This policy explains what Mogostore collects when you browse or buy, why, and what happens to it. By using the site you agree to the practices described here.
What we collect
- Account details: your email address, display name, and (if you sign in with Google) your Google account identifier. Passwords are stored only as salted Argon2 hashes — we never see or store your actual password.
- Order details: the products you purchased, amounts, currency, coupon code used, invoice number, and the email address the order was placed under.
- Delivery records: download grant tokens (stored only as SHA-256 hashes plus an encrypted copy), license keys, download counts, link expiry dates.
- Technical logs: for each download we record the IP address and browser user-agent, solely to detect abuse of download links.
- Newsletter: if you subscribe, we store your email address in a dedicated subscribers list.
What we don't collect or do
- We never receive your card number, UPI PIN, or net-banking credentials. All payments are processed by Razorpay on their hosted checkout; card data never touches our servers.
- We do not sell, rent, or trade your personal information to third parties.
- We do not send marketing messages by SMS/phone — we only contact you at the email address you gave us.
How we use your information
- To deliver purchases: issue receipt emails (via Resend), generate secure download links, and enforce per-product download limits and link expiry.
- To operate your account: authentication sessions live in a signed, httpOnly JWT cookie.
- To provide support and resolve disputes about orders and refunds.
- To send transactional emails (receipts, delivery links, password resets). Marketing emails are sent only if you opted in, and every one carries an unsubscribe link.
Sharing
- Razorpay: processes payments and payment webhooks. They receive only what the transaction requires (amount, order reference).
- Resend: delivers our transactional emails to your address.
- Backblaze B2: stores product files. Downloads stream through expiring, signed links — B2 never learns your identity from us.
- Upstash: provides rate-limiting counters (no personal profiles).
- We may disclose information if required by law enforcement with valid legal process.
Security & retention
- Download tokens exist only inside signed links; we store their hash and an AES-256-GCM encrypted copy so links can be re-issued without keeping the raw value.
- Password reset tokens are stored hashed and expire automatically.
- Order records are retained for accounting and tax purposes. You can request deletion of your account and marketing data at any time; records we must legally retain will be minimized instead.
Your choices
- Opt out of marketing email any time using the unsubscribe link, or by replying to any receipt email.
- Request an export or deletion of your personal data by contacting us with your account email.
Questions about this policy? Email hello@mogostore.com or use our contact page.
Mogostore Software Solutions Pvt. Ltd. · Placeholder Business Address — Replace Me, City, State, PIN Code, India