Privacy Policy

IndieFiction is a book discovery platform for independent authors, operated by Abhishek Aggarwal, a sole trader based in Victoria, Australia. We handle your information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth), and, for people in the UK or EU, as the data controller under the UK and EU GDPR.

For anything about your data (questions, requests, or complaints), write to hello@indiefiction.com or use our contact form. We aim to respond within 7 days, and always within 30.

We only collect what the site needs to work. Specifically:

• Account details: your name and email address. Your password is handled by our authentication provider and stored as a cryptographic hash; we never see it. If you choose Continue with Google instead, Google confirms your identity and passes us your name and email address, and nothing else. There is no password on that account at all. We do not receive your Google password, your contacts, or anything else in your Google account, and we do not post anything to it.
• Author profile: anything you choose to add (a biography, a photograph, and links to your website or social accounts). All of this is optional, and all of it is public once you publish it.
• Book submissions: title, description, genre, cover image, the retailer link you provide, and optionally the formats your book comes in, their ISBNs, whether it is in Kindle Unlimited, and the name of a co-author with, if you like, links to their website or social profiles. All of it is public on your book's page. We don't ask for a co-author's email or any other contact details. If you name a co-author, please make sure they agree to be named; they can ask us to remove their name and links at any time. A business account also names the author of each book it lists and can add a short biography of them and links to their website or social profiles, on the same terms: public on the book's page, no contact details, and removable at the author's request.
• Upcoming books: the title, description, genre, cover and sample chapters you add, and optionally a co-author's name and links (on the same terms as above) and a link to a book trailer you host on YouTube or Vimeo. We store which video it is, never the video itself. All of it is public on the book's page.
• ARC requests: when you ask for review readers for a listed book, the book, your sign-up link, your note to readers, the formats you offer, where reviews help, an optional “reviews by” date, and your answer about AI. While the request is live, all of it except the link itself is shown on the ARC page, and Join leads to the link. We keep the request and its outcome on your account, with how many times Join was clicked: a number, not who clicked. If you buy a request, we record the amount, the date and Stripe's reference for the payment; your card details go to Stripe, never to us.
• Business accounts: the organisation's name, its logo and website if you add them (all public, on your publisher page), and optionally a contact person, a name and an email address. The contact person is never public, is used only so a person at your organisation can be reached about the account, and is never sent marketing: everything we send goes to the account's login email.
• Reader accounts: the books you save to your shelf and mark as finished, and the authors and readers you follow. Your shelf is private: shown only to you unless you choose to show part of it on your page (below), and no book page shows who saved it. Following is private with one exception: a reader you follow can see your name on the followers list of their own account page, and nobody else can. Authors are never told who follows them. A reader's public page shows how many people follow it, never who. Following someone means we show you an account notification when they list a new book or story, or publish a review or note. When an author you follow lists a new book or publishes a short story, we also send one email to your account address about it; switch that off in your account settings or with the Unsubscribe link in any of those emails. It is separate from the newsletter, and the author never learns who it went to. Your reader profile (your name, photo, the line about what you read and any social links) is public at your page, indiefiction.com/@handle, from the moment you choose a handle; until then it is private. Every review or note you publish appears there too, and in the site-wide feed at indiefiction.com/reviews. Until you publish one, the page asks search engines not to list it. If you add them, your page also shows the link buttons you write (once you have published a review or a note), the one book you choose as currently reading, the post you pin, a banner photo, the colour theme you pick, up to six favourite books, and your Finished or Want to read shelf if you switch it on (both are off until you do). Nothing else from your shelf is shown. A banner photo is stored like your profile photo and deleted with your account. Your page's QR code is drawn on our own server; nothing about you is sent to a QR service. Drafts stay private. A post the spam filter holds is shown only to you and to us until we release it.
• Messages between readers and authors: what you write, when, and to whom. A conversation is visible to the two people in it and to nobody else, with two exceptions: a message held for review (by our spam filter, or because it comes from an account less than a week old), and a message one of you reports to us, are read by us so we can decide what to do with them. Either person can switch their inbox off or block the other, and we keep the block so it holds. We never use your messages for marketing or show them to anyone else.
• Short stories: the text of any story you write or paste in, its title, genre, and whether you marked it as containing adult content. A published story is public, under your name, and readable by anyone. Drafts are private: only you and, where they need to act on a report, we can see them. We keep them until you delete them or delete your account, because a half-finished story you come back to next month is the point of having drafts. We also record when you published and when you last edited, so we can tell what has changed since we reviewed it.
• Account notifications: short messages shown on your account page about your own books, stories and subscription, plus occasional site news from us. A typical one says that a book you submitted was approved, with its title and the note we wrote at the time. Only you (and we) can see them, and we record when you last opened the panel so we can show you what is new. If five or more build up unread, we send one email saying how many, not what they are, and not another until you have looked. Because it is about your own account rather than marketing, it goes out whether or not you subscribed to our emails. We also email you whenever your password is changed, every time, so you find out even if it wasn't you who changed it.
• Messages to us: anything you send us through the contact form.
• Ask posts: questions and answers you post in the community are public, including your name and photo if you were signed in. An anonymous question carries only the same random browser id used for likes, so the post itself holds nothing that points back to you. Separately, so that one person cannot flood the page, we store a one-way hash of your IP address with a timestamp: not the address, not attached to your post, and deleted after two days. Neither record lets us name an anonymous asker. Want something you posted taken down? Email us and we will remove it.
• Story comments: comments you leave on a short story are public, under whatever name you type: no account is involved and we store nothing else with the comment. The same two-day hashed-IP throttle record described for Ask posts applies here, and it is never attached to your comment. Want a comment taken down? Email us and we will remove it. The story's author can reply under a comment; the reply is public, shown under their author name and marked Author, and is tied to their account only through the story itself.
• Newsletter address: if you subscribe without creating an account, from the footer, the readers or ARC pages, the Shout-Out archive, or the signup box on a book, short story or reading list page, we store just your email address, when you subscribed, which of those places you used, and the exact wording you agreed to. Nothing else, and no account is created.
• Blind Date books by email: at the end of the Blind Date game you can ask us to email you the books you were matched with. We use your address only to send that one email. If you also tick the box to join the reader newsletter, we store your address and the wording you agreed to, the same as any other newsletter signup; if you do not, we do not add your address to any list, though our email provider keeps its own delivery log of the message it sent.
• Quiz certificates by email: if you pass Level 2 or 3 of the book quiz you can ask us to email you a certificate, with whatever name you type on it. We use the address and the name only to draw and send that one email; neither is stored. If you also tick the box to join the reader newsletter, we store your address and the wording you agreed to, the same as any other newsletter signup. The quiz separately counts, for every question, how often it is answered correctly, runs out of time or uses a hint: those counts are how we edit the questions, and they contain nothing about you, no address, account or IP.
• ARC reader list: a separate list of people who would like to hear from authors looking for ARC readers, for books before or after they are published. Authors and readers with an account join it from their account page; anyone can also join by ticking the box under a newsletter signup. It is a separate choice from the newsletter, so you can be on one and not the other, and leaving one does not take you off the other. We record the date you agreed and the wording you were shown.
• Consent records: whether you accepted our terms and whether you opted into the newsletter, with the date and the exact wording shown at the time. If you opt in again later, we add the new record and keep the earlier ones. We keep this so we can demonstrate what you agreed to.
• Technical logs: our hosting provider records IP addresses and browser details to serve pages and block abuse. We do not use these to build a profile of you. Separately, to stop floods and password guessing, our own forms (signing up, logging in, password resets, the contact form, reports, the reader interest list, the book quiz and Blind Date, Ask questions and story comments) keep a one-way hash of your IP address with a timestamp, deleted after two days; confirmation and password-reset requests also keep a one-way hash of the address they were sent to for the same two days.
• Story and Upcoming reading statistics: when you read a short story we count the visit, how long the story was open in a visible tab, and how far down it you got (only in quarters: a quarter, halfway, three quarters, the end); when you visit an Upcoming book's page or its sample chapters we count the visit. In both cases the author sees only the aggregate: a total view count (and, for stories, an average reading time and how many readers reached each quarter), never who read it or any one person's time or progress. To keep the counts honest we store a one-way salted hash of your connection details (when it is cleared is set out under “How long we keep it”): not your IP address, not linked to any account, and not readable back into either. No cookie and nothing on your device is involved. Basis: our legitimate interest in showing authors how their work is received.
• Reader page statistics: when you visit a reader's page (indiefiction.com/@username) we count the visit, and when you click one of its links or buttons we count the click. The reader sees only totals per day (visits, and clicks per link), never who visited or clicked. Their own visits and search engine robots are not counted. To keep the counts honest we store a one-way salted hash of your connection details, separate from the one used for stories, which is cleared after one day (see “How long we keep it”): not your IP address, not linked to any account, and not readable back into either. No cookie and nothing on your device is involved. Basis: our legitimate interest in showing readers how their page is used.
• Joining an ARC: when you press Join on the ARC page we add one to that request's click count and send you to the author's own sign-up form. We store nothing about you for this: no IP address, no hash, no cookie, and search engine robots are not counted. What you enter on the form goes to the author and to the form's provider (Google Forms, BookFunnel, StoryOrigin, Prolific Works or BookSirens), under their privacy policies, not ours; we never receive it. Basis: our legitimate interest in showing authors how their request is doing.
• Subscription details: which plan you are on, its status, and when it renews. We never see or store your card number. Card details go directly to Stripe, who processes the payment as merchant of record; we receive only a reference to the subscription.
• Reader interest list: if you register interest in an upcoming book, we store your email address, your name if you chose to give one, when you registered, and the exact wording you agreed to. This list exists to be given to that book's author. See “Who we share it with” below, because this is the one place on the site where your address goes to another person.

We do not buy personal data from third parties.

Under the Australian Privacy Principles we may only use your information for the purpose we collected it for, or a directly related purpose you would reasonably expect. Under the GDPR we must additionally have a lawful basis for each use, so we have set those out below.

• Running your account: to let you log in, submit books, and manage your profile. Basis: performance of a contract with you.
• Listing your books and publishing your author profile: the entire point of the platform. Basis: performance of a contract, at your request.
• Newsletter: only if you asked for it, by ticking the box at signup, by subscribing from one of the signup forms listed above, or by turning it on from your account page. Basis: your consent, which you can withdraw at any time.
• Running the community (Ask and story comments): publishing the questions, answers and comments you post, and showing your name and photo on answers you write. Basis: our legitimate interests in running a community, and your act of posting.
• ARC reader list: keeping the list of readers and authors who want to hear about ARC requests (for books before or after they are published), so those requests only ever reach people who asked for them. They come in one email on Fridays, only in weeks when there are requests to share, and each one has a link to leave the ARC list without leaving the newsletter. Basis: your consent, withdrawn by switching it off or telling us.
• Moderating submissions and preventing abuse: keeping the catalogue and the community accurate and the platform safe, including the posting limits described above. Basis: our legitimate interests.
• Responding to your messages. Basis: legitimate interests, or steps taken at your request.
• Managing your subscription: mirroring its status so the site knows what to show, and linking you to Stripe's portal for invoices and card changes. Basis: performance of a contract.
• The reader interest list: holding your address so the author can receive it and tell you when their book is published. Basis: your consent, given next to the form with the disclosure in front of you.
• Understanding how the site is used: which pages and books people find, so we can improve discovery. Basis: your consent, given through the cookie banner.
• Meeting legal obligations: where the law requires us to retain or disclose something. Basis: legal obligation.

We do not sell your personal information, and we never will. We do not share it with advertisers or data brokers.

We use two kinds of cookie: those strictly necessary to run the site, and analytics cookies that only load after you accept them. There are no advertising cookies and no cross-site tracking on IndieFiction.

Strictly necessary:

• Session cookies (names beginning sb-): set by our authentication provider to keep you logged in. If you continue with Google, a short-lived if_google_flow cookie also protects that sign-in and is deleted as soon as it completes (10 minutes at most).
• if_signed_in: a simple yes/no marker so the header can show “My account” without slowing the page down. It contains no identity and no personal data.
• if_admin: set only for site administrators, so the same header link points to the admin panel instead of an author account. A yes/no marker with no identity in it, and no effect on what anyone is allowed to do.
• if_join_snooze: set only if you press “Not now” on the newsletter and ARC reader invitation on your account page, so it stays hidden for 30 days. A yes/no marker with no identity in it, and it expires on its own.
• Local storage: remembers your cookie choice, so we do not ask again, and holds a random id used to remember which books, stories and Ask posts you have liked, which authors you have recommended, which answers you found helpful, and which questions you asked from this browser. That id is generated by your browser and is not derived from anything about you: no IP address, no fingerprint, and nothing that identifies you. Clear your browser data and it is gone. It also keeps your place in the short stories you are partway through (just how far down each one you got), so you can continue where you left off. Your place is never sent to us; it covers your 50 most recent stories and is forgotten when you finish a story or after 90 days. If you change the reading settings on a story (text size, page colour, font), those choices are kept here too, and are never sent to us either. Local storage also keeps your book quiz progress (levels unlocked and scores), a note that you confirmed you are over 18 before reading an explicit sample chapter, a book or person you chose to save or follow before signing in (until you have), and a marker so a purchase is counted in analytics only once; session storage remembers, for the current visit only, that you closed the sign-up prompt. None of these identify you.

Book trailers: an Upcoming book's page can carry a trailer hosted on YouTube or Vimeo. Nothing loads from either until you press play. When you do, the video plays from YouTube's privacy-enhanced domain (youtube-nocookie.com) or from Vimeo's player with its do-not-track setting on. From that moment the video site receives your IP address and may store data in your browser, under its own privacy policy rather than ours. Don't press play and they receive nothing.

Analytics (only with your consent):

• Google Analytics 4 (cookies named _ga and _ga_*): tells us which pages and books people find, and roughly where visitors come from. Google uses your IP address to work out an approximate location and does not store it. We also count three things as they happen: creating an account, starting checkout, and completing a subscription or a purchase, such as a paid ARC request, so we can see which pages lead people to sign up and buy. We count plays of the book quiz and Blind Date with a Book the same way (the level and score, or which book was shown or unwrapped), never who played. These are counts and nothing more: your name, your email address and your payment details are never sent to Google, which is both our rule and theirs.

These load only after you accept in the cookie banner. Decline and the script is never requested at all: not loaded and switched off, not present. The site works exactly the same.

You can change your mind at any time. “Cookie settings” at the bottom of any page brings the banner back, and declining there stops analytics from loading again from that moment on.

We have not asked for, and do not set, advertising cookies. If that ever changes, the banner will ask you separately: accepting analytics is not accepting advertising.

Google is an additional recipient of this data and may process it outside your country under its own safeguards.

We use a small number of service providers to run the platform. They process data on our instructions only, and cannot use it for their own purposes.

• Supabase: database, login, and image storage. Our project is hosted in the United States (North Virginia).
• Vercel: website hosting and content delivery. Pages are served from servers worldwide.
• Brevo: sends our emails, including confirmations, password resets, and the newsletter. Brevo is based in the European Union.
• Google: verifies who you are, and only if you choose to sign in with Google. Google tells us your name and email address. We send nothing about you to Google beyond the fact that a sign-in was requested, and choosing this is entirely optional. Google is based in the United States.
• Google Analytics: measures how the site is used, and only if you accepted analytics cookies.
• Stripe: processes payments for subscriptions, message tokens and ARC requests as merchant of record. The purchase is made from Stripe, on Stripe's checkout, and they receive your card details directly; we do not.

One disclosure on this site goes to a person rather than a service provider: the reader interest list. Register interest in an upcoming book and your email address (and name, if you gave one) exists so that the author can download it and email you when the book is out. The wording beside the form says exactly this before you submit.

Be clear about what that means: once an author has downloaded the list, they hold their own copy and we cannot take it back: deleting our copy does not undo the disclosure. Authors agree, as a condition of their subscription, to use the list only to announce that book, never to sell or share it, and to honour opt-outs. If an author misuses your address, tell us. We can and do end subscriptions over it.

We may also disclose information if the law requires it, or to establish or defend a legal claim.

IndieFiction is operated from Australia, and our providers store data in the United States and the European Union. Wherever you live, this means your personal data is held outside your country, including if you are in Australia.

Australian Privacy Principle 8 requires us to take reasonable steps to ensure overseas recipients handle your data consistently with the APPs, and we rely on our providers' contractual commitments to do so. For people in the UK and EU, those transfers rest principally on Standard Contractual Clauses approved by the European Commission, together with the technical protections described below. You can ask us for details of the safeguards that apply.

• Account and profile: for as long as your account exists. Delete your account and we remove your profile, biography, and photograph.
• Published books: until you remove them, or you ask us to. On a business account, deleting the account deletes its listings with it.
• ARC round-up send log: a one-way hash of your address against each Friday's ARC email, so a send that has to resume never mails you twice. Not your address. Entries older than 90 days are deleted each time a Friday ARC email finishes sending.
• ARC requests: for as long as your account exists, live, ended or declined, so you can see what you have asked for and how many requests are left, along with the record of any you bought. Deleting the account deletes them; Stripe keeps its own record of the payment as the seller.
• Business contact person: for as long as the account exists, or until you blank the fields on your publisher profile.
• Lapsed business accounts: a business account whose plan has lapsed, or that remains suspended, may be deleted after two years, together with everything it holds. We do not keep an organisation's data indefinitely with nothing to show for it.
• Short stories: until you delete them. Deleting your account deletes your stories with it, drafts included. Unlike an Ask question, nothing is kept and re-labelled, because a story is the whole of what you wrote rather than one side of a conversation someone else is still having. If we had already quoted an extract in a newsletter or a social post before you deleted it, that copy stays where it is: a newsletter that has been sent cannot be recalled. We publish no new extracts after you remove a story.
• Ask posts: your questions and answers stay public until you or we remove them; email us and we will take yours down. If you delete your account, your answers are deleted with it, while your questions remain but are shown as Anonymous, detached from your name, so the thread still makes sense to the next reader.
• Story comments: public until you or we remove them; email us and we will take yours down. A comment is deleted for good when the story it sits on is deleted, and an author's reply goes with the comment it answers. Authors can delete their own replies at any time.
• Story and Upcoming reading statistics: the hashed connection records behind view counts are cleared once they are more than 90 days old, the next time that story or book is viewed, and all of them are deleted when the story or book is deleted. The aggregate totals (a story's view count and average reading time, an Upcoming book's view count) are part of the work's record and stay with it.
• Reader page statistics: the hashed connection records are cleared once they are more than a day old, and the daily totals once they are more than 90 days old, the next time that reader's page is visited. All of it is deleted with the reader's account.
• Your shelf and the authors you follow: until you remove them, and deleted with your account. A book that leaves the site leaves every shelf it was on. Reviews and notes: until you delete them, and deleted with your account, photos included. A post we take down is kept invisible rather than erased, so a contested removal can be reviewed against the real text.
• Messages: a conversation is kept until either person deletes their account, when the whole conversation is deleted for both of you. A message we remove is kept invisible rather than erased, for the same reason as a removed post. Blocks are kept until you lift them.
• Message tokens: a record of each conversation you open and which allowance it used, and of each pack you buy (how many tokens, the amount, and Stripe's reference for the payment; never your card details, which Stripe holds), kept for the life of your account and deleted with it. If you open a conversation with a paid token, we email the other person to say that you did, with a link to reply; the email never carries the message itself.
• Account notifications: deleted after 180 days, deleted immediately when you dismiss one yourself, and deleted with your account. Longer than the 90 days we hold reading statistics on purpose: these are your own record of decisions about your work, and a review note from five months ago is still the thing you may want to refer back to.
• Newsletter records: until you unsubscribe. We keep a record of the unsubscribe itself so we can prove we honoured it, and so we do not email you again by mistake. Ask us to erase the address outright and we will, from our list and from our email provider, though then nothing is left to stop a later import adding you back.
• Removed author profiles: if we take a profile down for breaking our terms, such as claiming to be someone else, we keep a copy of what was published and the reason it went. A contested removal has to be reviewable against the real text rather than our description of it. Delete the account and that copy goes with it.
• Closed accounts: when an account is deleted we keep a one-way hash of the email address, the reason, and how many books and answers were affected. The hash cannot be turned back into your address; it exists so a deletion can still be accounted for afterwards and, for an account we deleted as spam, so the same address cannot sign up again. Everything else goes.
• Messages to us: kept so we have context if you write again, until you ask us to delete them.
• Technical logs: short-lived, and retained by our hosting provider under their own schedule.
• Analytics: only collected if you accepted it. Google holds the visit-level data for up to 14 months and then deletes it; the aggregate counts we actually look at (how many people read a page) are kept indefinitely, and identify nobody. Declining, or withdrawing later through “Cookie settings”, stops new data being collected. It does not reach into what Google already holds, which ages out on that schedule.
• Reader interest lists: while the author's subscription is active, and for 30 days after it lapses so an expired card doesn't instantly destroy their list; then our copy is deleted. It is also deleted when the author removes the book. Each download an author makes is logged (who, which book, how many addresses, when) so “when did my address leave your system?” always has an answer. Remember that deletion of our copy does not reach copies an author already downloaded.
• Subscription records: the mirror of your plan's status, kept while your account exists. Invoices and payment records are held by Stripe as the seller, under their own retention obligations.

Wherever you live, you can ask us to show you what we hold, correct it, or delete it. If you are in the UK or EU, the GDPR additionally gives you the right to:

• receive a copy of your data in a portable format;
• object to processing based on our legitimate interests;
• ask us to restrict processing while a dispute is resolved;
• withdraw consent at any time (this does not affect anything we did before you withdrew it).

If you are in Australia, the Australian Privacy Principles give you the right to access the personal information we hold about you and to ask us to correct anything inaccurate, out of date, or misleading. You can also ask us to stop using your information for direct marketing at any time.

The quickest routes: change your details on your account page, switch the newsletter off with the toggle there, or click unsubscribe in any email. Erasure is self-service too: the same page will delete your account outright, after showing you what that removes. For anything else, email hello@indiefiction.com. We do not charge for this.

If you think we have handled your data badly, please tell us first: we would rather fix it, and we will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner. People in the UK can complain to the Information Commissioner's Office, and those in the EU to their national supervisory authority.

The site is served over HTTPS. Passwords are hashed by our authentication provider and are never visible to us. Access to the database is restricted at row level, so one author's account cannot read another's private data. Uploaded images are validated by their actual file contents rather than their filename, and stored under generated names.

No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the relevant authority as the law requires.

Accounts on IndieFiction are for adults: you must be 18 or older to create an account. We do not knowingly collect personal data from children. If you believe a child has created an account, tell us and we will remove it.

We will update this page as the platform grows. The date at the top always reflects the latest version. If a change materially affects your rights, we will tell you, by email if you have an account with us.