Last updated: February 26, 2026

Privacy Policy

1. Introduction

Magic Engineering, LLC (doing business as "Yard," "we," "us," or "our") operates the Yard platform at yard.sh, a digital marketplace for software projects. Yard operates as a merchant of record, meaning all purchases are processed through our payment infrastructure on behalf of sellers.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, create an account, purchase or sell projects, or otherwise interact with our services. By using Yard, you consent to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Email address
  • Username and display name
  • Profile information (avatar, bio)
  • GitHub account information (if you authenticate via GitHub OAuth)

2.2 Payment Information

Payment processing is handled entirely by our third-party payment processor. We do not store credit card numbers, bank account numbers, or other sensitive financial data on our servers. Our payment processor may collect:

  • Credit/debit card details
  • Billing address
  • Transaction history

For sellers, our payment processor collects additional identity and banking information as required for payouts. Please refer to the payment processor's Privacy Policy for details.

2.3 Project and Seller Data

If you sell projects on Yard, we collect:

  • Project listings, descriptions, and pricing
  • Release files and associated metadata
  • GitHub repository information for automated syncing
  • Sales and earnings data

2.4 Usage Data

We automatically collect certain information when you use our platform:

  • IP address
  • Browser type and version
  • Pages visited and features used
  • Referring URL
  • Device information
  • Timestamps of activity

2.5 Cookies

We use a limited number of cookies essential to the operation of the platform. See Section 5 for details.

3. How We Use Your Information

We use the information we collect to:

  • Provide and maintain the platform: account management, project delivery, and download access
  • Process payments: facilitate purchases, calculate platform fees, manage seller payouts, and handle refunds
  • Communicate with you: transactional emails (purchase confirmations, receipts, trial notifications), account security alerts, and platform updates
  • Ensure security: detect and prevent fraud, abuse, and unauthorized access
  • Improve the platform: analyze usage patterns to fix bugs, improve performance, and develop new features
  • Comply with legal obligations: tax reporting, responding to legal requests, and enforcing our Terms of Service

4. How We Share Your Information

We do not sell your personal information. We share data only with the following categories of service providers, and only as necessary to operate the platform:

  • Payment processor: payment processing, tax calculation, seller identity verification, and payouts
  • GitHub: OAuth authentication and repository integration for release syncing
  • Resend: transactional email delivery (purchase confirmations, account notifications)
  • Sentry: error monitoring and crash reporting to maintain platform stability
  • Storage providers: secure file storage for project releases and assets

We may also disclose information when required by law, to protect our rights, or to prevent harm.

5. Cookies & Tracking

Yard uses a minimal set of cookies:

  • Session cookie: maintains your authenticated session. Essential for platform functionality.
  • OAuth state cookie: temporary cookie used during GitHub OAuth authentication to prevent CSRF attacks. Deleted after authentication completes.

5.1 Analytics

We may use Umami, a privacy-focused analytics tool, to understand aggregate usage patterns. Umami does not use cookies and does not collect personally identifiable information.

5.2 Error Monitoring

Sentry is used to capture and diagnose errors. It may collect technical data such as browser type, stack traces, and request metadata to help us fix bugs.

6. Data Retention

  • Account data: retained for as long as your account is active. Upon account deletion, personal data is removed within 30 days, except as required by law.
  • Purchase records: retained for 7 years to comply with tax and financial reporting obligations.
  • Session data: automatically purged upon session expiration.
  • Usage logs: retained for up to 90 days for security and debugging purposes, then deleted or anonymized.

7. Data Security

We implement industry-standard security measures to protect your information:

  • All data transmitted between your browser and our servers is encrypted via TLS/HTTPS
  • Passwords are hashed using bcrypt; authentication tokens are securely hashed before storage
  • Payment data is handled by Stripe, a PCI DSS Level 1 certified processor; we never store card numbers on our servers
  • Access to production systems is restricted and audited

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: request a copy of the personal data we hold about you
  • Correction: request correction of inaccurate or incomplete data
  • Deletion: request deletion of your personal data (subject to legal retention requirements)
  • Data portability: request your data in a structured, machine-readable format
  • Opt-out of marketing: unsubscribe from promotional communications at any time

To exercise any of these rights, contact us at legal@yard.sh. We will respond within 30 days.

9. International Data Transfers

Yard is operated from the United States. If you are accessing our platform from outside the United States, your data will be transferred to and processed in the United States. By using Yard, you consent to this transfer. We rely on standard contractual clauses and other lawful mechanisms to facilitate international data transfers where required.

10. Children's Privacy

Yard is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly. If you believe a minor has provided us with personal data, please contact us at legal@yard.sh.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or a notice on the platform. Your continued use of Yard after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

Magic Engineering, LLC (DBA Yard)
Email: legal@yard.sh