Privacy policy

The Solo Market, operated from Portugal, is the data controller for the information described here. Full legal entity details will be listed before the public launch. To reach us about your data, use the contact form.

Account. Your email address, a display name, and a password. The password is handled by Firebase Authentication and hashed — we never see it.

If you sell. The contents of your listing: title, description, screenshots, demo video, your uploaded package, and the support email, bio and website you choose to publish. Bear in mind a listing is public — only put in it what you want the world to read.

If you buy. A record of what you bought and when, so you can re-download it. Card details go straight to Stripe; they never touch our servers.

If you write to us. Whatever you put in the contact form, including the email address you give us so we can reply.

If you join the launch list. Just your email address, kept until we email you at launch or you ask us to remove it, whichever comes first. We send one message, we don't add you to anything else, and we never pass it on. Reply to that email, or use the contact form, to be taken off the list.

On your own device. Your cart and saved items are kept in your browser's local storage, not on our servers. Clearing your browser data clears them.

No analytics or product-tracking scripts. No advertising or marketing cookies. No third-party trackers. We do not build a profile of you, and we do not sell or rent your data to anyone, ever.

The tools sold here run on your own computer. We have no visibility into what you do with them or what data you put through them.

To perform our contract with you: running your account, delivering what you bought, paying sellers. To meet legal obligations: tax and accounting records, and seller reporting under DAC7. And on legitimate interest: keeping the marketplace safe from fraud and abuse.

The launch list is different: that one runs on your consent, given by entering your address, and you can withdraw it at any time.

We use a small number of established providers, each only for what it says here:

• Google Firebase — authentication, database and file storage.
• Stripe— payments and seller payouts. Stripe collects sellers' identity and bank details directly, under its own privacy policy.
• Resend — transactional email (receipts, review decisions, sale notices).
• Vercel — hosting.
• Google Sheets — where contact-form messages land so we can answer them.

Some of these process data outside the EU. Where that happens it is covered by the European Commission's standard contractual clauses.

Account data for as long as your account exists. Purchase and payout records for as long as tax and accounting law requires, which is longer. Contact-form messages until the conversation is finished and we have no reason to keep them.

Under the GDPR you can ask for a copy of your data, correct it, have it deleted, restrict or object to how we use it, and take it elsewhere. Ask through the contact form and we will respond within one month.

You can delete your account yourself from account settings. Records we are legally required to keep — sales, payouts, invoices — survive that deletion, and so do listings other people have already bought, so those buyers keep access to what they paid for.

If you think we have handled your data badly, you can complain to your national data protection authority. In Portugal that is the CNPD.

If this policy changes in a way that matters, we will email account holders before it takes effect rather than quietly editing the page.