Privacy Policy

Algo is operated by Algo-rythm Digital, based in Lagos State, Nigeria. For the purposes of the Nigeria Data Protection Act 2023, we are the data controller for the personal data described here.

For any question about this policy, or to exercise a right in section 7, contact team.algohq@gmail.com.

Everything Algo holds falls into one of these groups.

Your account. Your email address, the name you give us, and, if you add them, an avatar image, a short bio, a location, a website, and X or GitHub handles. If you sign in with Google, we receive your email address, name and profile picture from Google; we never receive your Google password.

What you publish. Products you submit, meaning the name, tagline, description, category, whether it was vibecoded or dev-built, tools used, website link, logo and screenshots, plus any comments you write and the products you upvote.

Waitlist emails. If you join the Algo waitlist, or a waitlist for a product listed on Algo, we store the email address you gave and the date you gave it. Nothing else.

Operational records. Your notification preferences, whether you are suspended, and timestamps recording when your account was created, when we last sent you a digest, and when we sent your welcome email; the last of these exists so we never send it twice.

We do not collect your password (Algo has none, see section 4), payment card details, your precise location, your contacts, or anything from your device beyond what is described in section 6.

The NDPA requires us to name a lawful basis for each purpose, not just to describe the purpose.

To run your account and show the platform: signing you in, displaying your profile, publishing your products, recording upvotes and comments. Basis: performance of a contract with you, being these Terms of Service.

To review submissions: an administrator reads each product before it appears, and may approve or reject it. Basis: legitimate interest in keeping the platform curated and free of spam and malware.

To email you: sign-in codes and a welcome message are necessary to the service (contract). Four other kinds of email are sent on the basis of your consent: decisions on products you submit, an announcement when a waitlist you joined goes live, a weekly digest of activity on your own products, and news from Algo: Shipped, a monthly letter about what is new on Algo which includes a clearly labelled paid placement, and invitations to events such as Ship-athon. News from Algo is sent to every account unless you turn it off. Each has its own switch in Settings, every one of them carries an unsubscribe link, and turning any of them off costs you nothing else.

To keep the platform safe: suspending accounts, removing content that breaches the Terms. Basis: legitimate interest in protecting users and the service.

Algo has no passwords. Signing in uses a one-time code sent to your email, or Google sign-in. There is no password to steal from us, reuse elsewhere, or leak.

Data is transmitted over TLS and stored encrypted at rest by our hosting providers. Access to the database is restricted by row-level security rules enforced by the database itself rather than only by application code, so a fault in the app cannot expose another user’s private records. Administrative access is limited to accounts we explicitly mark as administrators.

No system is immune. If a breach occurs that is likely to result in risk to your rights, we will notify the Nigeria Data Protection Commission and affected users as the NDPA requires.

We use a small number of service providers. They process data on our instructions, and each is bound by its own contractual and legal obligations.

Supabase: database, authentication and file storage. Vercel: application hosting, delivery, and the aggregate visitor counting described in clause 6. Resend: sending transactional and digest email. Google: only if you choose Google sign-in.

Transfers outside Nigeria. These providers store and process data outside Nigeria. Under sections 41–43 of the NDPA we rely on the adequacy of the receiving jurisdiction and on the contractual safeguards in each provider’s data processing agreement. You can ask us for details of these safeguards.

Discord is separate. If you join our Discord community, that is a relationship between you and Discord, governed by Discord’s own privacy policy. We do not link your Discord identity to your Algo account.

We do not sell your personal data, and we do not share it for advertising.

Algo sets no advertising or tracking cookies. Nothing about you is sold, shared with an ad network, or used to build a profile of you, here or anywhere else.

We do use Vercel Web Analytics to count how many people visit the site each day. It is cookieless: it stores nothing on your device, issues no identifier, and cannot recognise you on a return visit or on any other website. What it records of a page view is the page, the country, the kind of device, and where the link came from, all of it added into totals. It is not joined to your account and there is no way for us, or for Vercel, to turn it back into a person. Pages under/admin are excluded entirely.

We do count two things, so that builders can see whether their product is landing: that a product page was viewed, and that someone clicked through to a product’s own website. Each count is a single row holding the product, which of those two things happened, and the time. It holds no account, no IP address, no device or session identifier, and nothing that could be joined back to you, by us or by anyone who obtained the data. It is therefore not personal data, and none of the rights in clause 8 need to be exercised over it, because there is nothing in it that is yours.

Three things are stored on your device:

A session cookie, set when you sign in, which keeps you signed in. Strictly necessary; without it the service cannot work.

Local storage holding your appearance preference (light, dark or system), the time you last read your notifications, and your recent searches. These never leave your device and are not readable by us. Clearing your browser storage removes them.

Session storage holding a short list of product pages already counted in this browser tab, so that one visit is not counted twice. It is discarded when you close the tab and is never sent to us.

Under the NDPA you may require us to:

Give you a copy of the personal data we hold about you. Correct anything inaccurate; most of it you can edit yourself on your profile. Delete your account and personal data, subject to section 8. Restrict or object to processing we base on legitimate interest. Withdraw consent to email at any time, in Settings. Receive your data in a portable, machine-readable format.

Write to team.algohq@gmail.com and we will respond within 30 days. Exercising a right costs nothing and will never disadvantage your account.

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission, the supervisory authority for data protection in Nigeria.

You can delete your account from Settings. We want to be exact about this, because it is the part most policies are vague on.

Removed immediately: your name, avatar, bio, location, website and social handles are erased, your email address is replaced with an anonymised value, and your sign-in credentials are revoked so the account cannot be used again.

Kept: products you published, and comments and upvotes you left, remain on Algo, attributed to “Deleted user”. They stay because other people’s work is attached to them: a product page carries other builders’ comments, and removing a listing would erase their contributions too, along with the upvote history and any Product of the Month record that depends on it.

If you need a specific product or comment removed as well as your account, ask us at team.algohq@gmail.com and we will remove it, unless we are legally required to retain it.

Waitlist emails are kept until we launch or until you ask us to remove you, whichever comes first.

Algo is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

If we change how we handle your data, we will update this page and change the date at the top. That includes beginning to take payments, which we do not today, and the counting described in clause 6 ever starting to record something that identifies you. Where a change materially affects your rights, we will tell you by email before it takes effect.

See also our Terms of Service.