Privacy Policy

• Account details: your email address, and a name if you add one.
• What you submit: the URLs in your batches, their status, and your API keys (stored only as a secure hash).
• Purchases: orders, amounts and payment references. Card and mobile-wallet details are handled by our payment partner and never reach us.
• Technical and security data: IP address and network, browser type, sign-in times, and a random browser identifier kept in a cookie.
• Messages you send us on email, Telegram or WhatsApp.

• to run your account: sign-in codes, submissions, credits, receipts and support;
• to keep IndexBear safe: rate limits, bot checks, and limits on free credits per network, browser and email domain so one person can't claim them many times;
• to meet legal and accounting obligations, and to handle disputes.

We email you only about your account and purchases. We don't send marketing without asking first.

We share data only with the providers that run parts of the service, each for that purpose alone:

• hosting and databases (Railway, Singapore region);
• network security, bot protection and delivery (Cloudflare, including the Turnstile check on sign-in);
• visit statistics and page-speed measurements (Cloudflare Web Analytics, which works without cookies);
• email delivery (Resend);
• online payments (EPS);
• our indexing partners, who receive the URLs you submit but not your account details.

We disclose data to authorities only when the law requires it.

• a session cookie that keeps you signed in (essential);
• a first-party browser identifier used to prevent free-credit abuse, kept for up to 400 days;
• your theme and currency choices, saved in your browser.

There are no advertising or analytics cookies: our visit statistics work without them.

• account data and submissions for as long as your account is open;
• routine security events for 90 days, and records of administrative actions and sign-ins for up to two years;
• orders and payment records for as long as accounting law requires.

You can ask for a copy of your data, a correction, or deletion of your account at any time using the contact details below. We'll confirm the request comes from the account's email address before acting on it, and we may keep records we're legally required to keep.

Traffic is encrypted end to end. Sign-in codes and API keys are stored only as hashes, and staff access to the control plane requires a code from the staff member's inbox for every sensitive change.

IndexBear is a business service and isn't intended for anyone under 16.

We'll update this page when our practices change. The date at the top shows the latest version.