What actually transfers when you sell a repo

The code is the easy part. It's a zip file. What derails a first sale — on either side — is everything around the code, and the quiet assumption that "I bought the project" automatically covers all of it.

Here's the full list, and who ends up with what.

The code

What transfers: a clean copy of the source, its documentation, its configuration, and its tests.

What doesn't: the seller's original repository. On Cinderella the deliverable is the *scrubbed bundle* — a cleaned copy — and the seller keeps their own repo. That surprises people, but it's the right shape: there's no account transfer to go wrong, no lingering access to revoke, and no git history full of the secrets we just removed.

If you're buying somewhere that *does* transfer a repo, make sure you understand what's in the history. Deleted secrets are still in old commits.

The rights

This is the part that has to be in writing, and the part most often isn't.

• Full assignment — the buyer owns it outright and the seller stops using it.
• Exclusive — nobody else will be sold it, but the seller may keep a private

copy for reference.

• Non-exclusive — the buyer gets a licence to use and build on it; the seller

can sell it again.

These are genuinely different products at genuinely different prices, and "I sold you my project" doesn't say which one happened. Cinderella records the rights model on the listing and writes it into the bill of sale for the transaction, so the answer exists on paper before either side needs it.

If a repo was public under a permissive licence, note that the public copy stays under that licence. What you're buying is the seller's ongoing work and their agreement not to compete with you — not the ability to un-publish the past.

The secrets

What transfers: nothing, and that's deliberate.

Every API key, database URL and token in the repo is stripped before listing. That means a buyer receives a project that won't connect to anything until they supply their own credentials, which is exactly right — you don't want the seller's Stripe key, you want your own.

The seller's job here is to rotate anything that leaked and send fresh values directly. Not in the listing, not in the chat thread. Directly.

The things that aren't code

Each of these transfers separately, with its own process, and each has to be named in the listing to be part of the deal:

• Domains — a registrar transfer, usually 5–7 days, needs an auth code.
• Hosting and deploy accounts — Vercel, Render, Fly. Usually a project

transfer or an invite plus the seller removing themselves.

• Third-party service accounts — Stripe, Twilio, OpenAI. Often *not*

transferable; the buyer usually has to open their own.

• App store listings — Apple and Google both have formal transfer processes

with their own conditions.

• Social handles, a waitlist, an email list — an email list carries consent

obligations with it. Don't hand one over casually.

• Users, if there are any — a real transfer of a user base is a data

protection question, not a file copy.

The thing that can't transfer

The seller's head. Six months of context — why the schema looks like that, what was tried and abandoned, which part is load-bearing — is worth more than most buyers expect and costs the seller almost nothing to hand over.

A short written brief covering architecture, gotchas and what's unfinished is the single highest-value thing a seller can include. It also, reliably, gets them a better review.

The short version

Code, rights, and credentials are the deal. Domains, accounts and audiences are separate transfers that only happen if someone says so. Context is free and undersupplied.

Put every one of them in writing before the money moves — a message on the listing is enough, so long as it exists.