Privacy Policy

1. Site Owner and Acceptance

This website, application, and any related services (collectively, the "Service" or "PlayIndies") are owned and operated by PlayIndies LLC ("PlayIndies," "we," "us," or "our"), a limited liability company organized under the laws of the United States, with its principal place of business in the United States.

PlayIndies operates a platform that connects independent video game developers, publishers, and agencies ("Developers") with content creators, streamers, journalists, and press ("Creators") for the purpose of distributing game keys, coordinating coverage campaigns, gathering reviews, and supporting the broader indie games community.

This Privacy Policy describes how we collect, use, store, protect, and share information about you when you access or use the Service. By accessing, browsing, registering for, or otherwise using the Service, you acknowledge that you have read, understood, and agreed to this Privacy Policy.

If you do not agree with any part of this Privacy Policy, you must not access or use the Service.

If you have any questions about this Policy, you may contact us at privacy@playindies.com.

2. Effective Date and Enforcement

This Privacy Policy is effective as of the date listed above ("Effective Date") and remains in effect until replaced by a subsequent version published by PlayIndies. Continued use of the Service after a new version takes effect constitutes acceptance of the updated terms.

This Policy is incorporated by reference into our Terms of Service. Violations of this Policy — including unauthorized access to, misuse of, or improper disclosure of user data — may result in:

• suspension or termination of your account;
• denial of access to current and future Services;
• referral to applicable law enforcement or regulatory authorities; and
• civil legal action by PlayIndies LLC or affected users, including claims for damages and injunctive relief.

PlayIndies enforces this Policy in accordance with applicable U.S. federal and state privacy laws, the EU General Data Protection Regulation ("GDPR") and UK GDPR where applicable, the California Consumer Privacy Act ("CCPA") as amended by the CPRA, and other regional data protection laws that may apply to you.

3. Customer Data We Collect

We collect information that you provide directly, information collected automatically through your use of the Service, and information received from third parties you authorize.

3.1 Information You Provide

• Account information: name, username, email address, password (stored as a salted hash), country, profile photo, and account type (Creator, Developer, Agency, Press).
• Profile information: bio, languages, content categories, genre preferences, audience demographics you choose to share, time zone, and pronouns.
• Creator channel information: channel names, follower counts, viewership statistics, content samples, sponsorship rates, and payment handles (e.g., PayPal email) where you choose to provide them.
• Developer/Publisher information: company name, billing address, tax identifiers where required, game titles, press kits, marketing assets, and key inventory.
• Communications: messages sent through the Service, support tickets, contact form submissions, and any other content you submit to us.
• Payment information: processed by our third-party payment processors (e.g., Stripe). We do not store full payment card numbers on our servers.

3.2 Information Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings.
• Usage data: pages viewed, links clicked, features used, search queries, session duration, referring URLs, and timestamps.
• Cookies and similar technologies: see Section 6 for details.

3.3 Information from Third Parties

When you connect a third-party account to PlayIndies via OAuth or similar authorization, we receive the information those platforms make available to us under the permissions you grant, which may include public profile data, channel/video statistics, video and stream metadata, follower counts, and contact information. The third-party platforms we currently support are:

• Social and streaming platforms: Twitch, YouTube, Instagram, TikTok.
• Community: Discord (for community membership and notifications via our Discord bot).

We use this information only as described in Section 4. Account authentication is handled through Amazon Cognito in addition to our own credentialed login.

3.4 Sensitive Information

We do not knowingly collect special categories of personal data such as religious beliefs, health information, biometric data, or political opinions. Please do not submit such information to us.

4. How We Use Your Data

PlayIndies uses the information we collect for the following purposes, each grounded in a lawful basis (contract performance, legitimate interest, consent, or legal obligation):

• Provide and operate the Service — create and manage your account, authenticate sessions, deliver requested features (including game key requests, campaigns, messaging, and reviews), and process transactions.
• Improve our products and services — analyze how features are used, identify bugs, and prioritize roadmap items based on aggregated behavioral data.
• Personalize your experience — recommend games, campaigns, or creators relevant to your stated preferences and historical activity.
• Facilitate matchmaking between Creators and Developers — present Creator profiles, audience metrics, and content samples to Developers evaluating campaign applicants, and present Developer campaigns to relevant Creators.
• Refine our marketing strategy — measure the performance of our own marketing channels and tailor outreach we send to you (with opt-out options described in Section 8).
• Secure the platform — detect and prevent fraud, abuse, account takeover, key reselling, and other prohibited activity, including by recognizing patterns of user input and device fingerprints.
• Communicate with you — send transactional emails (account confirmations, key delivery, campaign updates, security alerts), respond to support inquiries, and where you have opted in, send newsletters or promotional content.
• Comply with legal obligations — including tax reporting, response to lawful requests from public authorities, and enforcement of our Terms of Service.

We will not use your personal data for purposes that are materially different from those described here without first notifying you and, where required, obtaining your consent.

5. Data Storage and Protection

5.1 Where Data Is Stored

PlayIndies data is hosted on Amazon Web Services (AWS) in the US East (N. Virginia) region. We use AWS services including, without limitation, Amazon ECS for application hosting, Amazon RDS / PostgreSQL for primary data storage, Amazon S3 for uploaded media, Amazon Cognito for identity management, Amazon SES for transactional email, and Amazon CloudWatch for monitoring. Data may also be processed by additional service providers described in Section 7, some of whom operate outside the United States.

By using the Service, you consent to the transfer of your information to the United States and to other jurisdictions where our service providers operate, which may have data protection laws that differ from those in your country.

Where personal data of EEA, UK, or Swiss residents is transferred outside those regions, we rely on appropriate safeguards such as Standard Contractual Clauses and adequacy decisions where available.

5.2 How Data Is Protected

We implement administrative, technical, and physical safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. These measures include:

• encryption of data in transit (TLS) and at rest where appropriate;
• salted, hashed password storage using industry-standard algorithms;
• role-based access controls and least-privilege principles for employee access;
• isolated production environments, network segmentation, and bastion-hosted administrative access;
• routine security reviews, dependency monitoring, and patching;
• logging, monitoring, and alerting on suspicious activity;
• documented incident response, data breach notification, and backup/recovery procedures.

We give particular care to protecting the following categories of user information from unauthorized third-party access:

• names and usernames;
• email addresses;
• passwords and authentication credentials;
• precise or coarse location data;
• uploaded media (avatars, images, videos, and keys).

5.3 Limits of Security

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials.

5.4 Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service. After account deletion we delete or anonymize personal data within a reasonable time, except where longer retention is required to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements.

6. Tracking Tools

PlayIndies uses cookies, local storage, server-side logging, and similar technologies to operate, secure, analyze, and improve the Service. The tracking tools we currently use are:

• Essential cookies and tokens — required for authentication, session management, and security (including JWT-based session tokens and Amazon Cognito identity tokens). These cannot be disabled.
• Functional storage — to remember your preferences, account settings, and UI state.
• Google Analytics 4 (GA4) — to understand aggregate usage patterns, measure feature adoption, and improve performance. Google's privacy policy is available at https://policies.google.com/privacy.
• Google reCAPTCHA — to protect forms and authentication flows from bots and abuse. Use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.
• Sentry — for application error monitoring and performance tracing. Sentry receives technical diagnostic data (stack traces, request metadata, environment information) and may receive limited identifying information such as a user ID associated with an error event.
• Server logs — IP address, user agent, request path, and timestamp are recorded by our application servers and AWS CloudWatch for security, debugging, and abuse prevention.

PlayIndies does not currently use advertising pixels (e.g., Facebook/Meta Pixel), third-party advertising networks, cross-site behavioral advertising trackers, Adobe Analytics, Hotjar, Clicky, or mobile advertising identifiers (IDFA/GAID). If we adopt any such tools in the future, we will update this Policy and, where required, obtain your consent.

You can control cookies through your browser settings and, where required by law, through a cookie consent banner presented on first visit. Disabling non-essential cookies will not prevent you from using the Service but may affect analytics and personalization.

7. Third-Party Access

PlayIndies does not sell or rent your personal data to third parties for their own marketing purposes.

We share personal data only in the following circumstances:

• Service providers and processors acting on our behalf under contractual confidentiality and data protection obligations. The current categories and named providers are:
  • Cloud infrastructure and storage: Amazon Web Services (ECS, RDS/PostgreSQL, S3, Cognito, CloudWatch).
  • Identity and authentication: Amazon Cognito.
  • Email delivery: Amazon Simple Email Service (SES) and SendGrid for transactional and notification email.
  • Payment processing: Stripe and PayPal. Full payment card details are handled by the processor and are not stored on PlayIndies servers.
  • Analytics: Google Analytics 4.
  • Error and performance monitoring: Sentry.
  • Abuse and bot prevention: Google reCAPTCHA.
  • Community and notifications: Discord (bot, webhooks, and community server).
  • Productivity and data sync: Google Sheets (used for selected intake flows such as signup interest and contact submissions, in addition to our primary database).
  • Internal operations tooling: Linear and similar internal project-management tools (no end-user content is shared except where necessary to resolve a support ticket).
• Developers, Publishers, and Agencies when you, as a Creator, apply for a campaign, request a key, or otherwise initiate interaction with them. The information shared is limited to what is reasonably necessary for the Developer to evaluate and respond to your request (typically your public profile, channel statistics, and the content of your application).
• Creators when you, as a Developer, run a campaign — Creators see the campaign details and brand information you publish on the platform.
• Aggregated or de-identified data that does not identify you individually may be shared publicly or with partners for research, reporting, marketing, and industry analysis.
• Legal compliance and protection — when we believe in good faith that disclosure is necessary to comply with applicable law, a court order, or a lawful government request; to enforce our Terms of Service; to protect the rights, property, or safety of PlayIndies, our users, or others; or in connection with fraud prevention.
• Business transfers — if PlayIndies is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal data.

We do not authorize our service providers to use or disclose your personal data except as necessary to perform services on our behalf or comply with legal requirements.

8. Opt-Out, Account Deletion, and Your Choices

You have the following choices regarding your personal data:

8.1 Email and Marketing Communications

• Transactional emails (account confirmations, security alerts, key delivery, campaign updates) are fundamental to the Service and cannot be disabled while your account remains active.
• Marketing and newsletter emails can be opted out of at any time by clicking the "unsubscribe" link at the bottom of any such email or by updating your communication preferences in your account settings.

8.2 Cookies and Tracking

You may disable non-essential cookies through your browser settings or through any cookie preference center we provide on the Service. Mobile users may reset or disable advertising identifiers through their device settings.

8.3 Third-Party Connections

You may disconnect any linked third-party account (Twitch, YouTube, Instagram, Tiktok, etc.) at any time through your account settings. Disconnecting may limit features that depend on that integration.

8.4 Account Deletion

You may delete your account at any time from your account settings, or by emailing privacy@playindies.com with the subject line "Account Deletion Request." Upon verified deletion:

• your profile and personal data will be deleted or irreversibly anonymized within 30 days;
• backups containing your data will be purged in accordance with our backup rotation schedule;
• aggregated, anonymized data derived from your use of the Service may be retained;
• records we are legally required to retain (e.g., tax, fraud, or compliance records) will be kept for the period required by law and then deleted.

8.5 Statutory Rights (GDPR, UK GDPR, CCPA/CPRA, and Similar Laws)

Depending on your jurisdiction, you may have additional rights, including the right to access, correct, delete, restrict or object to processing, port your data, and withdraw consent. California residents have specific rights under the CCPA/CPRA, including the right to know what personal information we collect and the right to opt out of any "sale" or "sharing" of personal information as those terms are defined under the law (PlayIndies does not sell personal information as commonly understood).

To exercise any of these rights, contact privacy@playindies.com. We will respond within the timeframes required by applicable law (typically within 30 days).

9. Changes and Updates to This Policy

PlayIndies periodically reviews this Privacy Policy to ensure it continues to reflect our practices and applicable law. We may modify or update this Policy at any time. When we do:

• the "Last Updated" date and version number at the top of this Policy will be revised;
• the updated Policy will be posted at the same URL where it is currently published;
• for material changes, we will provide reasonable advance notice — for example, by email to the address associated with your account, an in-product notice, or a prominent banner on the Service;
• where required by applicable law or where the changes are material, your continued use of the Service following the effective date of the change constitutes acceptance of the revised Policy. In some cases we may ask you to re-consent before continuing to use the Service.

We retain copies of all previous versions of this Privacy Policy and a record of material changes. Prior versions are available on request by emailing privacy@playindies.com.

10. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data:

• Email: privacy@playindies.com
• Mailing Address: PlayIndies LLC, 16915 SE 272nd St, Ste 100 #8036, Covington, WA 98042, United States

We will do our best to respond to all legitimate inquiries within 30 days.