Privacy Policy

This policy explains what PeakIndie (indie game discovery and verified signals) collects, why we collect it, how we use it, and how you can access or delete it. It is public, does not require a login, and applies to everyone who uses the site — including studios who connect Instagram through Meta.

Controller: PeakIndie. Contact: [email protected]. Site: peakindie.com.

What we collect

Account. Email, username, password hash if you set a password, account intent (player or studio), and studio profile fields you submit. Google, Steam, and Discord sign-in store the identity those providers return, including a verified email when they give us one.

Content you publish. Game pages, Watch clips, studio profiles, and Featured home ads are public once published.

Usage. First-party analytics record views, likes, follows, and outbound clicks on PeakIndie so studios can see what happened here. We do not collect IP addresses, device fingerprints, or advertising identifiers for that analytics.

Cookies

Sign-in uses two first-party cookies: an HTTP-only session cookie (gs_session) and a readable CSRF cookie (gs_csrf). They are required for the site to work. We do not use advertising cookies or third-party tracking cookies.

Instagram and Meta

Instagram Login is not offered yet. We are waiting on Meta business verification before studios can connect an Instagram account. When that is enabled, we will use Instagram Login with these permissions only:

• instagram_business_basic — Instagram user id, username, account type, profile picture URL, follower count, and media count.
• instagram_business_manage_insights — account-level insight totals we display as views. We do not request posting, messaging, or ads permissions.

We store an encrypted access token so we can refresh those metrics. We use this data only to show the connected Instagram profile and follower/view counts on the studio dashboard and on public game pages the studio chooses to display. We do not post to Instagram, do not message followers, do not sell Instagram data, do not use it to build ads, and do not share it with other studios or advertisers. Personal Instagram profiles are not stored.

Tokens stay until you disconnect Instagram in the dashboard, until Meta invalidates them, or until we delete your PeakIndie account. After disconnect or deletion we drop the token and the Instagram profile fields we stored.

Other connected platforms

Steamworks publisher keys and itch.io OAuth tokens are encrypted at rest, never shown again, and used only to verify imported games and to request metrics those credentials allow. We do not ask for Steam or itch passwords.

YouTube, Twitch, TikTok, and Discord connections use OAuth tokens we encrypt and use only to list the channel or server you pick and to pull public-facing reach metrics (for example subscribers or followers). You can disconnect any of them in the dashboard.

How we use data

To run the service: sign you in, publish listings and clips you submit, show discovery feeds, run Featured ads you buy, and display verified or connected metrics you authorized. We send mail through our email provider: account mail (verification, password reset, studio invites, moderation, Featured ads) and messages about PeakIndie itself, such as beta access and product updates, to the address on your account.

We do not sell personal data. We do not share Instagram or other platform data with third parties except the infrastructure processors we need to host the site (hosting, email, database). Meta receives your authorization when you tap Sign in with Instagram; after that we call Instagram Graph APIs with the token you granted.

User data deletion

You can delete your PeakIndie account in Settings: type DELETE and confirm. That wipes the account, session cookies, encrypted tokens, follows, and any studio you own, including public listings, clips, and ads. You can also email [email protected] from the address on the account (or name the Instagram username you connected). We aim to complete emailed requests within 30 days. A dedicated copy of these instructions is at /data-deletion.

To stop Instagram access without deleting the whole account, open Dashboard → Integrations and disconnect Instagram. That revokes our stored token for that connection.

Access and correction: the same mailbox. We will confirm what we hold on the account and correct it where we can.

Retention

Account and connection data stays until you disconnect it, ask us to delete it, or we close the beta copy. Server logs are kept only as long as we need them to run and debug the service.

Children

PeakIndie is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe we have, email [email protected] and we will delete it.

Changes

If we change how we process Instagram or other platform data, we will update this page and the date above. The current version is always at https://peakindie.com/privacy.