Privacy notice for Indie Mac Apps.

• No public account or profile is created when you browse.
• When secure intake is available, the free submission form asks for app name, official URL, category, a short description, contact email, and an optional official media link.
• You may create a private developer account by verifying your contact email, then manage submissions sent with that address. Product images are optional and remain private until separately approved for publication. Existing receipt codes remain available for earlier submissions.
• No newsletter signup, comment box, star rating, or written review input is active.
• No app installer is uploaded to or distributed by this site.

The hosting and security infrastructure may process ordinary technical request data such as IP address, requested URL, browser information, and timestamps to deliver and protect the site. Indie Mac Apps does not use that data to create public profiles or sell personal information.

Public listing badges link to an app's current directory page. Some badges display its support count. Loading a badge never casts a vote or subscribes anyone to email. Downloaded images cannot be remotely recalled after an app is removed.

If you choose to support an app, we keep that choice with your verified private account so it counts once. You may cancel it. We show only an aggregate count, not a public voter profile. Support is separate from editorial decisions and does not change natural listing order. A closed account cannot add support and is excluded from the public count.

Only after you allow optional analytics, we measure whether the first Selected apps card is at least half visible for one second and whether its Visit website link is clicked. This measurement covers that editorial position only; separately labeled sponsorship placements use their own campaign event counts.

Events contain a temporary random page ID, app slug, position and event type. They contain no account email, IP address, search text or referring website. The page ID deduplicates events for up to seven days; daily aggregate counts remain. Signed-in internal activity is separated. Counts are measured events, not unique people or guaranteed audience coverage. Necessary only stops this optional measurement.

Google Analytics is off until you choose Accept cookies in the Cookie settings control. Your choice is stored in this browser's local storage, not in a cookie. A Necessary only choice can also use session storage to keep this tab opted out after reload if permanent storage fails. If the browser cannot save your choice, analytics stays off. Open Cookie settings at any time and choose Necessary only to revoke permission.

After you allow analytics, the site sends manually controlled page views only for selected public pages. The event contains a canonical page path, a generic page title, and an empty referrer. Query strings, fragments, search text, page-specific titles, form values, account pages, and submission status pages are excluded. The Google tag is not loaded on private pages, and public-to-private navigation starts a new document before the private page opens.

Google may process ordinary network and browser information when the tag runs. GA4 can also create standard session events such asfirst_visit, session_start, anduser_engagement. Google Signals and ad personalization signals are disabled. Enhanced Measurement is off for this Google Analytics stream, so it does not add history-based page views, form, outbound-link, scroll, video, search, or download events. Keep that setting off while this integration is active. See Google's privacy policy.

Some app detail pages include an optional, editorially reviewed YouTube demo video. When present, the page loads the embedded player lazily as it approaches the visible area. Loading the player connects your browser to YouTube's privacy-enhancedyoutube-nocookie.com domain, where YouTube may process ordinary network and browser information. The video does not autoplay; press Play in the player to begin. You can also use the Watch on YouTube link to open it directly. See Google's privacy policy.

If you email hello@indiemacapps.com, the message and address are used to respond, investigate a correction, or keep a necessary editorial record. Do not send sensitive credentials, payment data, license keys, or confidential customer information.

We use Resend to send requested sign-in links, submission confirmations, and editorial notifications. Resend processes the recipient email address, message content and delivery information to provide this service. Your public browsing does not subscribe you to marketing emails. Editorial requests are sent after the owner confirms the outward-facing message; private AI reports and internal review notes are not included.

Sign-in tokens are stored as one-way verification values. Temporary outbound message payloads are encrypted in our database. Sign-in messages are removed from active storage after sending or expiry; other submission-related messages follow the submission retention period. Developer account information is removed after 180 days without verification when no active submission, verified project management access, or unresolved account request depends on it. These active-storage limits do not erase copies already delivered to a mailbox or held in a service provider's recovery history. Contact us to request removal of a private submission or account.

Resend's processing is described in its privacy policy. We continue using the support mailbox for developer replies.

Official-destination links take you to a third-party developer or authorized distribution site. That destination controls its own data collection and privacy practices. Review its notice before entering personal, account, or payment information.

Submission details and contact email are held privately in Cloudflare’s private database service for editorial review and necessary follow-up. Cloudflare Turnstile processes browser/security information to prevent abuse. Only the configured owner can access the complete editorial queue and private review notes. Verified developers can access their own submissions, their own product images, and messages explicitly addressed to them by the editors. No submission becomes a public listing automatically and ordinary submission is free.

Developer sign-in uses a short-lived, one-use email link and a necessary secure session cookie. The link expires after 15 minutes and a session lasts at most seven days. Verifying the original contact email can associate earlier, nonexpired submissions with your private account. Earlier receipt codes can still be entered on the status page to check progress; it is never added to the page address. Status checks do not show contact details or private review notes. We store a one-way verification value rather than a readable copy of your code. Do not include passwords, payment information, customer information, or confidential material in any field.

Submissions expire 180 days after you send them. Expired records stop appearing in status checks and are removed by a daily cleanup, normally within the next 24 hours. Review queue maintenance also removes expired records. Deletion removes your active submission, contact details and private review notes. We keep only a non-public submission reference and deletion time to prevent accidental recovery of deleted records. Anti-abuse counters use a one-way value instead of your IP address and expire after 24 hours.

Cloudflare recovery history may retain prior versions for up to 30 days (the account plan may provide a shorter window). Active deletion cannot immediately erase that history. If we restore a backup, submissions stay closed until later deletion requests and expired records have been removed again. Approved public facts, once separately published, belong to the editorial catalog and require a separate correction/removal request.

To recover a Priority Review or bundle request interrupted after submission, this tab can keep a request preference in session storage for a recovery window of up to 24 hours. It contains the submission reference, original request reference, selected plan, and a hash derived from the verified account email. It contains no readable email address, sign-in token, receipt credential, or payment-card details. Recovery does not authorize a payment; you still review an approved quote before choosing to pay.

Contact hello@indiemacapps.com for access, correction or deletion. Include your submission reference if available; do not email the receipt credential. See the submission page for current availability.

Where the free Tracker preview is enabled, your verified private account may save up to ten followed apps, one category, mute and pause choices, and requests to review a supported app source. These choices are private and grant no authority over an app's public listing. Closing the account removes its personal Tracker choices.

Tracker checks reviewed public sources once for all followers. Sources do not receive your account email or personal follow list. The timeline contains only actually recorded public events within the last ninety days. We retain recent source-check diagnostics for thirty days, source-review audit records for up to 180 days, mutation receipts for thirty days and source import requests for ninety days. The latest necessary source baseline may remain while the source is maintained; full third-party response bodies are not kept.

Weekly Tracker email is off until you explicitly enable it and the service is available. Existing developers are not automatically enrolled. With new eligible events, a digest is scheduled for Monday at 09:00 UTC. Resend processes the recipient address and plain-text message to send it. Payloads awaiting dispatch are encrypted and cleared after a terminal outcome or within seven days; most minimal delivery and provider-event receipts remain for up to ninety days. A minimal unresolved-delivery record remains until it is reconciled or the account is closed, so an uncertain message is not automatically sent again. A provider acceptance does not prove inbox delivery.

Turn Tracker email off in its settings or confirm the opt-out link in a digest. Merely opening the confirmation link does not unsubscribe you. Bounce, complaint and opt-out suppression records apply only to Tracker email. Tracker opt-out does not change developer publication notices, account access or payments. A pause retains your follows and stops updates and weekly email in your workspace.

Identity checks compare saved app details with public listings. Your explanation of a same-name match and the editor's identity decision remain private and follow the original submission retention period. A name match, duplicate report or verified product URL does not grant app management rights. Minimal reviewed public identity aliases may remain with the stable editorial project so an old product URL is not accidentally listed as a second app.

When enabled, the developer center stores optional display name, organization, time zone and reminder preferences privately. These settings do not alter sign-in security, service-day calendars or approved publication notices. Public app facts and submission associations do not establish verified management rights.

Account and app-claim requests, their status and processing records are private. Account requests and legacy claims follow the account cleanup lifecycle; project cases follow the case limits below when project management is enabled. Stable editorial project identities remain independently of the 180-day submission period. Closing an account immediately revokes sessions and management access and clears optional profile data; it does not remove published app facts or erase separately retained submissions. Full private-record removal requires a separate verified request.

An immutable original email association prevents a changed sign-in email from acquiring another person's earlier submissions. A minimal keyed, non-public closed-email marker is retained to prevent closed identities from being recreated by an old sign-in link after account cleanup. This marker is separate from ordinary submission retention and contains no readable email address. Claims and account changes require editor verification; requesting them does not complete them automatically.

Where project management is enabled, claims, revisions, withdrawal and removal requests have private case conversations. Only that case's participants and the owner can read its messages and evidence. Internal owner notes are separate. A new app manager does not inherit a former participant's private conversations or proof. Reading a page does not mark messages read; an explicit read confirmation updates only your own read position.

Case content expires no later than 180 days after case creation. Content linked to an older submission keeps that earlier expiry. Private proof and attachments expire at the earlier of case expiry or 30 days after the case ends; replying, restoring a draft or changing managers does not extend these limits. Expired content is unavailable before background deletion finishes. Minimal non-public case, authorization, removal and delivery records may remain for audit and to prevent unauthorized restoration; these records do not retain message bodies or proof images.

Proof uploads remain private and are never public listing assets. Dedicated product images require a separate owner review of their purpose, source and publication rights before an independent public copy is created. Removing a private copy does not remove an approved public listing. Public removal and restoration require their own reviewed actions; restoration does not restore old management grants.

Necessary editorial notices and optional conversation reminders are separate. Optional conversation email is opt-in; messages remain available on the website if email fails. A provider acceptance records a sending result, not delivery to your inbox. Copies already delivered to mailboxes cannot be recalled. Case-related temporary notification bodies follow the same or earlier content expiry as the case.

Payment notice updated 2026-10-22. When these services are available, the seller is TOTM TECH LTD. Stripe hosts Checkout and processes payment details under its own privacy notice. We do not store your card number or security code. We send the quoted amount, currency and private order/project references to Stripe to attribute and reconcile the payment.

For a sponsorship, we retain the private payer association, selected project, order terms, proposed and actual service times, payment and refund references, amounts, currency, receipt link, and operational records. Only the original payer and authorized owner can view the private order. A new app manager does not inherit another payer's billing history. Closing an account or expiry of a submission does not automatically erase financial records needed for a refund, accounting or a payment dispute.

Campaign statistics may record the date, placement, page type, device class, sample bucket, and measured impression and click events. These are event counts, not unique people, downloads, or sales. Signed-in internal activity is separated from public campaign statistics. Historical sponsorship performance data is not yet available.

The ordinary 180-day submission deletion limit does not apply to these separate financial records. Their applicable retention period must be configured before payments are enabled; this release does not automatically purge transaction history. Access or deletion requests for financial records are reviewed separately against outstanding obligations and applicable retention requirements. Supplement content remains in the original private submission and follows its existing content expiry.

Images are stored in private Cloudflare object storage. Upload only product images you are entitled to supply for the proposed listing, and remove personal information, account details and keys from their visible content. Images are resized and technical metadata is removed; this does not remove private information visible in an image.

Public product details and submitted images may be examined with AI tools for editorial pre-review. Contact email, receipt credentials and private editorial decisions are excluded from the research input. AI recommendations remain private to the owner and do not approve or publish an app. A human owner makes the final editorial decision.

Review reports and pending image files follow the original submission retention period of 180 days. Deletion queues the associated stored images for removal; temporary storage failures are retried by cleanup. Images selected for a separately approved public listing become part of that editorial publication and require a separate correction or removal request.