Privacy Policy

Effective 25 July 2026 · Questera Marketing · support@questera.ai

The short version: Indexa is a desktop app that runs entirely on your own computer. Your sites, credentials, and submission history never reach us — we couldn't see them if we wanted to. The only things we handle are your purchase record (email + licence key, so you can recover it), payment via Stripe (we never see card numbers), and website analytics — cookieless and anonymous by default, plus Google Analytics only if you accept the cookie banner (section 4).

1. What the Indexa app does with your data

Everything. Locally. The app stores your projects, sitemap URLs, Google credentials, and full submission history in a database on your own computer. Sign-in tokens are encrypted with your operating system's keychain. The app's network connections go only to Google, to the IndexNow endpoints, and to your own sitemaps — directly from your machine, using your own accounts and quotas. There is no Indexa server in the middle, no account system inside the app, and no telemetry, tracking, or analytics of any kind in the app.

Your Google credentials never leave your device. The OAuth tokens (and any API client credentials) the app uses to talk to Google are created on your machine, encrypted there, and sent only to Google — we never receive, proxy, transmit, or store them, and nothing in the app is capable of sending them to us.

The email address you enter to start the free trial is stored, encrypted, on your own computer, and is also sent to us once when the trial starts. We use it only to record the first time that email began a trial, so that reinstalling the app does not silently restart a used trial. If you are offline the app starts the trial locally and reconciles on a later launch.

2. What we store on our side

Only what a purchase requires:

Purchase record — when you buy Indexa, we keep your email address, the name Stripe gives us (if any), and the licence key we generated for you. This is what lets you recover a lost key at any time from the account page.
Sign-in events — when you sign in on this website with a one-time email code, we record that the sign-in happened (email and timestamps), to operate the account page and understand aggregate signups.
Support email — if you email us, we have what you sent. The app's built-in problem reports are automatically scrubbed before they leave your machine: URLs, project names, emails, and usernames are redacted.
An anonymised device token — a licence is valid on one computer at a time, so activating registers a device token with us. It is derived from an operating-system identifier that is hashed with a salt before it ever leaves your machine, so what we receive is an opaque string: we cannot recover your hardware ID from it, and it tells us nothing else about your computer. It is sent when you activate, when the app re-checks the licence on launch, and when you deactivate to move to another computer.
Windows SmartScreen check — the Windows installer is not yet code-signed. Windows itself (via SmartScreen/Microsoft Defender's reputation check, not anything Indexa adds) may send the installer's file hash to Microsoft the first time you run it — this is standard Windows behaviour for any unrecognized publisher's software and is outside our control.

That's the whole list. We have no database of your sites, pages, or submissions. The app never sends us your URLs, project names, Google credentials, or anything else about the work you do in it — the device token above is the only thing it reports about your computer.

3. Payment

Payments are processed by Stripe. Your card details go to Stripe, not to us — we receive only confirmation of the payment and the email you used at checkout. Stripe's own privacy policy governs that data.

4. Website analytics and cookies

This website — not the app — uses two analytics tools. DataFast runs on every page: it is cookieless and aggregate, recording page views and referrers with no personally identifiable information and no cross-site tracking.

Google Analytics 4 is different, so we ask first. It sets cookies (_ga, _ga_*) in your browser, derives an approximate location from your IP address, and sends that data to Google, who process it under their own terms. It loads with Google Consent Mode set to denied, which means it stores nothing and sets no cookies unless you press Accept on the banner. Decline — or simply ignore the banner — and it stays switched off. To change your mind, clear this site's cookies and site data and the banner returns.

We do not sell your data and we do not build advertising profiles: the Google Ads personalisation signals (ad_storage, ad_user_data, ad_personalization) are set to denied and we never enable them.

5. One-time email codes

Signing in on this website sends a one-time code to your email via our email-delivery provider. The code proves you own the inbox — that's how we make sure only you can see your licence key. Codes expire and are not reused.

6. Your data on your device is yours — and your responsibility

Because everything the app does lives on your own computer and disk, it is under your control — and outside ours. We cannot access, restore, or recover the app's local data, and we are not responsible for its loss, for your device's storage, or for backups. Standard practice applies: back up your machine like you back up anything that matters.

7. Data retention & deletion

We keep purchase records for as long as your licence exists, as proof of purchase and for key recovery. To have your records deleted, email support@questera.ai from your purchase address — note that deleting the purchase record removes our ability to re-send a lost key, and the app will stop validating on its next licence re-check.

8. Changes

If this policy changes, the new version will be posted here with a new effective date. Material changes to what we collect would be called out on the site.

9. Contact

Questions about privacy: support@questera.ai.