Privacy Policy
Indicia Privacy Policy
Last Updated: 07/12/2026
This Privacy Policy explains how Indicia ("we," "us," or "our") collects, uses, and protects your information when you use our OSINT platform at Indicia.app. By using Indicia, you agree to the practices described below.
1. Information We Collect
We collect only the data necessary to operate, secure, and improve the service:
1.1 Account Information
Email address (required for account recovery and paid subscriptions)
Username.
Password hash (we never store plain-text passwords).
Referral Payout Information: If you participate in our referral program and request a payout of earned commission, we collect and store the payout method you select and the destination you provide to receive funds (such as a payment-app handle, email address, or username), along with your payout request and payment history (amounts, currency, status, and dates). We do not collect or store bank account, routing, or card numbers for referral payouts.
1.2 Technical & Usage Information
IP address.
Device and access information (browser, timestamps, etc.).
Search History: We log the specific tools you access and the text queries you enter, as well as the titles and descriptions of the "Cases" you create to organize your history, to provide your account dashboard and workspace functionality.
Bot Protection (Cloudflare Turnstile): On our sign-up, login, and password-reset forms we use Cloudflare Turnstile to distinguish human users from automated abuse. Turnstile is provided by Cloudflare, Inc. and may process technical signals such as your IP address, browser and device characteristics, and interaction data in order to issue a verification token. This information is processed by Cloudflare acting as our service provider, solely for security and anti-abuse purposes, and is not used by Indicia to build a profile of you. For details, see Cloudflare's privacy policy.
1.3 Uploaded Content & Biometric Data
We do not permanently store, retain, or archive images you upload to the Service. Uploaded images are processed temporarily for the duration of your request and are deleted from Indicia's systems immediately after the output is generated. Some features (such as geolocation and reverse face search) require transmission of your uploaded images to third-party providers for processing. These providers analyze the content solely to generate the requested result. By default, third-party providers are not permitted to retain or use your images for model training or improvement. If a third-party provider offers an option to contribute your uploaded image to help improve its models, this will only occur if you provide explicit, separate, opt-in consent at the time of upload. If you do not opt in, your images will not be retained by any third-party provider and will not be used for training. Indicia does not control and is not responsible for the independent privacy practices of third-party providers when you choose to opt in to training. When you consent to such use, your uploaded image may be retained by that provider according to its own privacy policy. Without this opt-in consent, your uploaded content is not retained for any purpose beyond generating the requested output.
No Biometric Collection: Indicia does not maintain databases of biometric identifiers (such as face geometry or retina scans) for the purpose of identification. While third-party providers may analyze features within an image to provide context, geolocation results, or facial similarity results, Indicia does not retain, store, or build profiles based on biometric templates. Indicia does not collect, create, or store biometric identifiers or biometric templates. When you upload an image, third-party providers may analyze visual features for the sole purpose of generating the requested result. They are contractually prohibited from using your uploaded content for biometric identification or recognition beyond that purpose.
If any third-party provider wishes to use uploaded images for model improvement or training, this will occur only when you provide explicit, separate, opt-in consent at the time of upload. Without this opt-in, your images will not be used for training.
Third-Party Processing: To generate results for tools like geolocation and reverse face search, we transmit your image to trusted third-party analysis providers and AI tools. By using these features, you explicitly acknowledge and agree that:
Transmission for Analysis: Images may be transmitted to third-party processors solely for the purpose of generating the requested output (e.g., geolocation analysis or facial similarity results).
Training & Retention: Uploaded images are not used by default for model training. Third-party providers may request to use your images for model improvement, but this will only occur if you provide explicit, separate consent at the time of upload. Without this opt-in consent, your uploaded content will not be retained or used for training.
Necessary Rights: You confirm that you have the right to upload the content you submit. If an upload contains personal data belonging to others, you are responsible for ensuring you have obtained any required permissions or notices before submitting it to the service.
Indicia as Intermediary: Indicia acts as an intermediary and facilitator for these third-party processing services. The content (image/text) is processed by these third parties subject to their own privacy policies and retention practices.
1.4 Reverse Face Search - Third-Party Processing
The reverse face search feature is provided through a third-party facial similarity search provider. Indicia acts as a facilitator for this service; Indicia does not independently operate or maintain the underlying facial recognition index. As a result, data handling practices for this feature are governed in part by our third-party provider's policies in addition to this Privacy Policy.
Specifically, with respect to data submitted through the reverse face search feature:
Uploaded Photos (Search Input): Photos you upload to initiate a reverse face search are not stored by the third-party provider after processing is complete. Once the facial similarity analysis is completed and results are returned, the uploaded image is automatically deleted from the provider's systems. No technical copies or backups are retained by the provider.
Search Results and History: Search results and history accessible through your Indicia dashboard are retained as long as your account is active and in use, or for a maximum of 30 calendar days of inactivity, after which they are subject to automatic deletion. You may also manually delete search records at any time through your dashboard.
System Logs and Technical Metadata: System access logs, diagnostic events, and error reports related to reverse face search processing are retained for a maximum of 90 days and are processed in anonymized form. These logs do not contain personal data relating to the subjects of search images.
For further information on the data retention and processing practices of our third-party facial similarity search provider, please refer to their privacy policy, available at: https://osint.pimeyes.com/privacy-policy
Minors: The reverse face search feature may not be used to search for, identify, or investigate individuals who are under the age of 18. Uploading images depicting minors for the purpose of reverse face search is strictly prohibited. Violation of this restriction may result in feature restriction or permanent account termination on the Indicia platform, and may be reported to relevant authorities. See Section 9 for our broader policy on children's privacy.
Geographic Restrictions: Due to local laws and regulations, the reverse face search feature is not available to users located in the European Union (including all EU member states) or the U.S. state of Illinois. Access attempts from these regions are automatically blocked at the platform level.
1.5 Legal Bases for Processing (EEA, UK, and Switzerland)
If you are located in the EEA, UK, or Switzerland, we process your personal data under the following legal bases:
Contract Necessity - to create and manage your account and provide the Service.
Legitimate Interests - to secure the platform, prevent abuse, and improve functionality.
Consent - when you explicitly choose to opt in to optional features such as allowing third-party providers to use your uploaded images for model improvement.
1.6 Data Retrieved from Public and Third-Party Sources
In providing our OSINT services, we retrieve, aggregate, and display data from public sources and third-party databases in response to your queries. This may include:
Breach & Compromise Data: Information retrieved from third-party breach repositories (e.g., "stealer logs," exposed usernames, and passwords) solely for security analysis and digital forensics.
Geospatial & Contextual Data: Information derived from public reviews, photos, or check-ins (e.g., Google Maps contributions)
Public Metadata: Usernames, IDs, and social media details (e.g., Discord or Roblox Profiles). We do not create this data; we index and visualize it. By using the Service, you acknowledge that Search Results may contain PII belonging to third parties.
1.7 Case Data and Organization Data
The Case feature allows you to efficiently organize your investigations and access relevant information in one place. To keep these Cases synchronized across your devices, the data is stored on our servers; however, by design, our administrative tools do not allow us to see the contents of the Case. We only have access to limited metadata such as:
The title and description of the Case.
Whether the Case has been shared with an organization, and if so, which organization.
Users may optionally create or join Organizations to collaborate with other Indicia users. When you are a member of an organization, we store and process the following data to provide organization features:
Your membership record, including your role within the organization (owner, admin, or member) and the date you joined.
The organization's name, URL slug, logo (if set), description, creation date, and default case-visibility setting.
An audit log of organization management actions (such as inviting or removing members, sharing or unsharing cases, and sending credits to members) including the actor's display name, the action taken, and a brief detail record. Audit log entries are retained as long as the organization exists.
Pending and historical invitations sent by the organization or received by your account.
Credit transfer records when credits are sent between members of an organization. These records are stored in your transaction history and may be subject to the same retention schedules as other transaction data.
1.8 AI Assistant (Adam) and Background Check
The Service includes "Adam," an AI assistant, and a "Background Check" feature that generates a standardized open-source intelligence report about a subject you specify. When you use these features, we process:
Prompts and conversation content. The messages, instructions, and any files you send to Adam, and the identifiers you enter as a Background Check subject (such as a name, email address, phone number, or username), together with the responses and reports generated for you.
Automated queries to data sources. To fulfill a request, Adam and Background Check may run searches and transmit your query parameters (e.g., an email address, username, or phone number) to the same third-party data providers, intelligence APIs, and search indices described in Section 3.2, and may transmit prompt and file content to the AI and cloud analysis providers described in Section 3.2 to generate a response or report.
Adam conversations and generated reports are stored so you can access them in your workspace and are retained in line with Section 4 (Data Retention); you can delete them from your dashboard. Because these outputs are generated by large language models and automated sources, they may be inaccurate or incomplete, and the resulting report may contain personal data relating to the subject. You are responsible for how you use them, as described in our Terms of Service.
2. How We Use Your Information
We use your information exclusively for:
Operating and maintaining the Indicia platform
Securing the service against abuse, fraud, and attacks
Account authentication and user support
Internal analytics to improve functionality
We do not use your data for advertising, profiling, or marketing.
3. Data Sharing
3.1 We Do Not Sell Your Data
Indicia never sells, trades, rents, or monetizes your personal information.
3.2 Service Providers & Third-Party Processors
We share necessary data with trusted third-party vendors solely for the purpose of operating the platform. These include:
Infrastructure Providers: Cloud hosting, email delivery, and security/DDoS protection services.
Payment Processors: We share transaction data with payment gateways (specifically Square for fiat and Oxapay for cryptocurrency) to process payments and prevent fraud.
Fiat: For credit card transactions, we do not store full card numbers; they are handled directly by Square.
Cryptocurrency: If you pay via crypto, we and our processor (Oxapay) collect and store the transaction hash, sending wallet address, and amount to verify the purchase. You acknowledge that these transaction details are public on the blockchain.
In the event of a dispute or chargeback, we may share user access logs and history with these processors to validate the transaction.
AI & Cloud Analysis Providers: We transmit content to enterprise-grade Large Language Models (LLMs) and analysis tools hosted by major cloud computing providers. We select these vendors based on their security standards and data protection policies. As noted in Section 1.3, we act as an intermediary; the content is processed by these providers to generate results.
Facial Similarity Search Provider: For the reverse face search feature, we transmit your uploaded image to a third-party facial similarity search provider. Indicia acts as a facilitator for this service. Data handling practices for this provider are described in Section 1.4.
Geolocation Analysis Provider: For the geolocation feature, we transmit your uploaded image to a third-party AI analysis provider. Indicia acts as a facilitator for this service. The provider processes your image solely to generate the requested geolocation result.
Disputes & Chargebacks: In the event of fraud, abuse, or unpaid fees, we may share relevant account information with legal counsel or payment processors to resolve the matter.
Data Aggregators & Intelligence APIs: To fulfill specific search queries (such as breach checks, deep web searches, or social media lookups), we transmit your query parameters (e.g., an email address, username, or phone number) to specialized third-party data providers and search indices.
3.3 Business Transfers
In the event of a merger, acquisition, bankruptcy, or sale of assets, user information may be transferred to the acquiring entity as part of the transaction.
3.4 Law Enforcement Requests
We share data with law enforcement when required by valid legal process (e.g., subpoenas), or when we believe in good faith that disclosure is necessary to prevent illegal activity, fraud, or imminent harm.
4. Data Retention
Full account deletions (including your search history) may take up to 30 days to process.
Some records (such as logs required for security, compliance, or investigations) may be retained for up to 18 months (or longer only if required by an active legal hold or investigation), even after account deletion.
Referral payout records are financial records. Because we are required to keep financial and tax records, records of referral payout requests and the payouts we issue are retained for up to 7 years from the date of the transaction, even after account deletion.
As stated in Section 1.3, we do not retain uploaded images or user content. These are processed in memory and discarded immediately after the result is generated.
When you delete a Case, the associated title and description are immediately and permanently removed from our active servers. Please note that deleting a Case does not automatically delete the individual activity logs that were grouped within it; those logs are retained as part of your account history until your account deletion has been fully processed (which may take up to 30 days, or longer only if required by an active legal hold or investigation).
When an organization is deleted, the organization record, member list, pending invitations, and audit log are permanently removed from our active servers at the time of deletion. Cases that were shared with the organization revert to personal cases owned by their original creator; they are not automatically deleted.
When you leave an organization, your membership record is deleted. Cases you had shared with that organization remain associated with the organization (subject to the organization owner's management) unless you separately unshare or delete them.
For data retention schedules specific to the reverse face search feature (including how uploaded images and search results are handled by our third-party provider), please refer to Section 1.4 and the third-party provider's privacy policy linked therein.
5. Data Security
We use industry-standard security measures to protect your data, including:
Password hashing
Encrypted connections (HTTPS)
Access control and monitoring
Secure server infrastructure and logging
In the event that any information under our control is compromised as a result of a breach of security, we will take reasonable steps to investigate the situation and, where appropriate, notify those individuals whose information may have been compromised and take other steps, in accordance with any applicable laws and regulations.
No system is ever 100% secure, but we make every reasonable effort to keep your information safe.
6. Cookies
We use strictly necessary cookies for security (e.g., Cloudflare) and authentication. We also use performance/analytics cookies to improve the platform. You may adjust your browser settings to refuse analytics cookies, though this may affect service performance.
7. Data Storage Location
Indicia is operated from:
- Fairfax County, Virginia, USA
Our primary server infrastructure is hosted in:
- Beauharnois, Quebec, CA
Our secondary server infrastructure & database is hosted in:
- Ashburn, Virginia, USA
Please note that our third-party service providers (mentioned in Section 3.2) may process data in other secure facilities within the United States or globally depending on their network topology.
For users located in the European Economic Area (EEA), United Kingdom, or Switzerland, data transfers to the United States are conducted under the European Commission's Standard Contractual Clauses (SCCs) or other valid transfer mechanisms. Our third-party processors are required to implement appropriate safeguards consistent with GDPR requirements.
8. Your Rights
Depending on your jurisdiction, you may have rights such as:
Accessing your data
Requesting corrections
Requesting deletion (processed within up to 30 days)
Do Not Track Signals: Your browser settings may allow you to automatically transmit a "Do Not Track" signal to online services you visit. Note that, like many other services, Indicia does not currently alter its practices when it receives a "Do Not Track" signal from a visitor's browser.
If you are located in the EEA, UK, or Switzerland, you may also object to certain processing activities, request restriction of processing, or request portability of your data under applicable law.
We respond to all privacy-related requests within the time periods required under applicable law. To exercise these rights, contact us at the email below.
9. Children's Privacy
Indicia does not knowingly collect or solicit personal information from anyone under the age of 18. If you are under 18, please do not use the Service or send any personal information to us. If we learn that we have collected personal information from a child under 18, we will delete that information as quickly as possible.
Reverse Face Search and Minors: The reverse face search feature is strictly prohibited from use in connection with any individual under the age of 18. This prohibition applies regardless of the purpose of the search, who submitted the image, or any claimed consent from the minor or their guardian. Violation of this restriction may result in feature restriction or permanent termination of the offending account on the Indicia platform, and may be reported to relevant authorities including law enforcement.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date. Continued use of Indicia after updates means you accept the revised policy.
11. Contact Us
For privacy questions or requests, reach us here: