Privacy Policy

When you sign up, we store:

• Your email address.
• Your name, if you give us one.
• Your password, never in plain text. We use Supabase Auth, which stores only a salted hash of it. We never see or store the actual password.
• Your plan and billing status. If you pay, Stripe holds your card details; we never see or store them.

You can drop a file on the homepage without signing up. We create a temporary guest account with no name and no email. To stop the free upload being abused, we keep a one-way scrambled version of your IP address. It can't be turned back into the address, and it's used only to limit how many guest links one connection can make.

A guest review stops accepting changes after 14 days and is deleted after 44, unless you add an email address to keep it. If you do, that address is stored the same way as any account's.

You never make an account to leave a comment. When you open a share link, we store:

• The name you type in, nothing more. We don't check it against anything, and we don't know who you "really" are.
• The text of the comments you leave.
• A random id we put in your browser's local storage, so that if you come back, you can still edit or delete your own comments. It doesn't identify you to anyone else, and it isn't linked to your name or any other site.
• An email address, but only if you choose to leave one. It's entirely optional, and it doesn't create an account. There's still no password and no sign-in. The only thing it's used for is telling you when someone replies to your comment. We never show it to anyone else, including the person who uploaded the file. Every email we send you for this has a link that removes your address from every comment you've left on that review, in one click, no sign-in required.

Review pages also run Google Analytics, the same as the rest of the site. See section 6. The Reddit ad pixel never runs on review pages. We never build a profile of you, and your comments are never used for anything but the review they belong to.

Videos, images, PDFs, documents, audio, and captured web pages are stored in private cloud storage that nobody can browse directly. When you or a reviewer needs to view a file, we generate a signed link that expires after a set time (currently 24 hours), not a permanent public URL. Review links are also marked so search engines don't index them.

We don't sell your data, and we don't share it with anyone to use for their own purposes. A small number of services process it only so that Pindicate works:

• Supabase: our database, sign-in system, and file storage.
• Vercel: hosts the application itself.
• Resend: sends our emails: account verification, password reset, comment digests, reply notices, and blog emails if you sign up for them.
• Stripe: takes payment for paid plans.
• Cloudflare: runs the quick bot check on the homepage upload, so the free guest upload isn't abused.
• Google Analytics: see section 6.
• Reddit: the Reddit ad pixel, to measure our own ads on Reddit. See section 6.

We use Google Analytics to understand how people find and use Pindicate, including which pages are visited, how often uploads start, and similar counts. It sets cookies in your browser and sends Google details such as the pages you view, your approximate location, and your device and browser type. We don't send Google your name, your email, your comments, or your files. You can block it with any content blocker, or with Google's own opt-out browser add-on.

We also use the Reddit pixel to see whether our ads on Reddit work, for example whether someone who saw an ad later visited the site, signed up, contacted us, or upgraded. It sets cookies and sends Reddit the pages you view on our website, those actions, and technical details such as your device and browser. We don't send Reddit your name, your email, your comments, or your files, and it never runs on review pages. Reddit handles that data under its own privacy policy.

We also count some activity ourselves, for example how many times the homepage is visited or a review link is opened, to see what's working. These counts are kept in our own database and aren't shared.

If you're in the EU, the EEA, the UK or Switzerland, Google Analytics and the Reddit pixel stay off until you choose to allow them, and nothing is sent to Google or Reddit before you do. We remember your choice for six months. Change your cookie choice.

Besides Google Analytics and the Reddit pixel, the only cookies we set are the ones that keep you signed in and the one that remembers your analytics choice.

No ads inside Pindicate. The only ad tracking is the Reddit pixel described in section 6, which measures our own ads. We don't sell your data, or a reviewer's, to anyone.

If you fill in the Custom plan form, we receive what you type: name, work email, company, job title, phone if you give it, and what you need, by email, so we can reply. We use it only to answer you.

If you sign up for blog emails on our homepage or blog, we store your email address, the page you signed up on, and when you signed up and confirmed. We first send you an email with a link to confirm, and we send nothing else until you click it. If you don't confirm within 30 days, we delete your address. After you confirm, we only email you when there's a new post, and every email has a link to unsubscribe. When you unsubscribe, we delete your address from the list. We never share the list or use it for anything else.

From Settings → Danger zone, you can permanently delete your account. This removes every file you uploaded from storage, every comment on them, your workspace, and your sign-in. It happens right away and can't be undone. Reviewer comments left on your assets are deleted along with them, since they only ever existed attached to your content. For anything else, email us and we'll remove it.

Questions about this policy, or a request about your data, can go to hello@pindicate.com.