Privacy Policy

Effective Date: September 9, 2026

IndieRocket is a service provided by Tiny Red Pixel Ltd (“we,” “our,” “us”). We respect your privacy. This Privacy Policy explains how we collect, use, and share information about you when you use our websites, mobile apps, and online services (“Services”), or when you interact with our smart links and landing pages.

We handle two distinct types of data:

• User Data: Information about you, our customer (the artist, label, or manager).
• Fan Data: Information about the fans who visit the smart links or pre-save pages you create using our Services.

1. Information We Collect

A. User Data (You, the Artist/Manager)

• Account Information: Name, email address, password, and payment information (processed by secure third-party processors like Stripe).
• Connected Services: When you link your Spotify for Artists, Meta Ads Manager, or other accounts, we access authorized data (e.g., track statistics, ad performance) to provide our analytics and automation features.
• Website attribution: We use a first-party browser-tab identifier, campaign labels from tagged links, referring hostname and page interactions to understand how visitors find IndieRocket. When you join the waitlist or create an account, we may retain that attribution with your record to measure signup and product use. We do not include your email address or full referring URL in the attribution labels.
• Content: Audio files, artwork, and metadata you upload for campaigns.

B. Fan Data (Your Audience)

When fans interact with your IndieRocket Smart Links or Pre-save pages:

• Usage Data: IP address, device type, browser type, referrer URL, and location (country/city level).
• Interaction Data: Which services they clicked (Spotify, Apple Music, etc.).
• Voluntary Information: Email addresses or phone numbers collected via "Subscribe" forms or Pre-save authorizations.
• Optional advertising permission: If a fan separately opts in, we record that permission so a locally hashed version of their email can be used only to exclude existing subscribers from an artist's Meta email sign-up ads.

2. How We Use Data

• To provide, maintain, and improve our Services (e.g., generating marketing plans, running ad campaigns).
• To provide you with analytics about your fan base and campaign performance.
• To execute "Pre-saves" by connecting with fan's music accounts (e.g., adding your track to their library).
• To send you technical notices, updates, and support messages.

3. Third-Party Integrations & Data Sharing

Our Service relies on integrations with third-party platforms. By using IndieRocket, you acknowledge data flows to/from:

A. Music Platforms (Spotify, Apple Music, etc.)

We use APIs from these services to:

• Authenticate you and your fans.
• Retrieve stats (streams, saves).
• Perform actions on behalf of fans (e.g., following an artist, saving a track).

Data shared with these platforms is subject to their own privacy policies.

B. Advertising Platforms (Meta Ads, Google Ads)

If you use our Ad Automation features:

• We send campaign configuration data to your ad accounts.
• We may place tracking pixels (Meta Pixel) on your Smart Links to measure conversion events.
• When a fan has separately opted in, we may send Meta a locally normalized, SHA-256 hashed version of that fan's email solely to stop showing them an artist's email sign-up ads. We do not use this permission to target ads or create lookalike audiences.

C. Content Generation (Google Gemini)

To power our content-generation features — such as marketing-plan generation, ad copy and captions, and generated imagery — we send the relevant inputs (your prompts, track and campaign metadata, and uploaded artwork) to Google Cloud Vertex AI for processing by Gemini models. Content generated for you (such as marketing plans, captions, and imagery) is saved as part of your campaigns so you can review, edit, schedule, and publish it. Data shared with Google is subject to Google's Privacy Policy.

D. Government & Law Enforcement Requests

We may receive requests from government, regulatory, or law enforcement authorities for the personal data of users or their fans. When we receive such a request, we apply the following processes:

• Legality review: We review the legality and validity of every request and only comply with requests that are lawful and properly issued.
• Challenging unlawful requests: Where we consider a request unlawful, overbroad, or improper, we will push back on or challenge it before responding.
• Data minimization: We disclose only the minimum information necessary to respond to a valid request.
• Documentation: We document each request we receive, our response, the legal basis relied upon, and the parties involved.

Where permitted by law, we will notify affected users of a request relating to their data.

4. Your Rights & Control

You have control over your data. You may:

• Access, correct, or delete your personal information through your account settings. See our User Data Deletion Instructions for the full self-serve flow.
• Disconnect third-party integrations (Spotify, Facebook) at any time via the "Integrations" page.
• Export your Fan Data (emails) where you are the data controller.

If you are a Fan wanting to remove your data from an Artist's list, please contact the Artist directly or use the "Unsubscribe" link in their communications. Unsubscribing also withdraws any optional Meta exclusion permission, and IndieRocket removes previously synced identifiers from that audience. You may also contact us to delete your data from IndieRocket's systems.

UK and EEA data protection rights

Tiny Red Pixel Ltd is the controller for IndieRocket's own website and waitlist information. Where the UK GDPR or EU GDPR applies, you can ask us to access, correct or erase your personal data, restrict or object to its processing, or provide a portable copy, subject to the conditions of those laws. Contact support@indierocket.app to exercise these rights.

We rely on your consent for the optional landing-page Analytics and Ad measurement described below. You can withdraw that consent at any time without affecting the lawfulness of earlier processing. You may complain to the UK Information Commissioner's Office or your local data protection authority in the EEA.

5. Cookies & Tracking Technologies

We use cookies to authenticate users and analyze service performance. On Smart Links, we may facilitate the placement of YOUR tracking pixels (e.g., Meta Pixel) so you can retarget fans. You are responsible for ensuring your use of pixels complies with applicable laws.

Landing-page privacy choices

On our landing and waitlist pages, optional Analytics and Ad measurement are separate choices and are off until you consent. You can accept optional tracking, decline it, or choose individual purposes. Your browser preference is stored for 180 days so we can remember and respect it; this preference storage does not enable tracking. Global Privacy Control and Do Not Track turn off both optional purposes. Necessary operations such as saving your requested waitlist entry, preventing abuse and counting successful signups continue independently.

If you allow Analytics, Google Analytics and our own visit statistics measure use of the landing pages and signup journey. These can use browser/session identifiers and browser, network and page information. Our Google Analytics configuration disables advertising personalization and Google signals. Declining or withdrawing Analytics stops this optional browser measurement and removes its first-party analytics cookies and session identifiers. See Google's Privacy Policy for information about Google's processing.

Optional Reddit ad measurement

If you allow optional ad measurement in Cookie preferences, we load the Reddit Pixel after your new waitlist signup has been saved. It reports a signup with a random conversion identifier so Reddit can measure and optimize our ads. The pixel can receive your browser and network information, the current page URL and Reddit ad-click identifiers, and can use advertising cookies. We do not pass your email address or phone number to this integration, and automatic email and phone matching is disabled.

Ad measurement starts off. Declining it does not affect joining the waitlist. Your choice is saved in this browser, and you can change or withdraw it at any time using Cookie preferences in the landing-page footer or below. Withdrawal stops future signup measurement; it cannot undo data already shared. We also suppress this pixel when your browser sends Global Privacy Control or Do Not Track. We retain the permission version, timestamp and random conversion identifier with your waitlist record. For data already shared with Reddit, see Reddit's Privacy Policy; you can contact us about deleting your IndieRocket record.

6. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

support@indierocket.app