Privacy Policy

Last updated: May 5, 2026

We keep this short. We don't sell your data. We collect what we need to run the platform and nothing more.

1. What we collect

Account information

Email address
Display name
Password (stored as a hash — we never see your actual password)
Avatar and bio (if you add them)
Website URL (if you add it)

Purchase and transaction data

What you bought, when, and at what price
Download history (which versions you downloaded and when)
For builders: earnings, payout requests, and bank account details you provide for transfers

Payment information

We do not store payment card details. All payment processing is handled by Stripe. We store the transaction record (amount, date, status) but not the card number, CVV, or billing address.

Usage data

Pages visited on bebrash.co
Search queries on the platform
Listing views and interactions
Browser type and operating system (standard server logs)
IP address

Content you create

Listings you publish (text, screenshots, zip packages)
Reviews you write
Messages sent through support

2. How we use it

Data	Why we use it
Account information	To create and manage your account, send you notifications
Purchase data	To give you access to your downloads and purchase history
Transaction data	To process payouts to builders, handle refunds, generate earnings reports
Payment data (via Stripe)	To complete purchases — handled by Stripe, not by us
Usage data	To understand how the platform is used and improve it
Content you create	To display listings, reviews, and builder profiles on the platform

We do not use your data for advertising. We do not sell your data to third parties.

3. Who we share data with

Service	Purpose	What they receive
Stripe	Payment processing	Transaction amounts, your email for receipts, builder bank details for payouts
Resend	Transactional email	Your email address and the content of emails we send you
OVH	Website hosting (self-hosted)	Standard request logs (IP, browser, pages visited)
VirusTotal	Malware scanning (builders only)	File hashes only (SHA-256/MD5) — no file content, no personal data

We do not share your data with any other third parties except when required by law.

4. Data retention

Data type	How long we keep it
Account data	While your account is active, plus 1 year after deletion
Purchase records	5 years (for accounting and dispute resolution)
Usage logs	90 days
Support communications	2 years
Uploaded packages	While the listing is live, plus 1 year after removal

5. Your rights

You have the right to:

Access: request a copy of the personal data we hold about you
Correction: ask us to fix inaccurate data
Deletion: ask us to delete your personal data (subject to retention requirements above)
Portability: receive your data in a structured, machine-readable format
Object: object to certain types of processing

To exercise any of these rights, email privacy@bebrash.co. We respond within 30 days.

If you are in the European Union, you have rights under the GDPR. Our lawful bases for processing: contract performance (account and purchase data), legitimate interests (usage data), legal obligation (transaction records).

6. Cookies

We use minimal cookies:

Session cookies: to keep you logged in (deleted when you close your browser)
Preference cookies: to remember your settings

We do not use advertising cookies or third-party tracking cookies.

7. Security

We use industry-standard security practices: passwords hashed with bcrypt, data in transit encrypted with TLS, database access restricted to application servers. No system is perfectly secure. If you discover a security vulnerability, report it to security@bebrash.co.

8. Children

Brash is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. Contact us at support@bebrash.co if you believe a child has created an account.

9. Changes

When we update this policy, we'll notify you by email and post the updated version on bebrash.co.

10. Contact

Privacy questions: privacy@bebrash.co

General support: support@bebrash.co