Privacy Policy

We collect the following categories of data:

• Account data, such as your email address, display name, handle, and password (stored only as a secure hash, never in plain text).
• Listings, the tools, files, descriptions, and media that sellers publish.
• Orders, the purchases, licenses, and download records tied to your account.
• Commissions and messages, the requests you post (including the brief and the email you use to claim a request created before you signed in), the quotes you send or receive, the deal records tied to a funded build (scope, amount, delivery, and status), and the messages you exchange with the other party. Messages are scanned for off-platform-payment solicitation so we can warn both sides; a flagged message is recorded as flagged.
• Uploaded media and files, the images, preview media, and files you upload to a listing, profile, or post. Paid files are watermarked per buyer on download.
• Connected GitHub data, if you sign in with GitHub or connect a repository: your public GitHub profile details (such as your login, public repo counts, stars, and languages) and, for a connected repository, the repo contents you choose to sell through Toolbay.
• Reports, the abuse reports you submit (what you reported and any detail you add), used to review and act on prohibited conduct.
• Usage data, such as the pages you view and the actions you take, which help us keep the marketplace secure and improve it.
• Technical data, such as your IP address and basic device and browser information. We use it to keep you signed in, apply rate limits, detect abuse, and diagnose errors. Your IP address is personal data, and we treat it that way.

We use cookies to keep you signed in and to remember a few preferences. Your session cookie carries a token that authenticates your account; we store only a hashed form of it on our servers.

We also set attribution cookies that remember where a visit came from — a referral code from a referral link, and a UTM source from a tagged link (for example, a link in a social post). We use these to credit referrals and to understand which channels bring people to Toolbay, and we carry the source onto the signup event. If you decline non-essential cookies, we do not set the attribution cookies.

Some flows use short-lived, single-use tokens rather than tracking cookies: a magic sign-in link carries a one-time token that signs you in (and, for a request you started before signing in, claims and publishes it), and it expires after use or after a short time.

We also set an anonymous visitor identifier and use PostHog, a product-analytics service, to understand how people move through the marketplace (for example, viewing a listing and starting a checkout) so we can improve it. This is measurement of our own product. We do not use cookies to sell your data or to build cross-site advertising profiles. Where the law requires consent for non-essential cookies, we will ask for it before setting them.

Payments are processed by Stripe. When you pay, your card details are collected and handled directly by Stripe under their own security and compliance standards. Toolbay does not store your full card numbers. We retain only the order and payment metadata we need to issue licenses, provide receipts, and respond to billing inquiries.

We send transactional email, such as receipts, license details, and account notices, through Resend. We share only the information needed to deliver those messages, such as your email address and the relevant order details. We do not sell your email address.

To run the marketplace we share limited data with the service providers below, only as needed to deliver the service. They act as our processors, under contract, and are not permitted to use your data for their own purposes.

• Stripe — payment processing and, for sellers, payouts.
• Resend — transactional and account email.
• PostHog — product analytics.
• Sentry — error monitoring, which may include your IP address and request details when an error occurs.
• Vercel — application hosting and file storage.
• Neon — our database.
• Upstash — rate limiting and abuse prevention.
• GitHub and Google — only if you choose to sign in with them or connect a repository.
• Anthropic — only when you use our AI setup assistant, which sends the text you enter to generate a response.

Toolbay is operated from the United States and these providers may process your data in the United States and other countries. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards, such as the providers' standard contractual clauses.

Your data is encrypted in transit and at rest. We apply access controls, hashing for credentials and session tokens, and audit logging for sensitive actions. No system is perfectly secure, but we work to protect your data with current, industry-standard practices.

Toolbay is built to be GDPR-ready. You have the right to access the personal data we hold about you, to correct it, and to request that we delete it. You can also export your account data. To exercise any of these rights, contact us using the address below and we will respond within the timeframes required by applicable law.

We do not sell your personal data. We share data only with the service providers needed to operate the marketplace, such as our payment processor and email provider, and only to the extent needed to deliver the service, or where we are required to by law.

We keep your data for as long as your account is active and as needed to provide the marketplace, comply with our legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date above and, where appropriate, notify you.