Privacy Policy

Effective Date: September 9, 2026. Last updated: November 4, 2026.

IndieRocket is a service provided by Tiny Red Pixel Ltd (“we,” “our,” “us”). We respect your privacy. This Privacy Policy explains how we collect, use, and share information about you when you use our websites, mobile apps, and online services (“Services”), or when you interact with our smart links and landing pages.

We handle two distinct types of data:

• User Data: Information about you, our customer (the artist, label, or manager).
• Fan Data: Information about the fans who visit the smart links, pre-save pages or Fan Gates you create using our Services, including what they enter there.

1. Information We Collect

A. User Data (You, the Artist/Manager)

• Account Information: Name, email address, password, and payment information (processed by secure third-party processors like Stripe). When we charge tax, Stripe asks every customer for a billing address at checkout, to work out whether tax applies, and business customers can give a VAT number. We and Stripe use these to calculate the tax, and keep them as records for as long as tax law requires (up to 10 years for EU VAT).
• Connected Services: When you link Meta (Facebook and Instagram) or other accounts, we access the data you authorize (for example ad performance) to provide our analytics and automation features. For the Spotify artist you choose, we read public Spotify data; we do not sign in to your Spotify account.
• Website attribution: We use a first-party browser-tab identifier, campaign labels from tagged links, referring hostname and page interactions to understand how visitors find IndieRocket. When you join the waitlist or create an account, we may retain that attribution with your record to measure signup and product use. We do not include your email address or full referring URL in the attribution labels.
• Product use: While you are signed in, we record which areas of IndieRocket you open (for example Video Studio or the Media Library) and each five-minute period in which you use them, so we can support your account and improve the product. Authorised IndieRocket staff can see this activity for your account. We do not keep the page addresses. These records are deleted automatically about 400 days after they are made.
• Content: Audio files, artwork, and metadata you upload for campaigns.
• App usage: Which sections of IndieRocket you open, when we first and last recorded an opening of each one, and approximately how often (usually once per browser tab session; separate tabs and a retried request can each add one, so the count is an estimate), and your answer to "Where are you right now?". We use this to show your next steps and to improve how new artists get started.

B. Fan Data (Your Audience)

When fans interact with your IndieRocket Smart Links, pre-save pages or Fan Gates:

• Usage Data: IP address, device type, browser type, referrer URL, and location (country/city level).
• Interaction Data: Which services they clicked (Spotify, Apple Music, etc.).
• Voluntary Information: Email addresses fans give through sign-up forms, pre-save pages and Fan Gates, and their answers to Fan Gate questions.
• Optional advertising permission: If a fan separately opts in, we record that permission so a locally hashed version of their email can be used only to exclude existing subscribers from an artist's Meta email sign-up ads.

2. How We Use Data

• To provide, maintain, and improve our Services (e.g., generating marketing plans, running ad campaigns).
• To provide you with analytics about your fan base and campaign performance.
• To email fans who signed up on a pre-save page when the release comes out (and about future releases if they opted in).
• When a fan who gives their email through a Fan Gate or sign-up form also agrees to hear from the artist, to add them to that artist's subscriber list so the artist can email them, together with their Fan Gate answers.
• To send a fan the emails a Fan Gate needs: the reward the artist set to arrive by email, and a confirmation message when the gate asks the fan to confirm their address.
• To send you technical notices, updates, and support messages.

3. Third-Party Integrations & Data Sharing

Our Service relies on integrations with third-party platforms. By using IndieRocket, you acknowledge data flows to/from:

A. Music Platforms (Spotify, Apple Music, etc.)

We use these services' public APIs to read your artist's public data, such as releases, cover art and popularity. To read play counts and find the public playlists your songs appear on, we also use a web-data service, Apify, which collects public Spotify pages for us. Signing in to your Spotify account is currently switched off.

Data shared with these platforms is subject to their own privacy policies.

B. Advertising Platforms (Meta Ads, Google Ads)

If you use our Ad Automation features:

• We send campaign configuration data to your ad accounts.
• We may place tracking pixels (Meta Pixel) on your Smart Links, pre-save pages and Fan Gates to measure conversion events.
• When a fan has separately opted in, we may send Meta a locally normalized, SHA-256 hashed version of that fan's email solely to stop showing them an artist's email sign-up ads. We do not use this permission to target ads or create lookalike audiences.

C. Content Generation (Google Gemini and OpenAI)

To power our content-generation features — such as marketing-plan generation, ad copy and captions, and generated imagery — we send the relevant inputs (your prompts, track and campaign metadata, and uploaded artwork) to Google Cloud Vertex AI for processing by Gemini models. Content generated for you (such as marketing plans, captions, and imagery) is saved as part of your campaigns so you can review, edit, schedule, and publish it. Data shared with Google is subject to Google's Privacy Policy.

Captions for Monthly Campaigns, and the rewriting pass that makes them read naturally, are written by AI models reached through OpenRouter (currently OpenAI models); when OpenRouter isn't available, Gemini does this work as described above. For that we send the track and campaign details the captions need. Data shared through OpenRouter is subject to OpenRouter's privacy policy and that of the model provider, currently OpenAI's.

Some features use other hosting and AI providers that process only the inputs needed for that feature: for example, some campaign images are generated on our own image service hosted by Modal, and if you connect your Higgsfield account, the pictures and song excerpt you choose are sent to it to make your video.

D. Government & Law Enforcement Requests

We may receive requests from government, regulatory, or law enforcement authorities for the personal data of users or their fans. When we receive such a request, we apply the following processes:

• Legality review: We review the legality and validity of every request and only comply with requests that are lawful and properly issued.
• Challenging unlawful requests: Where we consider a request unlawful, overbroad, or improper, we will push back on or challenge it before responding.
• Data minimization: We disclose only the minimum information necessary to respond to a valid request.
• Documentation: We document each request we receive, our response, the legal basis relied upon, and the parties involved.

Where permitted by law, we will notify affected users of a request relating to their data.

4. Your Rights & Control

You have control over your data. You may:

• Access, correct, or delete your personal information through your account settings. See our User Data Deletion Instructions for the full self-serve flow.
• Disconnect connected accounts (such as Facebook) at any time via the "Integrations" page.
• Export your Fan Data (emails) where you are the data controller.

If you are a Fan wanting to remove your data from an Artist's list, please contact the Artist directly or use the "Unsubscribe" link in their communications. Unsubscribing also withdraws any optional Meta exclusion permission, and IndieRocket removes previously synced identifiers from that audience. You may also contact us to delete your data from IndieRocket's systems.

UK and EEA data protection rights

Tiny Red Pixel Ltd is the controller for IndieRocket's own website and waitlist information. Where the UK GDPR or EU GDPR applies, you can ask us to access, correct or erase your personal data, restrict or object to its processing, or provide a portable copy, subject to the conditions of those laws. Contact support@indierocket.app to exercise these rights.

We rely on your consent for the optional landing-page Analytics and Ad measurement described below. You can withdraw that consent at any time without affecting the lawfulness of earlier processing. You may complain to the UK Information Commissioner's Office or your local data protection authority in the EEA.

5. Cookies & Tracking Technologies

We use cookies to authenticate users and analyze service performance. On Smart Links, pre-save pages and Fan Gates, we may facilitate the placement of YOUR tracking pixels (e.g., Meta Pixel) so you can retarget fans. You are responsible for ensuring your use of pixels complies with applicable laws.

Landing-page privacy choices

On our landing and waitlist pages, optional Analytics and Ad measurement are separate choices and are off until you consent. You can accept optional tracking, decline it, or choose individual purposes. Your browser preference is stored for 180 days so we can remember and respect it; this preference storage does not enable tracking. Global Privacy Control and Do Not Track turn off both optional purposes. Necessary operations such as saving your requested waitlist entry, preventing abuse and counting successful signups continue independently.

If you allow Analytics, Google Analytics and our own visit statistics measure use of the landing pages and signup journey. These can use browser/session identifiers and browser, network and page information. Our Google Analytics configuration disables advertising personalization and Google signals. Declining or withdrawing Analytics stops this optional browser measurement and removes its first-party analytics cookies and session identifiers. See Google's Privacy Policy for information about Google's processing.

Optional ad measurement

Reddit

If you allow optional ad measurement in Cookie preferences, we load the Reddit Pixel after your new waitlist signup has been saved. It reports a signup with a random conversion identifier so Reddit can measure and optimize our ads. The pixel can receive your browser and network information, the current page URL and Reddit ad-click identifiers, and can use advertising cookies. We do not pass your email address or phone number to this integration, and automatic email and phone matching is disabled.

Ad measurement starts off. Declining it does not affect joining the waitlist. Your choice is saved in this browser, and you can change or withdraw it at any time using Cookie preferences in the landing-page footer or below. Withdrawal stops future signup measurement; it cannot undo data already shared. We also suppress this pixel when your browser sends Global Privacy Control or Do Not Track. We retain the permission version, timestamp and random conversion identifier with your waitlist record. For data already shared with Reddit, see Reddit's Privacy Policy; you can contact us about deleting your IndieRocket record.

Meta (Facebook)

With the same optional Ad measurement choice, we can load the Meta Pixel after a new waitlist entry has been saved. It reports a Lead event with a random conversion identifier to measure and optimize IndieRocket's ads. Meta can receive browser and network information, the public page URL and Meta ad-click identifiers, and can use advertising cookies. We do not send your email, phone number or their hashes; automatic matching and automatic event setup are disabled for this integration.

We do not report duplicate submissions or load this pixel when you decline, send Global Privacy Control or Do Not Track, or use a private account page. Withdrawal stops future measurement and removes our first-party advertising cookies. A previous Reddit-only choice requires a new choice before Meta measurement starts. We retain the permission version, timestamp and random receipt with your waitlist record. See Meta's Privacy Policy for its processing and controls.

6. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

support@indierocket.app