The October 1 Index · Privacy Policy
Privacy Policy
Effective September 10, 2026. Applies to index.statusbird.io and to the Exposure Report and Portfolio Sweep services, operated by StatusBird LLC, 5227 N 7th St STE 77491, Phoenix, AZ 85014 ("StatusBird", "we", "us"). This service is separate from the StatusBird monitoring application, which has its own privacy policy at statusbird.io/privacy.
1. What this service does with data
The October 1 Index is a research service. It fetches the public homepages of online storefronts from the outside, records which third-party scripts each page loads, and publishes aggregate counts by app vendor. It collects no personal data from the storefronts it observes: no customer records, no order data, no account information. Where a storefront's public page contains personal data (for example a founder's name on an about page), we do not extract or store it.
2. Data we collect from visitors and customers
2.1 The free store check
When you submit a domain to the store check, we fetch that storefront's public homepage once and show you the result. We keep, for up to one hour, a count of checks per visitor IP address to enforce the limit of five checks per hour. We do not store the domain you entered, the result, or your IP address beyond that hour.
2.2 Analytics
We use Plausible Analytics, a privacy-focused service that sets no cookies and collects no personal identifiers. It records page views and, for record documents, the fact that a document was opened, identified only by the document's random token. Plausible processes visitor IP addresses transiently to derive country and to de-duplicate visits within a day, and does not store them. See plausible.io/data-policy.
2.3 Orders
When you buy an Exposure Report or a Portfolio Sweep, payment is processed by Stripe. We receive from Stripe your name, email address, billing country, the domain you entered on the checkout form, and a payment reference. We never receive or store card numbers. Stripe's privacy policy is at stripe.com/privacy.
2.4 Deliverables and evidence
For each paid order we generate a report and a JSON evidence file describing what the named storefront loaded on the date of the check. These describe the storefront, not you, and are retained so that a report can be re-issued and its hash verified. Continuous-detection re-checks for report buyers run weekly for 30 days after delivery and are retained on the same basis.
2.5 Email
Order confirmations, deliveries and re-check alerts are sent through SendGrid to the address on the order. If you email index@statusbird.io, we keep the correspondence for as long as needed to handle it. Outreach email we send to agencies and vendors goes to publicly listed business addresses; every such message carries an unsubscribe instruction and we honour it immediately.
2.6 Server logs
Our web server keeps standard access logs (IP address, requested URL, user agent, timestamp) for 14 days for security and troubleshooting, then deletes them.
3. Why we process this data and on what basis
- To deliver what you bought and to keep a verifiable record of it: performance of a contract.
- To run the free check and stop abuse of it: our legitimate interest in operating the service.
- To measure how the site is used, without identifying anyone: legitimate interest, using cookieless analytics.
- To contact agencies and vendors about findings that concern their own work: legitimate interest, with a one-step opt-out.
4. Who we share data with
Only with service providers that process it on our behalf: Stripe (payments), SendGrid by Twilio (email delivery), Google Cloud (hosting, United States), and Plausible (analytics, European Union). We do not sell personal data and we do not share it for cross-context behavioural advertising. Aggregate index data, which contains no personal data, is published and may be licensed to third parties; it is never sold to plaintiffs' law firms.
5. Retention
- Free-check rate limit counters: one hour.
- Server logs: 14 days.
- Order records, reports and evidence files: three years from the order date, the period a buyer may need to rely on a dated record, unless you ask us to delete them sooner and no legal obligation prevents it.
- Correspondence: as long as needed to handle it, then up to two years.
6. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy of it, restrict or object to its processing, and withdraw consent where processing is based on consent. Residents of California and other US states with comprehensive privacy laws may exercise these rights, and may appeal a decision, by emailing index@statusbird.io; we will respond within 45 days and never discriminate for exercising a right. Residents of the European Economic Area and the United Kingdom may also lodge a complaint with their supervisory authority. We do not knowingly collect personal data from anyone under 16 and the service is not directed at them.
7. International transfers
We are located in the United States and process data there. Where data is transferred from the EEA or UK, our providers rely on standard contractual clauses or an adequacy decision, as applicable.
8. Security
Data in transit is encrypted with TLS. Payment data is handled entirely by Stripe. Access to order records and evidence files is limited to StatusBird LLC personnel who need it to deliver the service.
9. Changes
We will post any change to this policy on this page with a new effective date. Material changes affecting order data will also be emailed to customers with open orders.
10. Contact
StatusBird LLC, 5227 N 7th St STE 77491, Phoenix, AZ 85014. index@statusbird.io.