Privacy Policy

Last updated: 8 October 2026.

This policy covers IndieCrew.Win, including our website, community and email updates list.

1. Who is responsible

Asynq Labs LLC is the operator and data controller. Our registered address is 30 N Gould St Ste N, Sheridan, WY 82801, United States. Contact privacy@asynq.org about personal data or email support@asynq.org.

2. Accounts and sign-in

Each account has an internal identifier. If you choose Google sign-in, we request only the OpenID identity permission and store your Google account identifier to recognise you. We do not request your Google name, email, photo, contacts or mailbox. We validate the sign-in token but do not keep Google access or refresh tokens. Google handles its own sign-in service under its Privacy Policy.

You choose a public name or nickname during account setup. Email is optional for Google accounts. If you register by email or add an email in Settings, we store the address and its verification status and send one-time codes through Resend. Without a linked email, access to a Google account depends on your continued access to Google. We do not collect an account password. Adding an email does not join our mailing list.

Two-step verification is optional for Free accounts and required for Crew access. We store an encrypted authenticator secret, hashed recovery codes and verification timestamps. Recovery codes are shown once. We also record security changes without recording the codes or secret in audit events. Setup QR codes are generated on your device. Sensitive changes require recent verification of your existing identity or authenticator. Google may provide a signed authentication timestamp for this check; we do not request additional profile permissions.

In Settings, you can choose optional emails about featured appearances, collaboration updates and daily community digests. These choices are off by default and separate from the news mailing list. Delivery needs a verified email. We store your preferences and delivery records to honour your choices and prevent duplicate messages. Emails can include public project information, aggregate activity counts and, for Crew digests, names of members with new pitches. We do not include private pitch bodies or pact commitments in these emails. You can turn these emails off in Settings; sign-in codes are separate.

3. Community data and who can see it

• Your chosen name, headline, skills, optional avatar, LinkedIn and X profile links, and published projects (including uploaded logos and cover images) are public. Public content can be copied or shared by visitors. Your profile also shows aggregate counts of different people you helped and completed pacts, plus applicable Crew or founding Crew status. Reputation totals do not publish private commitments, thank-you text or partner identities.
• Your pitch describes what you are building, need and offer. It is visible to you and Crew members, including when you have a Free account. It is not a confidential message to a single person.
• We store connection requests and their status. Senders can see their own messages. Free recipients can see that a request exists and who sent it, but need Crew access to read the message and respond.
• Pact commitments, delivery confirmations, help records and thank-you messages are available to their participants in the application.
• We keep project likes, featured reservations, membership status, onboarding progress and internal contribution records to operate those features and enforce their rules.
• We store founder following relationships and inbox read status. Follower and following counts are public. Crew followers can see your public project publications, likes, comments, new follows, links and stories, and receive notices when you gain or lose Crew membership. Losing Crew removes your follows in both directions. The inbox displays up to 90 days of eligible activity and does not expose private pitch or pact content.

Authorised operators and service providers may access data when necessary for support, maintenance, security, abuse handling or legal obligations. Private content is access-controlled, not end-to-end encrypted. Do not include passwords, sensitive personal information or other people’s confidential material in your pitch or collaboration records.

Club participation and renewal records

Crew membership renews at no extra charge when participation and qualifying guest requirements are met. We store membership status and audit successful community actions, including their time, acting member, affected member and whether they came from the web or MCP. Audit records contain identifiers and action types, not private message bodies. Renewal assessments use the disclosed activity criteria and relevant referral records: who recommended a guest, their registration and project creation, and accumulated guest credit. These records support renewal decisions and reminders about unmet requirements. You may request correction of inaccurate records or human review by emailing privacy@asynq.org.

4. Email updates and support

Account email notifications follow the preferences in your workspace settings. Previous interest-list records may include an email, signup time, source and consent version. You can request deletion of those records by emailing support@asynq.org. We also process messages and contact details you provide when asking for help.

5. Technical data and browser storage

Our hosting provider processes request information such as IP addresses, browser details, timestamps and errors to deliver and protect the site. The application uses hashed network, email or account identifiers and attempt counts for abuse prevention. Audit records identify relevant actors, actions and times without intentionally copying private message bodies or sign-in secrets into the audit log.

Essential cookies maintain your session and bind sign-in attempts to your browser. An invitation cookie remembers the first valid member invitation for up to 30 days, so a new account can be credited to the person who invited you. Sessions expire after seven days; code and Google sign-in flows expire after ten minutes. Expiry prevents use but does not mean every related database or provider record is immediately erased. Blocking essential cookies prevents sign-in. We use local browser storage to remember your homepage introduction display preference. The current application does not include advertising cookies or third-party behavioural analytics scripts.

We count clicks on project website buttons as daily project totals. These totals do not identify individual visitors or use tracking cookies. Short-lived hashed network identifiers limit abusive requests. Project comments and their author profiles are public; removed comments are hidden while relevant records may be retained for moderation and audit. Comment likes are associated with your account. Reports, their reasons and additional context are private moderation records.

6. Why we process data

Where data protection law requires a legal basis, we rely on performing our agreement with you for account access, profiles and the community features you request. Our legitimate interests in protecting the service, investigating abuse, maintaining reliable systems and resolving disputes support necessary security and operational records. Email updates rely on your consent, which you may withdraw without affecting earlier lawful processing. We may also retain or disclose information where a legal obligation requires it.

We do not sell personal data, use community content to train AI models, or send private pitches to an AI service in the current product. Access checks and rate limits are automated; you can contact us to request a human review of an access restriction.

7. Providers, disclosures and international processing

Cloudflare provides hosting, security and D1 database storage. Resend processes destination addresses, verification email content and delivery information when we send email. Email-update addresses and consent are stored in our database. If we import the list into Resend for a mailing, Resend also processes the consented contact addresses and subscription preferences. Account registration alone does not add an address to that list. Google processes sign-in requests when you choose it. Email providers also process correspondence sent to our support addresses. We share only information needed for the relevant service. External project links have their own privacy practices.

Asynq Labs is based in the United States and our providers operate internationally. Data may be processed outside your country, including outside the EEA or UK. Where transfer restrictions apply, transfers require an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses and the relevant UK protections. Contact us for information about the safeguards applicable to your data.

We may disclose information when required by law or when reasonably necessary to address fraud, protect people or establish or defend legal claims. A business transfer may involve relevant records, subject to applicable law and notice of a material change in their use.

8. How long we keep data

Account and community records are retained while needed to provide your account and the interactions you participate in. On an account-deletion request, we review the associated records and delete or anonymise data that is no longer needed. Limited records may need to remain for an unresolved dispute, abuse investigation, legal obligation or another participant’s legitimate rights; we explain relevant exceptions when handling your request. Archiving a project or signing out is not an account-deletion request.

Expired sign-in and rate-limit records are cleaned up during subsequent service activity. Operational audit and collaboration history are not automatically erased when a session expires. Early-access records are kept until you leave or the programme ends, with unused records reviewed before any later mailing programme. Provider logs and backups may persist under their retention cycles. We do not promise an immediate purge from every backup or from copies other members have independently saved.

9. Your choices and rights

You can edit your profile and pitch in the workspace. For access, a copy or export, correction, deletion, restriction, an objection to processing, or withdrawal of mailing consent, write to privacy@asynq.org. These requests are handled manually; there is no self-service account-deletion tool yet. We may ask for proportionate proof that the account is yours, including for accounts without an email. Never send a sign-in code or session token.

Rights and exceptions depend on applicable law. Where the GDPR applies, you can complain to your local data protection authority and we normally respond to rights requests within one month, notifying you if a permitted extension is needed. You may object to processing based on legitimate interests and to direct marketing. We do not charge for ordinary rights requests. Withdrawing mailing consent does not close your account.

10. Age and policy updates

IndieCrew is intended for adults aged 18 or over. Contact us if you believe a child has supplied personal data. We update this page when our practices change and show the revision date above. For material changes we provide an appropriate notice, such as in the application or by email where available, and request consent when required.

Terms of Service · Operator details