Privacy Policy

Most of Appstro works signed out. In that mode we do not ask for your name, email address or any other identifying detail.

Some things are still recorded:

• Analytics (consent-based). We use Google Analytics 4 and Firebase Analytics to count page views, see which tools get used, and record interactions such as clicks and form submissions. These store a cookie and a randomly generated identifier in your browser, and record your approximate location (derived from IP, not precise), device type, screen size, browser language and referring page. That identifier is not your name or email, but it does persist across visits on the same browser, so treat it as pseudonymous rather than anonymous.
• Performance measurement. Cloudflare Web Analytics, run by our host, counts page views and measures page load times. Cloudflare states that it uses no cookies or local storage and does not fingerprint visitors, so it runs without consent.
• Search terms. When you search for an app or keyword, the search text is logged to our own database with no link to your identity, and is aggregated to build the public keyword landing pages on this site. If you have accepted analytics, submitted search text is additionally sent to the analytics providers above alongside the pseudonymous identifier. Do not type anything private or confidential into the search box — treat it as public.

Appstro sets no advertising cookies and runs no ad networks. The only non-essential storage is analytics, described above.

If you are in the EU, EEA or UK, analytics do not run until you accept them. Nothing is loaded, no cookie is set and no identifier is generated before you answer the banner — declining is exactly one click, the same as accepting, and the entire site works either way. Outside those regions analytics are on by default.

Wherever you are, you can change your mind at any time using Cookie settings in the footer of every page. We also honour the Global Privacy Control and Do Not Track browser signals — if either is enabled, analytics stay off and you are never asked.

A large part of Appstro’s state never reaches our servers at all. The following live in your browser’s localStorage and are readable only by you:

• Your watchlist, comparison basket, publisher-compare basket and recently viewed apps
• AI App R&D projects and ASO checklist progress
• An anonymous local identifier used to keep your own settings separate between browsers
• Your own AI API key. If you supply a Gemini key in AI settings, it is stored in your browser and sent directly from your browser to the AI provider. It is never transmitted to, or stored on, Appstro servers.

Clearing your browser storage for this site erases all of it permanently. We cannot recover it, because we never had it.

Accounts are optional and exist to sync features across devices. Authentication is handled by Supabase. When you sign up we store:

• Your email address and a securely hashed password (we never see or store your plaintext password)
• Your saved apps / watchlist, if you choose to sync it
• The app + keyword + country combinations you track, and their daily rank history
• Your alert preferences, including your Telegram chat ID if you connect Telegram
• Anything you post to the Feedback Exchange — your request brief and the feedback you write on other people’s apps

Row-level security is enabled on these tables, so your rows are readable only by your own authenticated session.

If you connect an Apple Ads account, the private key you upload can spend real money, so it gets stricter handling than anything else on the site. It is encrypted with AES-256-GCM before storage, is never returned to the browser in any form, and is decrypted only inside a server-side function to sign requests to Apple. The database table holding it has row-level security enabled with no access policies at all — no browser session, yours included, can read it.

Reporting figures fetched from your Apple Ads account (spend, taps, installs) are shown to you and are not stored beyond your session.

Messages sent through the contact form are stored so they can be read and answered. We keep the message text, the category you picked, and the email address you supply — which is optional, so you can report a bug without identifying yourself. It is used only to reply to you.

Bug reports additionally include the page address you were on and your browser version, because a bug that cannot be reproduced cannot be fixed. This is stated on the form before you send it, and no other category attaches that context.

We also store a salted, one-way hash of your IP address — never the address itself — solely to rate-limit the form against spam. Messages are readable only by the site operator, and are deleted once resolved and no longer needed.

If you subscribe in the footer, we store your email address for the sole purpose of sending Appstro and ASO updates. Every email contains an unsubscribe link, and you can ask us to remove you at any time at privacy@appstro.dev. We do not sell, rent or share the list.

Appstro reads public App Store data live from your browser. That means:

• Apple. App lookups, searches, chart and review data come from Apple’s public iTunes / App Store endpoints.
• No third-party proxies. This used to say that Apple requests were relayed through four public CORS proxy services, which could each see the app ID or search term you asked for along with your IP address. That is no longer true: Apple’s endpoints now allow direct browser access, so your browser talks to Apple, and those four services were removed in August 2026. Requests that need a server — App Store search and product pages (search order, reviews, in-app prices), Apple’s EU ad repository, and download and revenue estimates — go through our own endpoint on our own hosting (Cloudflare), not a third-party proxy.
• Download and revenue estimates. Third-party estimate data is requested for the apps you view.
• Google Analytics and Firebase. Both are Google services and receive the analytics data described above — only if you have accepted analytics.
• Google (Gemini). AI features send the app listing text and your prompt to Google’s Gemini API — using your own key if you supplied one, otherwise a shared server-side key.
• Telegram. Only if you connect it, and only to deliver alerts you asked for.
• Cloudflare and Supabase. Cloudflare hosts the site and runs our server functions, including the relay that forwards some App Store and estimate requests; Supabase runs our database and sign-in. Both necessarily process requests on our behalf.

• We do not sell or rent personal data to anyone.
• We do not run advertising networks or advertising trackers on this site.
• We do not build advertising profiles or share your data with data brokers.
• We do not expose your identity on the Feedback Exchange — no profile page, no email, ever visible to other users.

• Account data is kept until you delete your account.
• Rank-tracking history is kept while you continue to track that combination.
• App metadata snapshots used to power change alerts are pruned after 30 days.
• Aggregated search terms and analytics are retained indefinitely in de-identified form.

You can request access to, correction of, or deletion of your personal data at any time. Depending on where you live you may also have the right to object to processing, to request a portable copy of your data, or to complain to your local data protection authority.

To exercise any of these, email privacy@appstro.dev. Account deletion removes your email, saved apps, tracked keywords and alert settings. Feedback Exchange posts may be retained in anonymised form so that conversations other users participated in remain coherent.

To opt out of analytics, use your browser’s tracking protection or an ad blocker — the site is fully functional with analytics blocked.

Appstro is a professional tool for app developers and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

Appstro is operated from Bangladesh and uses hosting and database infrastructure located outside your country. Using the service involves transferring your data internationally to those providers.

We may update this policy as the product changes. The effective date at the top always reflects the current version. Material changes will be announced on the site.

Questions about privacy or a data request: privacy@appstro.dev. See also our Terms of Service.