Privacy Policy

Ignitae is a launch platform for indie developers and makers. We collect the minimum data needed to run your account, publish your projects, and process payments. We host everything in the EU (Hetzner, Germany). You can edit, export, or delete your data from your settings at any time. Questions or rights requests: legal@ignitae.com.

Account and authentication

• Email address, name, avatar, and optional profile fields (bio, website, Twitter and GitHub handles).
• Hashed password (bcrypt) if you sign up with email and password.
• OAuth tokens and provider account ID if you sign in with GitHub or Google.
• Session identifier and email verification timestamp.

Content you publish

• Projects you submit: name, tagline, description, URL, logo, and screenshots.
• Feedback, comments, replies, upvotes, interest signals, bookmarks, follows, and collections you create.
• Newsletter subscription email if you opt in (double opt-in confirmed).

Technical data

• Essential session and CSRF cookies (Auth.js) and your cookie preference.
• Aggregated and anonymous analytics via Umami, self-hosted on our infrastructure. Umami uses no tracking cookies and stores no personal identifiers.
• Server logs for diagnostics, kept 30 days.

Payment data

If you subscribe to Pro, Team, or buy a project boost, payment is handled by Stripe. We never see or store card numbers. We keep your Stripe customer ID, subscription status, billing period dates, and purchase amounts.

• Run the platform. Create accounts, publish projects, deliver feedback, and serve the discovery feed (contractual necessity, GDPR Art. 6.1.b).
• Send transactional emails. Verification, password reset, feedback notifications (contractual necessity).
• Send the newsletter. Only if you opt in (consent, GDPR Art. 6.1.a). Every email has an unsubscribe link.
• Process payments. Subscriptions and boosts via Stripe (contractual necessity).
• Improve the platform. Anonymous, aggregated analytics with Umami (legitimate interest, GDPR Art. 6.1.f).
• Prevent abuse and enforce our terms. Rate limiting, moderation, audit logs (legitimate interest).

We do not sell your personal data. We share data only with the sub-processors below, each bound by a Data Processing Agreement under GDPR Art. 28.

• Account and content: kept while your account is active. Deleted immediately when you delete your account.
• Sessions: 30 days from last activity.
• Verification and reset tokens: until used or expired (typically 24 hours).
• Email send logs: 30 days.
• Application logs: 30 days.
• Account deletion log: kept up to 5 years as SHA-256 hashes only, never plain text. Used solely as evidence of compliance with the right to erasure.
• Anonymised user-generated content: after account deletion, references to you are removed but content that helps the community (such as reports filed against other users) may persist without your identifier.
• Stripe billing records: kept by Stripe per their own retention policy (typically 7 years for tax and accounting). We do not control this.
• Newsletter: until you unsubscribe or request deletion.

You can exercise the following rights at any time. Most are self-service from your account.

• Access and portability (Art. 15, 20): available in your settings. If a self-service export is not yet available for the data you need, email legal@ignitae.com.
• Rectification (Art. 16): edit your profile, email preferences, and handles in settings.
• Erasure (Art. 17): delete your account from settings. Deletion is immediate and irreversible. Linked content (projects, images on our CDN, feedback, follows) is removed by cascade.
• Restriction (Art. 18): email legal@ignitae.com. We respond within 30 days.
• Object to newsletters (Art. 21): click the unsubscribe link in any newsletter email.
• Lodge a complaint: with the Spanish Data Protection Agency (AEPD), aepd.es, or with the supervisory authority in your EU country of residence.

We use only essential cookies for login and CSRF protection, plus one optional cookie that remembers your dark or light mode preference. We do not use any tracking or advertising cookies.

Our analytics tool (Umami, self-hosted) is cookie-free and does not require consent because it processes no personal data. You can review and adjust your preferences via Cookie Settings.

We protect your data with TLS encryption in transit, bcrypt hashed passwords (cost 12), short-lived sessions, and CSRF tokens on every mutation. Application data and uploaded files live in Hetzner data centres in Germany. We follow least-privilege access for staff and review our infrastructure regularly. No system is perfectly secure, so if you discover an issue please report it to legal@ignitae.com.

Ignitae is not directed at children under 16. If you are under 16, please do not create an account. If we learn we have collected data from a child without parental consent, we will delete it.

We may update this policy as the platform evolves. We will notify registered users of significant changes by email and update the date at the top.

Privacy questions and rights requests: legal@ignitae.com.

Supervisory authority for users in Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid. aepd.es.