission limits can be applied per account, and so that site administrators can identify the author of a submission during review.

Game submissions

The game name, store link, short description, tags and cover image you submit (or that we read from your public store page) become public in the catalog once the game is published. Your email address is never shown publicly.

Cookies

We use a single, strictly necessary cookie (ii_session) that keeps you signed in for up to 7 days. It is HttpOnly and is deleted when you sign out. We do not use advertising, analytics or tracking cookies.

YouTube Showcase form

The separate form on the YouTube Showcase page collects the details you type into it (game name, developer name, contact email, synopsis, download link, comments). It is processed by Formspree and used only to review your trailer submission.

2. How submissions are reviewed (automated review)

To keep the catalog free of spam, the server reads the public text of the store page you link and sends it, together with the game name you typed, to Google's Gemini API so that it can check the game against our curation rules and write a short description. We do not send your email address, name or any other account data to Gemini. If the automated review is unavailable, you can enter the details manually and an administrator reviews them.

3. Who we share data with

We do not sell your data and we do not use it for advertising. Data is processed only by the services needed to run the site:

• Cloudflare — hosting, and the database where submissions are stored. Cloudflare processes connection data such as IP addresses under its own policy.
• Google — Google Sign-In, the Gemini API (see section 2) and Google Fonts, which loads fonts from Google's servers and therefore receives your IP address.
• itch.io and Steam — we fetch the public store page you link.
• Formspree — only for the YouTube Showcase form.

Only the site administrators can see the email addresses stored with submissions, and only to operate and moderate the site. We may disclose data if required by law.

4. Google API Services User Data Policy

The Indie Index's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the sign-in and submission features described above, is not used for advertising, and is not read by humans except administrators looking at an author's email during moderation.

5. Retention and your choices

• You can delete any game you submitted at any time from the “Your submissions” list in the submission window. Deleting a game also removes the email address stored with it.
• Per-account daily usage counters (numbers only) are kept for rate limiting.
• To request deletion of any other data we hold about you, contact us through our Discord server (link in the page header) and we will remove it.
• You can stop sharing data with the site at any time by signing out and revoking access at myaccount.google.com/permissions.

6. Security

Connections use HTTPS, secrets are kept on the server and never exposed to the browser, and sessions are signed so they cannot be forged. No system is perfectly secure, but we take reasonable steps to protect the data we hold.

7. Children

The site is not directed to children under 13 and we do not knowingly collect their data.

8. Changes

We may update this policy; the date at the top shows the latest version.

9. Contact

Questions about this policy or your data: reach us on our Discord server.