Privacy Policy

Algo is operated by Algo-rythm Digital, based in Lagos State, Nigeria. For the purposes of the Nigeria Data Protection Act 2023, we are the data controller for the personal data described here.

For any question about this policy, or to exercise a right in section 7, contact team.algohq@gmail.com.

Everything Algo holds falls into one of these groups.

Your account. Your email address, the name you give us, and — if you add them — an avatar image, a short bio, a location, a website, and X or GitHub handles. If you sign in with Google, we receive your email address, name and profile picture from Google; we never receive your Google password.

What you publish. Products you submit — name, tagline, description, category, whether it was vibecoded or hand-built, tools used, website link, logo and screenshots — plus any comments you write and the products you upvote.

Waitlist emails. If you join the Algo waitlist, or a waitlist for a product listed on Algo, we store the email address you gave and the date you gave it. Nothing else.

Operational records. Your notification preferences, whether you are suspended, and timestamps recording when your account was created, when we last sent you a digest, and when we sent your welcome email — the last of these exists so we never send it twice.

We do not collect your password (Algo has none — see section 4), payment card details, your precise location, your contacts, or anything from your device beyond what is described in section 6.

The NDPA requires us to name a lawful basis for each purpose, not just to describe the purpose.

To run your account and show the platform — signing you in, displaying your profile, publishing your products, recording upvotes and comments. Basis: performance of a contract with you, being these Terms of Service.

To review submissions — an administrator reads each product before it appears, and may approve or reject it. Basis: legitimate interest in keeping the platform curated and free of spam and malware.

To email you — sign-in codes and a welcome message are necessary to the service (contract). The weekly digest of activity on your products, and launch announcements, are sent on the basis of your consent, which you can withdraw at any time in Settings without losing access to anything else.

To keep the platform safe — suspending accounts, removing content that breaches the Terms. Basis: legitimate interest in protecting users and the service.

Algo has no passwords. Signing in uses a one-time code sent to your email, or Google sign-in. There is no password to steal from us, reuse elsewhere, or leak.

Data is transmitted over TLS and stored encrypted at rest by our hosting providers. Access to the database is restricted by row-level security rules enforced by the database itself rather than only by application code, so a fault in the app cannot expose another user’s private records. Administrative access is limited to accounts we explicitly mark as administrators.

No system is immune. If a breach occurs that is likely to result in risk to your rights, we will notify the Nigeria Data Protection Commission and affected users as the NDPA requires.

We use a small number of service providers. They process data on our instructions, and each is bound by its own contractual and legal obligations.

Supabase — database, authentication and file storage. Vercel — application hosting and delivery. Resend — sending transactional and digest email. Google — only if you choose Google sign-in.

Transfers outside Nigeria. These providers store and process data outside Nigeria. Under sections 41–43 of the NDPA we rely on the adequacy of the receiving jurisdiction and on the contractual safeguards in each provider’s data processing agreement. You can ask us for details of these safeguards.

Discord is separate. If you join our Discord community, that is a relationship between you and Discord, governed by Discord’s own privacy policy. We do not link your Discord identity to your Algo account.

We do not sell your personal data, and we do not share it for advertising.

Algo sets no advertising or tracking cookies and uses no third-party analytics service. Nothing about you is sold, shared with an ad network, or used to build a profile.

We do count two things, so that builders can see whether their product is landing: that a product page was viewed, and that someone clicked through to a product’s own website. Each count is a single row holding the product, which of those two things happened, and the time. It holds no account, no IP address, no device or session identifier, and nothing that could be joined back to you — by us or by anyone who obtained the data. It is therefore not personal data, and none of the rights in clause 8 need to be exercised over it, because there is nothing in it that is yours.

Three things are stored on your device:

A session cookie, set when you sign in, which keeps you signed in. Strictly necessary; without it the service cannot work.

Local storage holding your appearance preference (light, dark or system), the time you last read your notifications, and your recent searches. These never leave your device and are not readable by us. Clearing your browser storage removes them.

Session storage holding a short list of product pages already counted in this browser tab, so that one visit is not counted twice. It is discarded when you close the tab and is never sent to us.

Under the NDPA you may require us to:

Give you a copy of the personal data we hold about you. Correct anything inaccurate — most of it you can edit yourself on your profile. Delete your account and personal data, subject to section 8. Restrict or object to processing we base on legitimate interest. Withdraw consent to email at any time, in Settings. Receive your data in a portable, machine-readable format.

Write to team.algohq@gmail.com and we will respond within 30 days. Exercising a right costs nothing and will never disadvantage your account.

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission, the supervisory authority for data protection in Nigeria.

You can delete your account from Settings. We want to be exact about this, because it is the part most policies are vague on.

Removed immediately: your name, avatar, bio, location, website and social handles are erased, your email address is replaced with an anonymised value, and your sign-in credentials are revoked so the account cannot be used again.

Kept: products you published, and comments and upvotes you left, remain on Algo, attributed to “Deleted user”. They stay because other people’s work is attached to them — a product page carries other builders’ comments, and removing a listing would erase their contributions too, along with the upvote history and any Product of the Month record that depends on it.

If you need a specific product or comment removed as well as your account, ask us at team.algohq@gmail.com and we will remove it, unless we are legally required to retain it.

Waitlist emails are kept until we launch or until you ask us to remove you, whichever comes first.

Algo is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

If we change how we handle your data — in particular if we begin taking payments, which we do not today, or if the counting described in clause 6 ever starts recording something that identifies you — we will update this page and change the date at the top. Where a change materially affects your rights, we will tell you by email before it takes effect.

See also our Terms of Service.