Privacy policy

Last updated October 18, 2026.

Short version: we don't use advertising trackers, tracking pixels or analytics cookies. Our visitor statistics are anonymous totals. We only keep personal data you give us yourself (like your email address), and we never sell it.

Who we are

Digital Underground is an independent creator business based in Ontario, Canada. It sells apps, guides and AI tools at digitalundergroundstore.com and on Gumroad, and runs the Developer Marketplace. Contact us through the support form or at [email protected].

What we collect and why

What	Why	How long
Anonymous visit statistics: daily totals of page views, which page, the referring website's name (for example "google.com"), phone or desktop, and which product links were clicked.	To see which products people are interested in. No cookies, no IDs, no IP addresses are stored, and the totals can't be linked to you.	Daily totals, about 13 months
Marketplace listing statistics: daily counts of how often each listing was shown, opened or clicked.	So makers can see how their listing is doing. Counts only, nothing about who viewed.	About 13 months, or until the listing is deleted
Email list: your email address, the date and time you agreed, the page you signed up on, the consent wording, your country (from your connection, not your IP address), and an unsubscribe code.	To send you Digital Underground emails you asked for, and to prove your consent (required by Canada's anti-spam law, CASL).	Until you unsubscribe. After that the record is marked "unsubscribed" so we never email you again by mistake; ask us and we will delete it completely.
Support messages: your name (optional), email, topic and message.	To answer you. They are emailed to us and are not stored on the website.	In our mailbox as long as needed to help you
Developer Marketplace accounts: your email, your listings, and a sign-in cookie. Login codes are stored only as a scrambled (hashed) value and expire after 10 minutes.	To let you list projects and manage them.	Until you ask us to delete your account. The sign-in cookie lasts up to 180 days or until you sign out.
Purchases	Handled entirely by Gumroad. We receive the order details Gumroad gives sellers (such as your email and what you bought) so we can deliver and support it.	As required for tax and accounting

Our stored data is backed up daily inside Cloudflare, and backups are kept for 60 days, so deleted data disappears from backups within 60 days. A weekly copy of the email list and marketplace listings is also emailed to our own store mailbox for safekeeping.

Your IP address is seen briefly by our servers, as with any website, to stop spam and abuse (rate limits). We don't store it: rate-limit counters use a one-way scrambled value that expires within a day.

Cookies and browser storage

We use no advertising or analytics cookies, so there is no cookie banner. We only use storage that is needed for something you asked for:

du_creator cookie: keeps you signed in to your Developer Marketplace dashboard.
Remembering a licence key you entered in one of our apps, your app settings (like dark mode, mute, or whether you minimised the store info panel), game high scores, and the email you used to sign in to the marketplace. These stay on your device.
A security check (Cloudflare Turnstile) on the marketplace submit form, to block bots.

Who processes data for us

Cloudflare hosts the site, stores the data above, and provides the Turnstile bot check.
Gumroad handles checkout, payments, refunds and delivery. See Gumroad's privacy policy.
Our email delivery provider (Resend or MailChannels) sends our emails, sign-in codes and support messages.
Proton Mail hosts our support mailbox.
If a marketplace listing has a YouTube or Vimeo video, nothing loads from those sites until you press "Play video".

Some of these companies process data outside Canada, including in the United States and the EU. Where personal data is transferred from the EU or UK to a country without an adequacy decision, we rely on our providers' safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We never sell, rent or share your data for advertising.

Email list (CASL)

We only add you with your express consent: you type your email and tick a box that is never pre-ticked. Every email says who it's from and has a working unsubscribe link. We act on unsubscribes right away, always within 10 business days. You can still download a free gift after unsubscribing.

Your rights

Wherever you live, you can ask us to see, correct, export or delete your data, or object to how we use it. In Canada these rights come from PIPEDA. In the EU and UK they come from the GDPR. Our legal bases for using your data are:

Consent for the email list (GDPR Art. 6(1)(a)).
Contract for marketplace accounts, purchases and support (Art. 6(1)(b)).
Legitimate interests for security, hashed-IP rate limiting, Turnstile bot checks and anonymous visit totals (Art. 6(1)(f)).

To make a request, use the support form (choose any topic and write "privacy request") or email [email protected]. We reply within 30 days.

If you are in the EU or UK, you can lodge a complaint with your local data protection authority. In Canada, you can contact the Office of the Privacy Commissioner of Canada.

Children

The store and marketplace are not aimed at children under 16, and we don't knowingly collect their data.

Changes

If we change this policy we'll update the date at the top. Big changes will be announced on the site.