Privacy Policy

Backlink Market (backlinkmarket.co, “Backlink Market”, “we”, “us”) is a marketplace where website owners list their sites and buy, sell or swap backlinks. This policy explains what personal and site data we collect, why we collect it, how we use, share, store and protect it, how long we keep it, and the choices you have. It applies to the website backlinkmarket.co and to every feature of the service, including Sign in with Google and the optional Google Search Console connection. Last updated 2 October 2026.

1. Who is responsible for your data

Backlink Market, available at https://backlinkmarket.co, decides why and how your data is processed (the “controller”). You can reach us about anything in this policy at ahmet@boldpilot.club.
This policy covers the people who use the marketplace as a buyer, a seller or both, and visitors who only browse the public pages.

2. Information we collect

Account information from Google Sign-In. When you sign in with Google we receive your Google account identifier, e-mail address, name, profile photo link and language setting. We never receive or store your Google password.
Profile information you add. A username and display name, country, language, time zone and your notification preferences.
Site and listing information. The domains you list; their niche, language, country, prices, the requirements you set for buyers, sitemap pages and the ownership-verification file we ask you to publish; and the figures shown next to a site (Domain Rating, monthly traffic range, traffic value).
Marketplace activity. Offers you send and receive, messages and briefs inside an offer, delivery records (the pages and links you place), the results of our link checks, and any violations or standing records that follow from them.
Payout details. If you sell on the Paid Market: the payout method (wire, PayPal, USDT or bank transfer), the account holder name where that method needs one, and the address or account number buyers pay to. We do not take card details and we do not process payments ourselves.
Google Search Console data (optional, read-only). If you connect Search Console: the access token Google issues to us, and, for each site you connect, the name of the Search Console property and the total number of Google search clicks over the last 28 days. Details are in section 3.
Third-party site data. Domain Rating and traffic estimates for a domain, read from Ahrefs. Only the domain name is sent to Ahrefs.
Technical data. Your IP address, browser and device type, pages requested and error logs, which our hosting provider records to deliver the site and keep it secure, and a session cookie that keeps you signed in.
Communications. The e-mails we send you about your account and offers, and messages you send to us.

3. Google user data and Google Search Console

Connecting Google Search Console is optional on its own but required to add or edit a site, because it is how we read a site’s real organic traffic. You choose which Google account to connect, and you can disconnect at any time.
What we ask for. One read-only permission: https://www.googleapis.com/auth/webmasters.readonly (“View Search Console data for your verified sites”). It lets us read; it does not let us change anything in your Search Console. Sign in itself uses only the basic Google profile and e-mail permissions.
What we access. The list of Search Console properties your Google account can see (to find the one that matches your listed domain), and one aggregate figure for that property: the total clicks from Google web search over the last 28 days. We do not read your search queries, pages, countries, devices, impressions, index or any other report.
What we do with it. We turn the clicks figure into a monthly estimate, place your site in a traffic range (for example “1k–5k a month”) and derive a rough monthly traffic value from it. The range, the value and a label saying it came from Search Console are shown to buyers; the raw figure and your Google account are not. We re-read the figure once a month for sites you have connected, so the range follows your real traffic.
Where it is stored. The click figure and property name are stored on your site’s record. The access and refresh tokens are stored in our database in a table that no signed-in user can read directly; only our server can read them, using a secret it holds. Data is encrypted in transit and at rest by our database provider.
Who sees it. No one but us, and the providers that host our systems (section 5). We do not sell it, rent it, share it with advertisers, or use it to serve ads. We do not use Google user data to train or improve artificial-intelligence or machine-learning models. Our staff do not read your Search Console data except where needed to fix a problem you ask us to look at, to keep the service secure, or where the law requires.
Limited Use. Backlink Market’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting and deleting. You can revoke our access at any time at myaccount.google.com/permissions; from then on we can no longer read your Search Console and the monthly update stops for your sites. To also have the stored tokens and the Search Console figures removed, write to ahmet@boldpilot.club and we will do it within 30 days (closing your account removes them too).

4. How we use your information

To provide the service: sign you in, show your listings, let members send, answer and track offers, confirm deliveries and keep delivered links under check.
To show buyers honest figures about a site (Domain Rating, traffic range and traffic value, each labelled with its source).
To communicate with you: e-mails about your offers, deliveries, deadlines and account, and replies to what you send us.
To keep the marketplace safe and fair: verifying domain ownership, detecting removed or changed links, handling violations, preventing fraud and abuse.
To maintain and improve the service: fixing errors, measuring performance and deciding what to build, using logs and aggregate figures rather than your individual Search Console data.
To meet legal obligations and to protect our rights.
Where the law asks for a legal basis, we rely on performing our contract with you (running your account and the marketplace), our legitimate interests (security, preventing abuse, improving the service), your consent (for the Search Console connection, which you can withdraw at any time) and legal obligation.
We do not sell your personal information, and we do not use it for advertising or profiling.

5. Who we share information with

Other members, as part of the marketplace. What you choose to publish: your display name and photo, your listings with their figures, how many domains you hold, and your delivery record. Your payout details are shown only to the buyer of an accepted Paid order. Your e-mail address is not public.
Service providers that run the service for us. Supabase (database and sign-in), Vercel (website hosting), Resend (sending e-mail), Ahrefs (Domain Rating and traffic estimates; receives domain names only) and Google (Sign in with Google and Search Console). They may process data only to provide those services to us.
Legal and safety. If the law, a court or a competent authority requires it, or to protect the rights, safety or property of members, the public or us.
Business changes. If the service is merged with or transferred to another organisation, your data may move with it, and we will tell you before it is governed by a different policy.
We do not sell personal information and do not share it with advertisers or data brokers.

6. Cookies

We use only the cookies needed to sign you in and keep the session secure, and a few settings such as your colour theme. We do not use advertising or cross-site tracking cookies.
You can block cookies in your browser, but signing in will not work without the session cookie.

7. How long we keep information

Account, profile and site data are kept while your account is open.
Offers, deliveries and link-check records are kept as long as they form part of the other member’s record of a deal or of the marketplace’s standing history.
Search Console tokens are kept until you disconnect and ask us to remove them, or until your account is closed. The click figure is replaced each time it is re-read.
Server logs kept by our hosting provider are retained for a short period for security and debugging, according to the provider’s settings.
After you ask us to delete your account we remove or anonymise your personal data within 30 days, except what we must keep by law or to settle a dispute.

8. How we protect it

All traffic to the site uses HTTPS. Access to the database is limited by per-account rules, so one member cannot read another’s private data, and sensitive operations run only on our server with secrets that never reach your browser.
Google access tokens and our application secrets are not readable by signed-in users or by the public.
No online service is perfectly secure. If a breach affects your data we will tell you and the authorities as the law requires.

9. Your rights and choices

You can ask to access, correct, export or delete the personal data we hold about you, to object to or restrict some processing, and to withdraw consent (for example by disconnecting Search Console). Depending on where you live, these may be rights under the GDPR, the UK GDPR or California law (CCPA/CPRA); we honour them for everyone.
You can edit your profile and sites yourself in the app, and pause or archive a site at any time.
To use a right or ask a question, write to ahmet@boldpilot.club from the e-mail address on your account. We answer within 30 days and may need to confirm it is you.
If you think we have mishandled your data, you can complain to your local data protection authority.

10. International transfers

Our providers may process data in countries other than yours, including the United States and the European Union. Where the law requires, we rely on safeguards such as standard contractual clauses with those providers.

11. Children

Backlink Market is for site owners and businesses and is not directed to anyone under 18. We do not knowingly collect data from children; if you believe we have, write to us and we will delete it.

12. Changes to this policy

We may update this policy as the service or the law changes. The version on this page is the current one and the date at the top shows when it last changed. If a change materially affects how we use Google user data, we will ask for your consent again before it applies.

13. Contact

Questions, requests or complaints about privacy: ahmet@boldpilot.club. Website: https://backlinkmarket.co.

Also read the Terms of Service. These rules describe how the marketplace works today and can change; the version on this page is the current one.