Trust depends on knowing where information goes.

This notice explains the limited information NORA needs to operate a curated software marketplace and how private releases are protected.

What NORA collects

We collect account details supplied through authentication, product-record information supplied by creators, acquisition-request details supplied by buyers, release metadata, and operational logs needed to run the marketplace.

Why we use it

NORA uses this information to authenticate accounts, route buyer requests, review and publish records, grant private release access, prevent abuse, and communicate material workspace updates.

Where it is processed

NORA uses Supabase for authentication and marketplace data, Vercel for hosting and server functions, and GitHub only when a creator chooses to provide verification evidence. Email notifications are optional and are sent only after a verified sender is configured.

Private releases

Source bundles are stored in a private delivery bucket. They are not public catalogue assets. A buyer receives a short-lived download link only after an authorised entitlement is granted.

Verification evidence

Repository URL, commit, runtime, and workflow-result metadata may be stored with a listing so NORA can show whether a published build was verified. NORA does not need creators to provide repository write access for this first integration.

Retention and deletion

Account and marketplace records are retained while an account or listing is active, and for a reasonable period afterwards to operate the service, resolve disputes, and meet legal obligations. Signed-in users can request account closure from their Account page. NORA reviews requests before closure so active releases, access rights, disputes, and required records are handled safely. Data export is not yet self-service.

Your choices

You can choose not to create a listing, not to provide optional organisation details, or not to connect external verification. Some information is required to create an account, route a request, or deliver a purchased release.

Policy status

This is a practical launch privacy notice, not jurisdiction-specific legal advice. It must be reviewed with qualified counsel before paid public launch, particularly for payment, tax, retention, and international data-transfer obligations.