Operated by K2MStudios

Privacy Policy

Last updated 10 September 2026

Indiewright is operated by K2MStudios ("we", "us"). This policy describes what we collect, why, who else sees it, and how to get it removed. It describes what the software actually does.

What we collect

Data	Why we have it
Email address and display name	To create your account, sign you in, and contact you about your account
Password	Stored only as a salted scrypt hash. We cannot read it, and neither can anyone who obtains our database.
Session tokens	To keep you signed in. Stored as SHA-256 hashes, not in usable form.
Payment and transaction records	To account for each purchase and pay creators accurately. Required for tax and accounting.
Purchases and entitlements	To know which editions you own and may open
What you were shown before buying	The price, fee and total you confirmed, kept as the record that answers a card dispute
Listening time per episode	To show creators how much of their work is heard, and to meter video
Works, episodes and audio you upload	To publish and stream them
Reports you submit about content	To review and act on them
IP address, briefly	Rate limiting, to stop abuse and automated attacks

What we do not collect

We never see your card number. Card details go directly to Stripe and never touch our servers. We store only a payment reference.
No advertising identifiers, no third-party ad or marketing trackers, no cross-site tracking pixels.
We do not build advertising profiles, and we do not sell or rent personal information to anyone, for any purpose.
No location tracking beyond the coarse IP handling described above.

Who else sees your data

Only the providers required to operate the service:

Provider	What they handle
Stripe	Payments, payouts, and identity verification for creators receiving money
Neon	Database hosting (United States)
Cloudflare R2	Storage and delivery of uploaded audio and images
Cloudflare	Application hosting, and delivery of the site itself (United States)
Our email provider	Account emails: verification, password resets, receipts, payout notices

We will also disclose information where we are legally required to, such as a valid court order. We disclose only what is actually demanded.

What creators and other listeners can see

Your display name and anything you publish or post publicly is visible to others. Your email address and purchase history are not — not to other readers or listeners, and not to creators, including creators whose work you buy. A creator sees that a sale happened and aggregate listening figures, never who you are.

How long we keep it

Account data — until you delete your account.
Financial records — retained after account deletion where tax and accounting law requires it. These are transaction records, not your profile.
IP addresses used for rate limiting — held in memory only, for at most one hour, then discarded.
IP addresses recorded with a consent or a purchase — these are different, and we would rather say so than let the line above imply otherwise. When you accept our policies at signup, and when you confirm a purchase, we store the IP address and browser user-agent alongside what you agreed to. That record is what lets us show, if a payment is ever disputed, that a real person saw the real terms and agreed to them. It is kept for as long as the financial record it belongs to.
Backups — database backups are retained on a rolling basis and age out. Where our hosting provider encrypts stored data at rest, backups are covered by that; we do not claim a separate layer of encryption on top of it.

Your rights

Wherever you live, you can ask us to:

Access a copy of the personal data we hold about you
Correct anything inaccurate
Delete your account and personal data, subject to the financial-record retention above
Export your data in a portable format
Object to a particular use of it

Two of these you can do yourself, without asking anyone and without waiting: Settings → Privacy → Download my data gives you a file containing your account, what you agreed to and when, what you bought, what you published and every movement of money on your behalf. Settings → Privacy → Close my account closes it immediately. If you never bought or published anything, the account is deleted outright. If you did, the personal details are erased and the financial records remain without naming you — because a record of money that can be rewritten later is not a record of anything, and tax law requires us to keep it.

For anything else, write to privacy@indiewright.com. We respond within 30 days and we do not charge for it. Residents of California, the EU, the UK and other regions with specific statutory rights may exercise them through the same address; we apply these rights to everyone rather than only where required.

Security

All traffic is served over HTTPS.
Passwords are hashed with scrypt and a per-user salt.
Session tokens are stored hashed, and are invalidated on password reset.
Paid audio is served through short-lived signed URLs issued only after an entitlement check, so knowing a URL is not the same as owning the work.
Card data is handled entirely by Stripe, a PCI Service Provider Level 1 certified provider. Indiewright never receives, transmits or stores card numbers.

No system is perfectly secure. If we discover a breach affecting your personal data, we will tell you what happened, what was exposed, and what we are doing — promptly and without minimising it.

Children

Indiewright is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact privacy@indiewright.com and we will delete it.

Cookies and local storage

We use browser storage for one purpose: keeping you signed in and remembering interface preferences such as your last-used tab. There are no advertising or analytics cookies, and no third-party trackers.

International transfers

Our providers are located in the United States. If you use Indiewright from outside the US, your data is processed there.

Changes

If we change this policy materially, we will email registered users rather than quietly updating the date at the top.