Privacy Policy

This page explains what information Pindicate collects, why, and how you can get rid of it.

Draft, not reviewed by a lawyer. This describes what Pindicate actually collects and does today, written in plain English. It must get a real legal review before Pindicate is open to the public.

1. If you have an account (the uploader)

When you sign up, we store:

Your email address.
Your name, if you give us one.
Your password — never in plain text. We use Supabase Auth, which stores only a salted hash of it. We never see or store the actual password.

2. If you're a reviewer (someone opening a share link)

You never make an account to leave a comment. When you open a share link, we store:

The name you type in — nothing more. We don't check it against anything, and we don't know who you "really" are.
The text of the comments you leave.
A random id we put in your browser's local storage, so that if you come back, you can still edit or delete your own comments. It doesn't identify you to anyone else, and it isn't linked to your name or any other site.
An email address, but only if you choose to leave one. It's entirely optional, and it doesn't create an account — there's still no password and no sign-in. The only thing it's used for is telling you when someone replies to your comment. We never show it to anyone else, including the person who uploaded the file. Every email we send you for this has a link that removes your address from every comment you've left on that review, in one click, no sign-in required.

That's it. No account, no tracking, no profile — just what you typed, and an email address only if you gave us one.

3. Your files

Videos, images, PDFs, and captured web pages are stored in private cloud storage that nobody can browse directly. When you or a reviewer needs to view a file, we generate a signed link that expires after a set time (currently 24 hours) — not a permanent public URL.

4. Who else handles your data (sub-processors)

We use a small number of outside services to run Pindicate. We don't sell your data to any of them — they process it only to provide the service:

Supabase — our database, sign-in system, and file storage.
Vercel — hosts the application itself.
Resend — sends account emails (verification, password reset) and comment digest emails.

5. What we don't do

No advertising. We don't sell your data, or a reviewer's, to anyone. No third-party analytics or tracking scripts run on Pindicate.

6. Deleting your data

From Settings → Danger zone, you can permanently delete your account. This removes every file you uploaded from storage, every comment on them, your workspace, and your sign-in. It happens right away and can't be undone. Reviewer comments left on your assets are deleted along with them, since they only ever existed attached to your content.

7. Contact

Questions about this policy, or a request about your data, can go to hello@pindicate.com.