Privacy Policy

1. Who we are

Index (“the Service”) is operated by Esguerra Enterprises L.L.C., doing business as Hidden Link Studios (“Hidden Link Studios,” “we,” “us,” “our”), a limited liability company organized in Nevada, United States.

• Contact for privacy questions and requests: support@in-dex.co

This policy explains what personal data we collect, how and why we use it, who we share it with, and the rights you have over it. It covers both the web app (in-dex.co) and the iOS app. Where a practice applies to only one of them, we say so.

2. The information we collect

2.1 Account information

When you create an account we collect your email address. If you sign in with Google or Apple, we also receive the name and avatar that those providers share with us, where you have provided them. Sign in with Apple may give us a private relay email address instead of your real email address, depending on your Apple settings.

2.2 Your content

“Your content” is the material you save and create in the Service, including saved URLs and links, images and files you upload, thumbnails and screenshots we generate from your saves, and the notes, tags, folders, boards, and projects you use to organize it.

2.3 Web pages we fetch on your behalf

When you save a URL, our server fetches that web page to extract its title, source domain, and a thumbnail so we can show you a preview. This means third-party web page content is retrieved and processed by us on your behalf, solely to produce the preview and metadata for your save.

2.4 Usage and analytics data

We collect usage and analytics data about how the Service is used — for example, the pages and features you interact with, the links you click, your device and browser type, and approximate location derived from your IP address. We use a third-party analytics provider to help us understand usage and improve the product. This applies across the Service, in both the web app and the iOS app. We do not use this data to sell you anything or to build advertising profiles.

3. How and why we use your information

We use your information to:

• Create and operate your account and authenticate you when you sign in;
• Provide the core functionality of the Service — storing, organizing, displaying, and (where you choose) sharing your content;
• Generate previews, thumbnails, and metadata for links you save;
• Understand how the Service is used and improve its quality, usability, and reliability;
• Process payments for Pro subscriptions on the web app;
• Send you essential service communications, such as sign-in links and account notices; and
• Protect the Service, prevent fraud and abuse, and comply with our legal obligations.

Where the GDPR or UK GDPR applies, our legal bases are: performance of our contract with you (to provide the Service and process payments); our legitimate interests (to understand usage, improve and secure the Service, and prevent fraud); and compliance with legal obligations. Where we rely on consent, you can withdraw it at any time.

4. Public sharing

Index lets you make individual saves or whole boards public and share them through a public link. When you do this, the content becomes accessible to anyone who has the link, without an account, and may be viewed or indexed by people outside our control.

Please do not put sensitive, confidential, or personal information in content you mark as public. Your content is private by default — nothing is made public without a deliberate action by you — and you can switch public content back to private at any time, which removes public access going forward.

5. We do not use AI to generate content

Index does not use artificial intelligence to write, generate, or create content on your behalf. Any related-content or “connection” features simply surface relationships between items you have already saved; they do not produce new content.

6. Who we share information with

We do not sell your personal information. We share it only as needed to run the Service, with the following recipients:

• Payment processor (web only). Pro subscriptions are billed on the web app through Stripe, which collects and processes your payment details directly. We do not store full payment card numbers. The iOS app has no in-app purchases.
• Sign-in providers. If you choose to sign in with Google or Apple, those providers authenticate you and share basic profile information (such as name and email) with us.
• Hosting and database provider. Your account data and content are stored with our hosting and database provider on servers located in the United States.
• Analytics provider. A third-party analytics provider receives usage data to help us understand and improve the Service.
• Other service providers. We use trusted providers to help us operate the Service, such as hosting, transactional email delivery, and link preview and screenshot generation. They may process your information only to provide their service to us.

We may also disclose information where required by law, to enforce our Terms, or to protect the rights, safety, and property of our users or others. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

We maintain a current list of the service providers we use. You can request it at support@in-dex.co.

7. International data transfers

Our infrastructure and several of our service providers are based in the United States. If you use the Service from outside the United States (including the EU or UK), your personal data will be transferred to and processed in the United States, which may have different data protection laws than your own country.

Where we transfer the personal data of individuals in the EU or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable). You can contact us at support@in-dex.co for more information.

8. Data retention

We keep your account data and content for as long as your account is active, and only as long as needed for the purposes in this policy unless a longer period is required by law (for example, payment records for tax purposes).

When you delete content, it is removed from your account. When you delete your account, your personal data and content are removed from our active systems promptly, except where we must keep certain records to meet legal obligations. Residual copies in encrypted backups are deleted in the ordinary course of our backup rotation.

9. How to access or delete your data

You can manage much of your data directly in the Service:

• Edit or delete individual saves, boards, folders, and projects at any time;
• Switch public content back to private at any time; and
• Delete your account, along with all of its content, from Settings → Account on both the web and iOS apps, or by emailing support@in-dex.co.

To request a copy of your data, a correction, or full deletion, email support@in-dex.co. We will respond within the timeframes required by applicable law.

10. Security

We take reasonable technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS);
• Database access controls, including row-level security so users can only access their own data; and
• Restricted administrative access to systems holding personal data.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your privacy rights

11.1 EU / UK (GDPR and UK GDPR)

If you are in the EU or UK, you have the right to access your personal data; correct inaccurate data; request deletion; restrict or object to certain processing; data portability; and withdraw consent where processing is based on consent. You also have the right to complain to your local data protection authority. To exercise any right, contact support@in-dex.co.

11.2 California (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect and how it is used and shared; access and obtain a copy of it; request correction; request deletion; and opt out of any “sale” or “sharing” of personal information. We do not sell your personal information. We will not discriminate against you for exercising these rights. To exercise them, email support@in-dex.co. We may need to verify your identity first.

12. Children

The Service is not directed to, and not intended for, children under 13 (or the minimum age of digital consent in your country, where that is higher), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact support@in-dex.co and we will delete it.

13. Third-party integrations you connect

Index lets you connect third-party services you already use so you can import your own saved content into your Index library. These connections are always optional and user-initiated: we only connect a service when you choose to, we only access your own content on that service, and you can disconnect at any time.

13.1 Pinterest

When you connect your Pinterest account, we read your own boards and Pins (the “boards:read” and “pins:read” permissions) solely to let you import your own saved content into Index. Access is read-only — we never post to your account, modify it, or access other users’ data. When you import an item, we store its image and basic metadata (such as its title and source link) in your private Index library. We do not sell, redistribute, or share your Pinterest content with third parties. You can disconnect Pinterest from Index at any time, which revokes our access, and you can also revoke access from your Pinterest account settings.

Our use of Pinterest data is subject to the Pinterest Terms of Service and Pinterest Privacy Policy.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above and, for material changes, provide additional notice (for example by email or an in-app notice). Your continued use of the Service after changes take effect means you accept the updated policy.

15. Contact us

For any questions about this Privacy Policy or your data, contact us at support@in-dex.co.