Privacy policy

1. What we collect

When you use The Graveyard, we collect only the necessary information to provide the marketplace and collaboration services:

• Account data: Email address, public username, profile avatar, short bio, and optional connected GitHub username.
• Listing content: Codebase titles, taglines, technical descriptions, tech stacks, licenses, and files you upload (e.g. source code archives or screenshots).
• Transaction records: Order IDs, amounts, timestamps, and delivery statuses. All payments are strictly executed in Razorpay Test Mode. We never process or store real credit card numbers or banking data.
• Encrypted communications: Direct transmission messages and collaboration pitches exchanged between creators and buyers on the platform.
• Technical telemetry: IP addresses, browser types, and access timestamps recorded in standard hosting and reverse-proxy logs.

2. Why we use your data

We process collected data exclusively to maintain platform integrity and functionality:

• To authenticate your session and protect account access.
• To deliver source code downloads and dispatch GitHub repository collaborator invitations.
• To notify sellers of purchase transactions and incoming co-founder pitches.
• To prevent abuse, spam, malware uploads, or unauthorized access.

3. Cookies and analytics

We believe in minimal, honest data tracking:

• Essential cookies: Used strictly for secure authentication session tokens (via Supabase Auth). These are necessary for user login.
• Cookieless analytics: We use privacy-friendly Vercel Web Analytics and Speed Insights. They do not store persistent tracking cookies, fingerprint devices across sites, or collect personal identifying information (PII).
• Opt-out options: You can opt out of analytics at any time via the consent notice or our Cookie Settings dialog. We automatically respect Do Not Track (DNT: 1) and Global Privacy Control headers.

4. Third-party service providers

We rely on trusted infrastructure partners to host and operate the platform:

• Supabase: Managed PostgreSQL database, authentication, and encrypted asset storage.
• Vercel: Edge hosting, serverless functions, and performance telemetry.
• Razorpay: Payment simulation gateway in Test Mode only.
• GitHub API: Automating repository collaborator invitations upon code acquisition.
• Google OAuth: Optional one-click federated sign-in.

5. Data retention

Your account profile, listings, and transaction histories remain active while your account exists. If you choose to delete your account or specific listings, uploaded archives and records will be removed from active indexes in accordance with retention schedules.

6. Your privacy rights

You have the right to request access to your personal data, rectify incorrect information, or delete your account. You can permanently delete and anonymize your account at any time directly via self-service in Console > Settings > Danger zone. This immediately anonymizes your public profile, archives all active code listings, and revokes login access, while preserving purchase records so buyers retain their purchased downloads. You may also contact us at our GitHub repository.

7. Children's privacy

The Graveyard is designed for developers and adults over the age of 18. We do not knowingly solicit or collect personal information from minors.

8. Security measures

We implement realistic, defense-in-depth technical controls:

• All web traffic is enforced over HTTPS (TLS encryption in transit).
• PostgreSQL Row Level Security (RLS) ensures that private delivery coordinates, repository links, and archives can only be retrieved by verified buyers and sellers.
• Source code archives are distributed via short-lived, signed storage URLs with expiration limits.

Note: We do not claim external SOC-2, ISO, or military-grade certifications. Please exercise customary caution when sharing proprietary code.

9. Changes to this policy

We may update this policy periodically to reflect platform enhancements or regulatory changes. The "Last updated" date at the top of this document indicates the effective revision.