Privacy

Privacy Policy

InIndy is a community app for people in Indianapolis. This page describes what we collect, why, and what we do not do. If anything here is unclear or you want your data removed, email brian.walker@inindy.co.

What this website collects

Nothing. This site has no analytics, no tracking scripts, no cookies, and no forms. Google Fonts is loaded from Google’s CDN and, per Google’s own terms, is subject to their privacy policy for the fetch; we do not receive or store anything from that request.

What the app collects

• Your email address, for sign in. InIndy uses passwordless magic-link authentication — we send a one-time link to your email, and tapping it signs you in. Your email is stored so we can find your account on subsequent sign-ins.
• Your display name and avatar, if you provide them. Both are optional and both are visible to other InIndy users who see your posts or groups.
• The neighborhood you belong to, so the app can show you the right feed and route posts you mark as neighborhood-visible to the right audience.
• Posts you create: title, description, time, and a specific street address for the event. See Location below for how that address is determined. Each post has a Who can see this? visibility setting that you choose; see Post visibility.
• Groups you join, and your role in each group (for example, member or admin). Group membership and role are stored so the app can enforce group-only post visibility and display member counts.
• Your attendance history: when you attend an event, the app records the event, the host, and the date, and shows them on your profile as your attendance history.
• Photos you attach to posts, groups, or your profile. Photos are compressed on your device before upload and stored via Cloudflare R2 behind a public CDN URL.
• RSVPs for posts, so hosts can see who is coming.

Location

Location data in InIndy is precise, not neighborhood-approximate: when you attach a location to a post, it identifies a specific place (for example, “Monument Circle, Indianapolis, IN”), not just the neighborhood.

There are two ways to attach a location when you create a post:

• Use my location. Tapping this asks the operating system for permission to read your device’s coordinates. The app reads them once, resolves them to a street address, and pre-fills the post with that address. The app does not track your location in the background and does not keep a location history for your account.
• Search an address. Typing here sends your query to a third-party address / places lookup service, which returns matching addresses. The address you pick is stored with the post.

Whichever method you use, the location stored with the post is the event’s location, and it is visible to whoever the post’s visibility setting allows — not to InIndy users at large.

Post visibility

Every post has a Who can see this? setting that you choose when you create it. In practice this controls which audience the post is shown to:

• My neighborhood — the post appears in the neighborhood feed for other InIndy users in the same neighborhood you belong to.
• A group — the post is visible only to members of the specific group you posted it to. Non-members cannot see it, even if they are in the same neighborhood.

You choose this for each post individually. The post row and its media are stored on our infrastructure regardless of the setting, but Supabase’s row-level security enforces the audience: non-members of a private group cannot read that group’s posts at the database layer.

Where your data lives

• Supabase hosts the Postgres database (with PostGIS for neighborhood queries), authentication, and access-control rules. Row-level security is enabled on every table, so, for example, posts made inside a private group are not readable by non-members at the database layer.
• Cloudflare R2 holds uploaded images, served publicly via the Cloudflare CDN. The database only stores the CDN URL, not the raw image bytes.
• Your device stores a small amount of local state: the auth session token (kept in EncryptedSharedPreferences on Android and the iOS Keychain), and preferences such as your chosen theme and last-selected neighborhood. These do not leave the device.

What we do not do

• We do not sell your personal data.
• We do not run advertising in the app.
• We do not include third-party ad or analytics SDKs.
• We do not share your data with anyone, other than the infrastructure providers listed above (Supabase and Cloudflare), which process it on our behalf.
• We do not implement phone-number sign-in or send SMS. Only email magic-link sign-in is offered.

Deleting a post or your account

You can delete any post you created from inside the app; the post row, its images, its tags, and its RSVPs are removed. To delete your entire account — profile, posts, groups you created, images, and email — email brian.walker@inindy.co from the address on the account and we will process the deletion. During the beta, deletions are handled manually; a self-serve delete flow is planned for the shipping version.

Children

InIndy is not directed at children under 13. If you believe a child has created an account, email us and we will delete it.

Changes to this policy

If we change how the app handles data in any material way, we will update this page and change the effective date below. If a change is significant, existing users will be notified in-app the next time they open InIndy.

Contact

Questions, requests, or corrections: brian.walker@inindy.co.

Effective date — August 27, 2026