Privacy Policy

IndexCore ("we", "our", or "us") explains here how we collect, transmit, store, and process data through the IndexCore Android app, its backend sync engines, and the web app at indexcore.app.

By using IndexCore, you agree to the practices in this policy. If you'd rather not, you can use the app entirely in Offline Mode, where nothing described below applies.

1. Offline Mode vs. Account Mode

IndexCore gives you direct control over whether any of your data reaches our servers at all:

A. Offline Mode (local-only)

• Without registering or signing in, your library, progress, and achievement records stay entirely on your device, in a local database.
• Nothing is transmitted to our servers. Nothing here is backed up by us — losing the device or clearing app storage means that data is gone. That's on you to manage.

B. Account Mode (synced profile)

If you register and sign in, the app syncs your library, progress, and achievements to our servers, so it stays consistent across devices and can appear on leaderboards.

2. Data We Collect

A. Account credentials

• Authentication: email address, a securely hashed password, and a database-generated account ID.
• Preferences: interface settings and privacy toggles you set in Settings.

B. Connected platforms

Linking a platform grants us read-only access to populate your library and achievements automatically:

• PlayStation Network: public Online ID, trophy counts and titles, unlock timestamps.
• Steam: public SteamID64, library titles and playtimes, achievement completion.
• Xbox Live: Xbox User ID, library titles, unlocked achievements.
• AniList: username, watch/read list entries, episode/chapter progress, scores.
• Hardcover: read history, page progress, review text.
• Trakt.tv: movie/TV watch history and watchlist.
• TMDB & IGDB: used only to look up and display titles, artwork, and release info — no account linking involved.

3. Data Storage & Retention

We run our own servers rather than a third-party data platform. Passwords and platform access tokens are stored separately from public data like leaderboard entries. We keep your account data for as long as the account is active — deleting it (see Section 9) removes your profile, library, achievements, and linked platform credentials immediately.

4. Leaderboards

If you participate in leaderboards, your public username, avatar, rank, and score are visible to other users, along with your library counts and which platforms you've linked (not your credentials). We compute scores from your verified trophies, playtime, and tracked titles.

5. Comments

You can leave comments on any title's page. Comments are public and tied to your username. Deleting your account anonymizes any comments you've left rather than removing them outright, so conversations other users took part in stay readable.

6. Cookies and Local Storage

• Session tokens: used to keep you signed in on the web app. Not used for tracking.
• Local caching: poster art and metadata are cached locally so pages load faster.
• No ad tracking: we don't use third-party advertising cookies or analytics trackers (no Google Analytics, no Facebook Pixel).

7. Security

• All traffic between the app, web app, and our servers is encrypted (TLS).
• Admin/developer tools require separate authentication, not exposed to normal accounts.
• All database queries use parameterized statements to prevent injection.

8. Your Rights (GDPR & CCPA)

• Access: request a copy of the personal data we hold on you.
• Rectification: update your email, password, or linked platforms any time in Settings.
• Erasure: permanently delete your account, library, achievements, and linked credentials — see Section 9. This is irreversible. Comments you've posted are anonymized, not deleted, so other users' conversations stay intact; a moderation record is kept if action was ever taken against the account, so deletion can't be used to dodge a suspension.
• Restriction: we don't offer partial restriction of processing. The only way to stop appearing on leaderboards or having your data processed is full account deletion — see Section 9.

To exercise any of these, email [email protected].

9. Deleting Your Account

Deletion is permanent and immediate.

A. Cancel any subscription first

IndexCore doesn't process payments directly. Premium is billed by Google Play or, for Patreon supporters, granted as a thank-you reward tied to an active pledge. Deleting your account does not cancel a subscription — if you don't cancel it separately you'll keep being charged for an account that no longer exists. We can't cancel or refund either on your behalf. Cancel through Google Play subscriptions or Patreon memberships.

B. How to delete

• On the web: Settings → Danger Zone → Delete Account. You'll confirm with your password and by typing DELETE. Takes effect immediately, on every device.
• By email: if you can't sign in, email [email protected] from your registered address with subject "Account Deletion Request" and your username. Actioned within 30 days.

C. What's removed

Your profile, username, email, password, library, progress and achievement records, leaderboard entries, linked platform credentials, friends/blocks, and any uploaded avatar.

Data that only ever existed on your own device (Offline Mode) isn't affected — clear it yourself via app storage settings.

D. What's retained, and why

• Comments stay online with your name replaced by "[deleted]" — removing them outright would break conversations other users took part in.
• Moderation records are kept if action was taken against the account, so a suspension can't be cleared by deleting and re-registering.

10. Children's Privacy

IndexCore isn't directed at children under 13 (16 in some jurisdictions), and we don't knowingly collect data from them. If we learn a child has registered, we'll remove their data. Contact us if you believe this has happened.

11. Contact

Questions about this policy or a data request: [email protected].