Privacy Policy

This policy explains what information Moatless (operated by WeBuilt LLC) collects, how it's used, and the choices you have.

Information we collect

Account information. Your email address, and your handle if you set one. If you sign in with GitHub, we receive your GitHub user ID, username, and email address, along with a token that lets us act on your behalf. We store that token encrypted, and use it only to check which of your GitHub App installations you can connect.

Repositories. If you sell on Moatless, we fetch the code of the repositories you connect when you publish a release, and store each release so buyers can download it.

Downloads. When you download code you've bought or claimed, we record when you downloaded it, which release, your IP address, and the git client you used. We keep this as proof that you received what you paid for, and may share it with our payment processor if a payment is disputed.

Purchases and payouts. Records of what you've bought or sold, and the status of your subscriptions. Payment details, such as card numbers, are collected and stored by Stripe, not by us. Sellers provide identity and bank details directly to Stripe to receive payouts.

Images and listing content. Descriptions, release notes, and images you add to your listings.

Usage information. Server logs, including IP addresses and the pages and repositories requested, which we use to operate and secure the service.

Visit statistics. We count visits with Plausible Analytics, which doesn't use cookies or store IP addresses or other personal information. It records the pages viewed, the site that referred you, and your browser, operating system, device type, and country, and reports them to us only in aggregate.

Product analytics. We use PostHog to understand how people use Moatless and to find problems with it. We ask before PostHog uses cookies, except when you arrive from one of our ads, when PostHog uses them straight away; you can turn them off with the cookie settings link at the bottom of any page. If you accept, PostHog records the pages you visit and what you click, your browser and device, and your IP address, which it uses to estimate your location. It may also record your session, so we can see how pages looked and behaved for you. Session recordings don't include anything you type into forms, or API keys. When you're signed in, this activity is linked to your account, including your user ID, email address, and handle. If you decline, PostHog only counts your visits, without cookies and without linking them to you. Separately, our servers send PostHog records of things you do on Moatless, such as signing up, creating or publishing a listing, publishing a release, making a purchase, or making a sale, linked to your user ID and your handle (which is public), along with reports of errors in our service. When you first open Moatless, we also note where you came from: the website that linked to us, and the campaign tags on the link, if it had them (an ad's, for example). If you sign up, we keep that with your account and send it to PostHog, so we can tell which ads and websites bring people to Moatless.

How we use information

• To provide the service: signing you in, delivering code you've bought, building releases, and processing payments and payouts.
• To send messages you need, such as sign-in links and purchase receipts.
• To understand how Moatless is used, and to fix and improve it.
• To keep the service secure, prevent fraud, and enforce our Terms of Service.
• To comply with legal obligations, such as tax and accounting requirements.

We don't sell your personal information, and we don't use advertising trackers.

Service providers

We share information with companies that help us run Moatless, only as needed for them to provide their services:

• Stripe, for payments, subscriptions, and seller payouts
• GitHub, for signing in and connecting repositories
• Resend, for sending email
• Fly.io, for hosting
• Tigris, for file storage
• Plausible Analytics, for counting visits, without cookies or personal information
• PostHog, for product analytics, session recordings, and error reports

We may also disclose information if required by law, or to protect the rights and safety of our users and the service.

Sellers

Sellers are told when one of their codebases is bought, but not who bought it. If you choose to share your handle and email with a seller when you buy or claim their codebase, we show them to that seller, in their sales list and in the email telling them about the sale. You can stop sharing them at any time from your Library, though we can't take back an email that was already sent.

Cookies

We use a cookie to keep you signed in. If you accept cookies, PostHog also stores an identifier in a cookie and in your browser's local storage, so it can recognize your browser across visits. We don't use advertising cookies.

Retention

We keep account and purchase records for as long as your account is open and as long as needed afterwards for legal, tax, and accounting purposes. Releases are kept so that buyers can continue to access code they've paid for.

Your choices

You can update your handle and revoke API keys in Settings. You can change your choice about cookies at any time from Cookie settings at the bottom of each page. To request a copy of your information, or to have your account and personal information deleted, email hello@moatless.store. Some records, such as completed transactions, may need to be kept for legal reasons.

Security

We encrypt sensitive information such as GitHub tokens, hash API keys, and serve the site over HTTPS. No system is perfectly secure, but we work to protect your information.

Children

Moatless is not intended for children under 16, and we don't knowingly collect information from them.

Changes

We may update this policy. If we make material changes, we'll update the date at the top of this page and, where appropriate, let you know by email.

Contact

Questions about privacy can be sent to hello@moatless.store.