Privacy Policy

We The Indies, LLC is a Florida limited liability company in St. Augustine, Florida, and we are the controller of the personal data described here. We collect what we need to make your disc, get it to your door, and pay the developer. We do not sell your data, and we do not run advertising on it.

What do we collect?

• When you buy something: your name, shipping address, email, and what you ordered. Card details go straight to our storefront's payment provider. We never receive or store them.
• When a developer makes an account: email address and sign-in method (email, Google, or Discord), studio profile, the game builds and artwork you upload, your submission history, and a record of the contract you signed. That record includes a salted hash of the IP address you signed from. We do not store the raw address, though it does pass through our rate-limiting provider while a limit window is open, so that repeated attempts can be throttled. See “Who else handles it?” below.
• When a developer gets paid: the Stripe account identifier you connect. Stripe collects your identity and bank details directly for its own verification. We see the account id and the payout status, not your bank credentials.
• When anyone visits: server logs and error reports, plus page-speed timings that carry no identifiers and set no cookies. Product analytics only run when we have them switched on and you have accepted them in the cookie banner.

Why are we allowed to hold it?

Order and account data: because we need it to perform the contract with you. Security logs, fraud checks, and keeping the site standing: our legitimate interest in running a working shop. Tax and accounting records: a legal obligation. Product analytics: your consent, which you can withhold or withdraw. That is the whole list.

Who else handles it?

• Our storefront and its payment provider take the order and process the payment.
• Stripe runs developer payouts through Stripe Connect. Developers connect their own Stripe account and Stripe is the controller of the identity data it collects for that.
• Supabase hosts our database and authentication, so accounts and submissions live there.
• Cloudflare R2 stores uploaded files: game builds, artwork, and archived masters.
• Resend sends transactional email such as order confirmations and submission updates.
• Sentry collects error reports when we have it switched on. An error report carries technical context about the failure: the route, a stack trace, and the application state around it. Redaction of personal details is configured before we turn it on, not after.
• PostHog collects product analytics when enabled and consented.
• Upstash runs the rate limiting that keeps sign-ins, submissions, and public forms from being abused. It receives your IP address as part of the counter key while a limit window is open. We do not store it, and the counter expires on its own.
• Mux processes and hosts video when a developer attaches a trailer or gameplay clip to a submission, and only while video features are switched on.
• Shipping partners receive the delivery address and package details so we can buy postage and complete customs paperwork.

Each of these gets only what it needs to do its job. We do not sell personal data, and we do not share it for anyone else's marketing.

Where does it go?

We operate from the United States and a large share of our customers are in the EU and the UK, so your data crosses the Atlantic. Transfers rely on the standard contractual clauses our providers publish, and on the EU-US Data Privacy Framework where a provider is certified under it.

How long do we keep it?

Order records stay as long as tax and accounting law requires. Our administrative audit log is kept for at least seven years. A developer's uploaded build is kept while we work on the submission and while the title is on sale. Today nothing in the running system deletes it; an archival process that lets us delete it sooner is being built. Account data stays until you ask us to delete it.

What are your rights?

Wherever you live, you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask for it in a portable format, or object to a use of it. If you are in the EU or the UK you also have the right to complain to your national data protection authority. Email privacy@wetheindies.com and we will answer within 30 days. There is no charge and we will not make it difficult. If you have an account, the same requests are one form on your account page, which puts them on record the moment you send them.

Two honest limits: we cannot delete an order record we are legally required to keep, and we cannot delete a contract signature record while that agreement is in force.

What about children?

This is not a service for children. We do not knowingly collect data from anyone under 16. If you think a child has given us their details, email us and we will remove them.

What about cookies?

The cookie policy lists every cookie and browser-stored value by name and says what each one does. Analytics stay off until you accept the banner.

When does this page change?

We will update this page when what we collect changes. The date at the top is the version in force.