Privacy Policy

Who we are

Indieable (indieable.com) is operated by HotBoxed Studios LLC, an Arizona limited liability company, which is the controller of the personal information described here. Contact: contact@hotboxedstudios.com.

What we collect from developers (account holders)

• Your email address and sign-in credentials — a password (stored hashed by our authentication provider) or passwordless magic links.
• The content you create: games, playtest pages, builds, keys, survey questions, and the emails you send through Indieable.
• Billing information, handled by Stripe. We store your Stripe customer ID, subscription status, and plan — card numbers never touch our servers.
• Basic usage counters, like how many announcement emails you've sent this month.

What we collect from testers

Testers don't need an account. When you apply to a playtest, we collect what you enter on the form:

• Your email address (required), and optionally a name and Discord handle.
• Your platform and your answers to the developer's questions.
• Your consent choices — whether you agreed to receive emails about the game, and when you accepted a playtest's rules (if it has any).
• Your later activity in that playtest: check-ins, feedback, bug reports, and whether and when you downloaded a build hosted on Indieable.
• A participation summary shown to developers you apply to — for example, that you've completed playtests on Indieable before.

Your browser may also remember your application details locally (in localStorage) so repeat applications are faster. That copy lives on your device, not our servers, and clearing it is up to you.

What we collect from everyone

• Aggregate page statistics: we count page views and store-link clicks per game. These events record the game and the event type — we don't store your IP address or an identifier with them.
• Vercel Analytics: cookieless, aggregated visit stats for the site.
• Standard server logs (IP address, user agent), kept short-term by our hosting providers for security and operations.

What we don't do

• We don't sell or rent personal information.
• We don't run advertising trackers or cross-site tracking cookies.
• We don't use your personal information to train AI models.
• We don't show testers' email addresses to developers. When you apply to a public or closed playtest, the developer sees your application — but not your address; their emails to you are relayed through Indieable, and each one includes an unsubscribe link. The exception is private playtests, where the developer invited you and therefore already had your address.

How we use information

To run the service you asked for (playtest pages, applications, key and build delivery, feedback tools); to send the emails you signed up for; to bill subscriptions; to keep the platform safe (rate limits, abuse and spam prevention); and to meet legal obligations. For readers in the EU/UK: the legal bases are performance of a contract, consent (marketing-style emails to testers), legitimate interests (security), and legal obligation (billing records).

Service providers

These companies process data on our instructions to run Indieable:

• Supabase — database and authentication
• Vercel — hosting and aggregate analytics
• Cloudflare — build file storage (R2)
• Stripe — payments
• Resend — email delivery

Processing happens primarily in the United States. Where EU/UK data is transferred, these providers rely on recognized safeguards such as standard contractual clauses or Data Privacy Framework participation.

Cookies

Essential cookies only: authentication session cookies for developer accounts. Tester flows use signed, expiring links instead of cookies, and our analytics are cookieless.

How long we keep things

• Developer accounts and games: until you delete them.
• Tester applications and feedback: while the game and playtest exist, so developers keep their playtest history. Deleted when the game is deleted, or on your request.
• Hosted build files: permanently deleted automatically after their expiry date plus a short recovery window (currently 7 days).
• Unsubscribes: unsubscribed addresses stay on a suppression list so we never email them again.
• Billing records: as long as tax and accounting law requires.

Your choices and rights

• Every email we send on a developer's behalf has a one-click unsubscribe.
• Testers can see their applications anytime via the tester portal (a magic link sent to your email).
• For access, correction, or deletion of your information, email contact@hotboxedstudios.com from the address in question — we respond within 30 days.
• EU/UK residents additionally have rights to restriction, portability, and objection, and may complain to their supervisory authority.
• California residents: we don't sell or "share" personal information as the CCPA defines those terms; the access and deletion routes above are available to you.

Children

Indieable isn't directed to children under 13 and we don't knowingly collect their information. If you believe a child has given us personal information, email us and we'll delete it.

Security

HTTPS everywhere, row-level database access controls, tester email masking, scoped signed links that expire, and least-privilege service credentials. No internet service can promise perfect security; if a breach affects you, we'll notify you as the law requires.

Changes to this policy

When this policy changes materially, we'll email account holders and post prominent notice. The date at the top always reflects the current version, and prior versions are available on request.

Contact

HotBoxed Studios LLC · contact@hotboxedstudios.com