Privacy policy

Account information

Your name, email address, and a hash of your password. Optionally a phone number, country, city, state, postcode and an avatar, where you choose to add them. If you sign in with Google we receive your Google account identifier, email address, name and profile picture from Google, and nothing else.

Seller information

If you sell here: your store name, bio and website, plus the payout details you give us. For bank payouts that is your bank name, account name and account number. For crypto payouts it is the wallet address you provide. We also hold your earnings, level and payout history.

Transaction information

What you bought, when, the price, the licence issued, purchase codes, refunds, and your wallet balance. For sellers, your sales, commission rate at the time of each sale, and payouts.

Technical information

We record the IP address and browser user agent of your last sign-in and your last activity, and the time of both. This exists for security: spotting account takeover, investigating fraud, and answering "was that me?" when you ask.

Things you write

Comments, reviews, support tickets and messages to sellers, including anything you choose to put in them.

• Card numbers, CVVs or bank credentials. These go directly to the payment processor and never reach our servers
• Advertising or cross-site tracking data. We run no advertising trackers
• Analytics profiles of your browsing. There is no third party analytics script on this site
• Anything from your server or the projects you build with items you buy

• To run your account and let you sign in
• To deliver what you bought, issue licences and serve downloads
• To take payment and to pay sellers
• To provide support, and to route your request to the right seller
• To keep the platform secure, detect fraud and investigate abuse
• To send necessary emails about your account, purchases and security
• To meet legal and accounting obligations

Where the law requires a legal basis, we rely on performance of our contract with you for most of the above, on our legitimate interests in running and securing the platform, on your consent for anything optional such as marketing email, and on legal obligation where we must keep records.

Payments are handled by third party processors, currently Paystack, Flutterwave and NOWPayments depending on the method you choose. When you pay, your payment details go to that processor directly.

We receive confirmation of the result, an amount, and a reference. We do not receive or store your full card number. Each processor handles your data under its own privacy policy, and we recommend reading the one that applies to the method you use.

Deliberately very little. A seller supporting you sees:

• Your display name, which is your first name and last initial
• Which item you bought and which licence tier you hold
• Your support status
• What you write in a support request or a comment

• Your email address
• Your postal address or phone number
• Your payment details
• Anything else you have bought on the platform

Sellers are contractually required to use what they do see only to support that purchase, and may not use it for marketing or pass it on. See the seller terms.

Reviews and comments are public and show your display name. Do not put anything in one you would not want public.

We share personal data only where it is necessary:

• Payment processors, to take payment and send payouts
• Service providers who host our infrastructure and send our email, acting on our instructions
• Domzivo, where your account is shared across the group, for example a wallet payout
• Law enforcement or regulators, where we are legally required, or where necessary to investigate fraud
• A buyer of the business, if we are ever sold or reorganised, under the same obligations

We do not sell your personal data. We do not share it with advertisers or data brokers.

We use a small number of cookies, all of them necessary to run the site:

• A session cookie that keeps you signed in and lets your session be refreshed securely
• auth_status, which tells the site whether to draw the signed-in header, so the page does not flicker on load
• vendor_status, which tells the site whether to offer the seller dashboard

We also keep your sign-in token in your browser's local storage so you stay signed in between visits. Signing out clears it.

There are no advertising cookies and no third party tracking cookies on this site. If that ever changes we will say so here and ask for consent where required.

• Account data: while your account is open, and for a period afterwards to handle disputes and meet obligations
• Transaction and licence records: kept for as long as legally required for accounting and tax, typically several years. These are also what let us honour permanent downloads
• Security logs such as sign-in IP and user agent: a limited period, then deleted
• Support tickets: long enough to handle a recurring issue and any dispute
• Public comments and reviews: until removed by you or by us

You can ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything inaccurate, much of which you can edit yourself in your account
• Delete your account and personal data
• Export your data in a portable form
• Stop sending you marketing email, which you can also do from any such email
• Object to or restrict certain processing

Ask through a support ticket from the account concerned. We respond within a month, and will tell you if we need longer.

Passwords are stored hashed, never in plain text, and nobody here can read yours. Two factor authentication is available on your account and we recommend turning it on. Traffic to the site is encrypted in transit.

Seller API keys are stored hashed, which is why a key's secret is shown once at creation and never again.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will tell you and the relevant authority where the law requires it.

Keep your own side secure: use a unique password, turn on two factor, and tell us promptly if you think someone else has accessed your account.

We operate from Nigeria and use service providers that may store or process data in other countries. Where data moves across borders we take reasonable steps to see that it remains protected to a comparable standard.

OurCodeMarket is not for children. You must be at least 18, or the age of majority where you live, to hold an account. We do not knowingly collect data from children, and will delete it if we find we have.

We may update this policy. The date at the top of this page shows when it last changed, and material changes will be announced on the blog. Where a change would require your consent, we will ask for it rather than assume it.

Privacy questions and requests about your data should go through a support ticket from the account concerned, which lets us verify the request is genuinely yours before we act on it.

If you are unhappy with how we have handled a request, you may have the right to complain to a data protection authority where you live.

For questions about this policy, or to report something that breaches it: