Early marketplace beta

Data and privacy

This page explains the current free marketplace flow. Do not submit sensitive records or information that a creator has not explicitly agreed to handle.

Information you provide

Accounts use an email address, display name, optional profile bio and website. Listings contain creator-provided descriptions, compatibility, setup, limitations, usage terms and public links. Reviews contain your score, experience, declared version and any reply. Saved items, creator follows and your free Library are private to your account. We record accepted version licenses and download authorizations. Following does not share your email with the creator.

Who can see it

Display names, profiles, approved public listings and their published reviews can be viewed by anyone. Private listings are available to their owner, administrators and people with a current share link after publication. Reports and moderation notes are restricted to the relevant administrative or creator view; they are not public review content.

A buyer request contains a name, email address, intended use and optional organization, timeline and message. The creator sees these details only after the buyer confirms the email link and consent. Anyone holding the private request-status link can view that request, so keep it private.

Hosting, email and security records

Cloudflare hosts the application and its D1 database. The hosting service processes network request information. Cloudflare Email Service sends account and request notices for this controlled test, including private verification links, only to approved verified destinations. The recipient list is not public.

Essential HttpOnly cookies support sign-in and form protection. The application stores hashes of session and request tokens, and bounded audit events and rate-limit keys for security and moderation. The application does not add advertising trackers. Provider acceptance of an email is not proof of inbox delivery.

Deletion and retention

You can delete your account after a fresh sign-in. This removes the profile, owned listings, reviews, saved items, follows, free Library access, and requests or reports tied to the account email. Previously released packages may remain available to existing owners with creator profile attribution removed. Existing delivered emails cannot be recalled. Restricted operational audit records may remain, without copying private contact details or free-form moderation messages into their metadata.

The maintenance implementation makes expired or consumed sign-in challenges and expired, idle or revoked sessions eligible for cleanup after 24 hours, free download authorizations 24 hours after expiry, and completed email jobs after seven days. Cleanup is batched, so these are eligibility periods rather than guaranteed deletion deadlines. Marketplace requests, reports and remaining audit history have no automatic age-based deletion in this beta. Production backup-retention and broader retention arrangements still require operational review.

Keep submissions limited

Do not provide passwords, API keys, private prompts, source packages, customer datasets or regulated records. Use the report forms on listings and reviews for concerns about marketplace content. This beta information is not a claim of completed legal or regulatory review.