Privacy Policy

The public site stores these rows in Postgres:

• Account: the sign-in email, an optional digest email for weekly reports, and a scrypt hash if you set a password. The plaintext password is not stored. The digest email can be a different address. Clearing it removes that address. While you are signed in, /account replaces that hash after the current password matches.
• Early-access request: email, product name, product domain or URL, an optional note, status, and timestamps.
• Invite: a hash of the token, the email it was issued for when one is set, who created it, expiry (7 days), and whether it was used. The raw link is shown once and is not stored.
• Checkout and subscription, only after this server has opened checkout and applied a signed webhook for that Paddle environment: email, plan, Paddle price id, Paddle customer and subscription ids, status, period end, and a hash of the checkout claim. A signed live webhook received while checkout is closed is recorded as seen and does not create or change a subscription. The raw claim is in the return link and is not stored. The card number is not stored.
• Brand: name, domain, category, audience, and use case.
• Competitors: name and domain, up to five.
• Prompts: the text the probe sends, including starter templates and lines you add.
• Probe rows: provider, model, temperature, repeat count, status, and any error. Each answer stores the prompt, the raw answer text, mention and recommendation flags, matched terms, recommendation cues, and the same flags for competitors. Each run stores mention rate, recommendation rate, and the share sort. A run can also store whether a digest email was attempted.

On a machine that can write files, a markdown digest may be saved under exports/. Email does not depend on that file. When email is sent, the digest text is the copy already in memory. The public site is https://indieaeo.app.

We store it to sign you in, to review access requests, to record a Paddle subscription when this server has opened checkout and applied a webhook for that environment, and to run and show the probes. We do not sell this data. We do not build an advertising profile. Checkout stays closed until this server opens it. Saving Paddle settings does not by itself open checkout.

These processors see data only as described. A provider that is not configured is not called.

• Azure Container Apps hosts the public site at https://indieaeo.app. Vercel production is paused and does not host that site. This app does not expose an HTTP route that runs the weekly probe.
• Azure hosts the Postgres database for the public site. The app uses the standard Postgres driver.
• OpenAI, or Microsoft Foundry / Azure OpenAI, when a probe is configured with a key. The prompt is sent as a Chat Completions request, and the answer is stored here. That call is a new completion, not a copy of a ChatGPT consumer transcript. With no key, the mock provider answers inside this app and does not call them.
• Perplexity, only when that experimental provider is configured with a key. The prompt is sent and the answer is stored.
• Resend, when the API key and from-address are set. A weekly digest goes to the digest email on the account. When that address is empty, it goes to the operator addresses in DIGEST_TO. When neither is set, the digest is not emailed. Early-access notices go only to DIGEST_TO, and only when that list is set. A notice includes the email, product name, URL, and note from the request. A digest includes the scores and can quote answer text.
• Paddle, when this server has opened checkout. Paddle is the merchant of record for a payment made in Paddle Checkout. The checkout page then loads Paddle.js for that payment form. After live checkout is opened, a signed-in app page or the billing page also loads Paddle.js for Paddle Retain, and only with the Paddle customer id stored on a live subscription for that account. An email address or an internal user id is not sent as that id. Sandbox mode does not load Retain. Paddle.js is not an analytics tag. The card is entered in Paddle Checkout. A signed webhook can include the subscription id, customer id, price id, status, and the email stored on the checkout. Paddle sends its own receipts.

Those services handle what they receive under their own terms. We do not send your password to them. This app does not scrape Google, and probes do not call Google.

Sign-in sets one cookie, aeo_session. The value is an HMAC-SHA256 token. The cookie is httpOnly and SameSite=Lax, lasts 14 days, and carries the email and an expiry. On HTTPS it is marked Secure. Changing the password does not clear it. Signing out clears it in that browser. The local development bypass does not set this cookie.

After you are signed in, the app may set sidebar_state so the sidebar stays open or closed. That cookie lasts 7 days. It is a display preference.

This app does not set an advertising cookie and does not load its own analytics script. Paddle.js, in the cases named above, is Paddle's checkout or Retain script. This page does not list cookies that script may set.

Rows stay in Postgres until we delete them or the database is emptied. The session cookie expires after 14 days. An unused invite expires after 7 days. Mail already handed to Resend, and logs kept by Azure, Resend, Paddle, or a model provider, stay with those services. We do not control those copies.

After you sign in, the dashboard shows your brands, prompts, stored answers, and scores. Edit a brand or a prompt in the app to correct it. Change a stored password at /account.

For a copy of what we store, or to delete it, email miuhui@outlook.com from the address on the account or the access request. Say whether you want a copy or deletion. We will delete the account, brands, prompts, stored answers, scores, the early-access request, and the subscription rows tied to that email from this app's database. We cannot pull back mail already sent through Resend, charges already processed by Paddle, or logs held by the hosts above.

There is no automated privacy portal. That email is the request path.

Indie AEO Lite is for people who operate their own sites. It is not meant for children.

We may update this policy. The date at the top is the date of this draft. The matching terms are at /terms.

huimiu. miuhui@outlook.com.