legal
Privacy policy
Last updated: October 27, 2026
TL;DR: free creator pages load no trackers and we don't count their visits. Paid pages (Creator and Pro) count visits as daily totals through Cloudflare Web Analytics (cookie-free) and count link taps server-side. If you submit a creator's email form, your details go to that creator — we store the list for them and never sell it. You can delete your account and data any time.
1. Who is responsible for your data
Suraj Pawar and Ashish Bhagat (co-owners) ("oddgecko", "we") operate oddgecko.com. This policy explains what personal data we collect, why, who sees it, how long we keep it, and what rights you have. It applies to creators (people with an account) and visitors of creator pages.
| Data | Who decides why it is used | Oddgecko's role |
|---|---|---|
| Creator account, billing status, security logs | oddgecko | Controller / data fiduciary |
| Audience data entered on a creator's form (name, email, phone) | The creator | Processor — stores and forwards on the creator's behalf |
| Instagram auto-DM data | The creator (their followers and messages) | Processor |
Privacy questions: privacy@oddgecko.com · AT Post Khanaput Taluka Junnar Dist Pune 410502.
Grievance Officer (India): Ashish Bhagat,
grievance@oddgecko.com.
2. What we collect
Creators
- Account: email, username, display name, avatar, password hash (never the password), Google account id if you sign in with Google, and the Terms version you accepted.
- Content you publish: pages, links, product cards (title, URL, price, image), uploaded images, themes, bios, and custom domain names when that feature is enabled.
- Login & security: sessions (stored as a hash), password-reset requests, rate-limit counters, and abuse reports about your content.
- Billing (Pro): plan, subscription status, billing period dates, and Dodo Payments customer/subscription ids. Card details are entered on Dodo's hosted checkout; we don't receive or store them.
- Analytics (Creator + Pro): per-day page views, outbound clicks per link, and aggregate breakdowns by referrer host, device type, and country. Daily totals only.
- Instagram auto-DM (if you connect): your Instagram user id and username, an access token stored to run the feature, your keyword rules and message templates, and a log of auto-DMs sent (to avoid repeats and honour STOP).
- Support/legal: copyright/abuse reports and our records of actions taken.
Visitors of creator pages
- Free pages: no analytics cookies, no fingerprinting, no visit counting. Normal infrastructure logs (see §6) exist at our hosting provider.
- Paid pages (Creator and Pro): visit counts from Cloudflare Web Analytics
(cookie-free), and link taps that pass through
/out/for counting. We store daily totals only. - Forms: if you choose to submit a creator's email form, the name, email and optional phone/WhatsApp number you enter.
- Third-party embeds (YouTube, Spotify, SoundCloud, etc.) may collect data directly from your browser; see §7.
We do not collect advertising profiles, cross-site tracking data, precise location, or contacts lists, and we do not sell personal data.
3. Why we use it
| Purpose | Data | Basis |
|---|---|---|
| Provide your account and pages | account, content | Contract |
| Host and serve images | uploads | Contract |
| Keep the Service secure, stop abuse, enforce rules | login/security data, reports | Legitimate interest / legal obligation |
| Process Pro payments and keep subscription status | billing ids and status | Contract; legal obligation |
| Analytics for Creator and Pro creators | aggregate daily counts | Contract |
| Store and export a creator's audience list | visitor form data | Visitor's consent to the creator; our contract with the creator |
| Instagram auto-DM | rules, logs | Contract; the creator's instructions |
| Respond to legal notices | reports, account info | Legal obligation / legitimate interest |
| Send service emails (reset links, billing and policy notices) | Contract | |
| Improve the Service | aggregated, non-identifying data | Legitimate interest |
We don't send marketing emails to a creator's audience; the creator does. We may send creators essential service messages and occasional product updates; you can opt out of non-essential updates.
4. What we share, and with whom
We don't sell personal data. We share it only with:
| Recipient | What | Why | Location |
|---|---|---|---|
| Cloudflare (Workers, D1, R2, cache, Email Routing, Web Analytics) | hosted data and traffic | hosting, security, delivery | global edge; data may be processed outside India |
| Dodo Payments | email/name, plan, payment details entered with them | payments, tax, receipts | their locations |
| Google account id/email on sign-in | login | global | |
| Resend | recipient email, message | send transactional emails | their locations |
| Meta (Instagram) | tokens and messages for auto-DM | the creator's chosen feature | global |
| Mailchimp / Kit | new audience signups | only if the creator connects them | their locations |
| Authorities | the minimum needed | to follow law, court orders, or protect people from serious harm | as required |
| A buyer or successor | data in a sale/merger | continuity, under this policy | as required |
Service providers may only use data to provide services to us. Their own privacy policies apply to what they do.
5. Visitor form data (audience lists)
When a creator adds a form, you decide whether to submit. What you enter is sent to that creator, who is responsible for how they use it. We store the list on their behalf and give them CSV export and optional Mailchimp/Kit forwarding. The creator must have a lawful reason to contact you and give you an easy way to stop. To unsubscribe or erase your data, first contact the creator (use the unsubscribe link in their emails). If you can't reach them, email privacy@oddgecko.com with your email and the page URL, and we'll help.
6. Cookies, logs and similar tech
- One session cookie keeps creators logged in (security-related, needed for the Service).
- No advertising cookies from us. Free pages set no analytics cookies.
- Cloudflare Web Analytics (Creator and Pro pages) is cookie-free and doesn't fingerprint visitors.
- Infrastructure logs. Our hosting provider (Cloudflare) processes IP addresses and request details to deliver pages and defend against attacks. We use short-lived rate-limit counters to stop abuse; we don't build visitor profiles from them.
- No creator-added tracking pixels today. oddgecko does not inject third-party advertising or analytics pixels into creator pages. If that changes, we will update this policy and the Creator Terms first.
7. Embeds and outbound links
Pages may embed YouTube, Spotify, SoundCloud and similar players. Those
providers may collect data when the embed loads. Links to shops and
affiliate programs lead to sites we don't control. Clicks on Creator/Pro pages go
through /out/ so the creator can count them; we store counts,
not who clicked.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account and content | until you delete the account (then removed, except as below) |
| Audience signups | until the creator deletes the page/account or removes them |
| Analytics daily totals | 90 days (auto-deleted) |
| Sessions | until they expire (expired ones swept nightly) |
| Password-reset counters | 7 days, then swept |
| Billing ids/status and payment records | for as long as the account exists and as the law requires for tax/accounting |
| Copyright/abuse reports and actions | up to 3 years (legal defence and repeat-infringer records) |
| Backups | only as long as needed for disaster recovery, encrypted where possible |
| Evidence needed for legal duties (e.g. child-safety reports) | as required by law |
9. Deleting your data
Creators: delete your account in the dashboard (Settings → danger zone). Active Pro subscriptions are cancelled first; if cancellation fails, deletion is blocked so you aren't charged for a deleted account. Then pages, audience signups, images and stats are removed, you're signed out everywhere, and your username is released and can be claimed by someone else. Visitors: see §5.
10. Your rights
Depending on where you live (including India's DPDP Act and, for people in the EEA/UK, GDPR), you can ask to:
- access the personal data we hold about you and get a copy;
- correct or update it;
- erase it;
- withdraw consent you gave (this doesn't undo earlier lawful use);
- object to or restrict some uses (where the law gives that right);
- get a portable copy (creators can export audience lists as CSV);
- nominate someone to act for you (India);
- complain to us, and then to the regulator (the Data Protection Board of India, or your local authority).
Email privacy@oddgecko.com. We'll confirm within 72 hours and respond within 30 days (sooner where the law needs). We may ask you to prove who you are. Some data we must keep by law.
11. Security
HTTPS everywhere; salted and hashed passwords; hashed session tokens; access limited to authorised operators; separate storage of payment data (with the payment provider); rate limiting. No service is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.
12. International transfers
We use global infrastructure. Your data may be processed outside India or your country by Cloudflare and other providers listed in §4. We choose providers with reasonable safeguards, and for transfers from the EEA/UK we rely on contracts/mechanisms such as standard clauses where required.
13. Children
oddgecko is for adults (18+) and not directed to children. We don't knowingly collect children's data. If you think a child has an account or has submitted a form, email privacy@oddgecko.com and we'll delete it. Creators must not use forms to collect data from children.
14. India DPDP Act
The Digital Personal Data Protection Rules, 2025 were notified in November 2025; most operational duties (notice, consent, retention, rights, breach reporting, children's data) apply from mid-May 2027. We're building to that. When fully in force we will show a specific notice at each collection point, keep a rights-request log, and publish contact details for questions.
15. Changes
If we change this policy in a meaningful way we'll update the date and notify creators by email or in the dashboard before it takes effect.
16. Contact
privacy@oddgecko.com · AT Post Khanaput Taluka Junnar Dist Pune 410502 · Grievance Officer: Ashish Bhagat, grievance@oddgecko.com (acknowledgment within 24 hours, resolution within 15 days).