Privacy Policy

This policy explains how Launchstock ("we", "us") handles personal information for the marketplace at launchstock.app, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

• Account details — name, email address, password (stored only as a salted hash), optional avatar and, for sellers, business/display information you choose to publish.
• Two-factor secrets — if you enable 2FA, the TOTP secret needed to verify your codes.
• Transactions — what you bought or sold, when, for how much, licence snapshots, invoices, refund requests and their outcomes. We never receive your card number: payment details go directly from your browser to Stripe.
• Content you write — reviews, buyer–seller messages, support tickets, listing content.
• Technical data — IP address and basic request logs used for security (rate limiting, abuse prevention) and operations. We do not run advertising trackers or sell data.

To operate accounts and deliver purchases; to process payments and payouts; to moderate the marketplace (listing review, fraud and abuse prevention, off-platform-payment detection in messages); to resolve refunds and disputes; to send transactional email (order confirmations, delivery, ticket updates) and, only where you've opted in through notification settings, product updates; and to meet legal obligations such as tax record-keeping.

Launchstock runs on infrastructure supplied by these processors:

• Supabase — our database, hosted in the AWS Sydney region (Australia).
• Vercel — application hosting; our compute runs in Sydney, though Vercel is a US company and some routing and log data may be processed overseas.
• Stripe — payment processing (a US company with Australian operations). Stripe holds your payment details under its own privacy policy.

Where data leaves Australia through these providers, we rely on their contractual and security commitments consistent with APP 8.

Passwords are hashed, download links are short-lived signed tokens, admin actions are audit-logged, uploads are scanned for disallowed file types, and access to production data is limited to what operating the platform requires. No system is perfectly secure, but if a data breach is likely to result in serious harm we will notify you and the OAIC as required by the Notifiable Data Breaches scheme.

Your reviews appear with your display name. If you're a seller, your seller profile and listings are public. Buyer–seller messages are visible to the two parties and, where flagged by moderation or attached to a dispute, to Launchstock staff.

Account data is kept while your account is active. Transaction records are kept for at least five years to meet Australian tax record-keeping requirements, even if you close your account. Messages and support tickets are kept while relevant to an active account or open dispute.

You can access and correct your details in account settings. You can also ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account (we'll delete or de-identify what we're not legally required to keep). Contact us through the support centre for any of these.

If you believe we've mishandled your information and we haven't resolved your complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

We use only the cookies needed to run the site: a session cookie that keeps you signed in and a CSRF token that protects forms. There are no third-party advertising or analytics cookies.

If we change this policy in a way that matters — new processors, new data types, new uses — we'll notify account holders by email or in-app notice before the change takes effect.