Privacy policy

Ahmad Bannout
Hakenort 17B, 33609 Bielefeld, Germany
E-mail: [email protected]

For questions about your data you can also write to [email protected]. We are not required to appoint a data protection officer.

The website, its database and our sign-in system run on our own server, rented from OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, in a data centre in France. OVH processes data only on our behalf under a data processing agreement (Art. 28 GDPR).

When you open a page, your browser sends technical data such as your IP address, the time, the page requested and your browser and operating system. We need it to deliver the pages and to keep the service secure and working (Art. 6(1)(f) GDPR, our legitimate interest in a secure, working website). Error and security logs are kept only as long as needed for troubleshooting and are overwritten automatically.

You can use AppTrendKit inside AI assistants such as ChatGPT and Claude through our connector (an MCP server at apptrendkit.com/mcp). It needs no account and shows only what anyone can see on the website without signing in. When the assistant uses it, the assistant's provider sends us the request it formulated (for example an app name, a chart, a country or a keyword) together with technical data: the IP address of the provider's server and, for ChatGPT, an anonymous per-user ID that OpenAI generates. We do not receive your conversation, your name or your account with the assistant.

We use this data only to answer the request and to limit how often the connector can be used: the IP address and the anonymous ID are stored as a one-way hash in our rate limiter for one minute. Errors are logged without the request's content. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in offering the connector and keeping it secure. How the assistant's provider handles your conversation is governed by its own privacy policy.

Most of AppTrendKit can be used without an account. If you create one, we process:

• your e-mail address and password (stored only as a secure hash);
• profile details you choose to add (display name, avatar link, timezone);
• what you save in your workspace, such as watchlists, alerts, saved searches and reports;
• sign-in records (time and IP address) to protect your account.

We use this data to provide the account and its features (Art. 6(1)(b) GDPR). Accounts are for people aged 18 or older.

We send e-mails that belong to the account: confirming your address, resetting your password, a welcome message and notices about changes to your sign-in. They are sent from our server through the e-mail service of Hostinger (Hostinger International Ltd., Larnaca, Cyprus), which processes your e-mail address on our behalf.

Deleting your account: you can delete it at any time under Account → Delete account. Your sign-in, profile and any workspace only you belong to are deleted at once; a workspace you share stays with its other members. Copies in our backups are deleted within 14 days.

Pro is sold and paid through Stripe's Managed Payments service: at checkout you buy from Stripe's Link as reseller. Link is operated by Stripe (for customers in the EU, by Stripe's Irish companies in Dublin; the exact company is named in Link's terms at checkout). It collects your payment details, billing address and e-mail address, works out the tax for your country and issues your invoice. It does this as its own controller, under its own privacy policy, which you see at checkout. Stripe may process data in the USA; it is certified under the EU-U.S. Data Privacy Framework.

We never see or store your card or bank details. From Stripe we receive and keep: a customer and subscription ID, your plan and billing period, the subscription status, renewal and cancellation dates, and a record of each billing event. We use this to give you Pro, to show your plan on your account page and to answer billing questions (Art. 6(1)(b) GDPR). We keep it as long as your account exists; records we must keep for tax and accounting reasons are kept for the periods the law sets (Art. 6(1)(c) GDPR).

To learn which features are used and what people look for, the site records events such as pages viewed, searches (the search words and how many results they found) and clicks on apps and tools. These events are stored in our own database on our server. They contain the page address and, if you are signed in, your account ID, but no IP address. Search words that look like an e-mail address or a long number (phone, card or account numbers) are not stored.

Without your consent no identifier is stored in your browser for this. If you accept analytics cookies (see below), a random ID in your browser's session storage groups the events of one visit; it is deleted when you close the tab. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in improving the service; for the session ID, your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). These events are deleted after 24 months.

We use PostHog to understand how the site is used and to find errors. The provider is PostHog Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA. Our data is stored on PostHog's EU servers in Frankfurt, Germany, under a data processing agreement. For any access from outside the EU, the EU Standard Contractual Clauses apply.

• Before you choose, or if you choose “Only necessary”: PostHog counts page views and clicks without cookies or browser storage. Your IP address is only used to create a short-lived anonymous code on PostHog's servers and is not stored. Legal basis: Art. 6(1)(f) GDPR.
• If you choose “Accept”: PostHog sets a cookie and uses local storage to recognise repeat visits, and records sessions (what is clicked and shown on screen; everything typed into forms is hidden) so we can see where the site is confusing or broken. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with the button below.
• Error reports: when a page fails in your browser or on our server, the error message, the page address and technical details about the browser go to PostHog so we can fix it. Form contents are never included. Legal basis: Art. 6(1)(f) GDPR.

PostHog deletes events after 12 months and session recordings after 30 days.

Without your consent we only store what the site needs to work or what you asked for (§ 25(2) TDDDG):

• Sign-in cookie (sb-…-auth-token): keeps you signed in. Deleted when you sign out.
• Theme (local storage): remembers light or dark mode if you choose one.
• Recently viewed apps and your last dashboard visit (local storage, only when you use those features): shown back to you in the product, never sent to us.
• Your cookie choice (local storage): so we don't ask again on every page.

Only with your consent: PostHog's cookie and local storage, and the session ID for our own statistics (see above).

When you send us a message through the support page or by e-mail, we process what you write, the e-mail address you give us for a reply, the page you sent it from and, if you are signed in, your account ID. Messages from the form are stored in our database and forwarded to our support inbox. We use this to answer you and to fix problems (Art. 6(1)(b) and (f) GDPR). Support messages are deleted 12 months after they were sent. No IP address is stored; only a daily-changing code that can't be turned back into it is used to limit how many messages one sender can send.

If you subscribe to the weekly report on our newsletter page or under a report, we store your e-mail address, the page where you subscribed, and when you subscribed, confirmed and unsubscribed. We first send a confirmation e-mail (double opt-in); until you click its link, we send you nothing else. After confirming, you get one e-mail a week with the report. Legal basis: your consent (Art. 6(1)(a) GDPR, § 7(2) UWG).

You can unsubscribe at any time with the link in every e-mail or on the newsletter page; it takes effect at once. Addresses that were never confirmed, and addresses that unsubscribed, are deleted after 30 days. The e-mails are sent from our server through the e-mail service of Hostinger (Hostinger International Ltd., Larnaca, Cyprus), which processes your address on our behalf. We do not track whether you open the e-mails. To limit sign-ups from one sender, we use a code derived from the IP address that can't be turned back into it; the IP address itself is not stored.

A copy of our database (which includes account data) is backed up every night to storage at Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare R2), under a data processing agreement. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses also apply. Backups are deleted after 14 days. We use them only to restore the service after a failure (Art. 6(1)(f) GDPR).

Requests to the website pass through the network of Cloudflare, Inc. (address above) before they reach our server. Cloudflare filters out attacks and automated abuse, such as bots that copy the site in bulk, and may briefly check that your browser is not a bot. For this it processes your IP address, the page you request and technical data about your browser on our behalf, under a data processing agreement; the same safeguards for transfers to the USA apply as for backups. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure website that stays available.

To tell people from bots, Cloudflare may set short-lived security cookies (such as __cf_bm, which lasts 30 minutes, and cf_clearance after a browser check). They are strictly necessary for this protection and are not used for analytics or advertising (§ 25(2) no. 2 TDDDG).

AppTrendKit shows information that Apple publishes on the App Store about apps, such as names, descriptions, ratings, chart positions and in-app purchase lists. Some of it can identify a person, for example the name of an individual developer. We process it to provide market research about apps (Art. 6(1)(f) GDPR, our legitimate interest and that of our users in information about the app market). You can object at any time by writing to [email protected].

We do not sell personal data and do not share it for advertising. Data is processed only by the service providers named above (OVH, PostHog, Cloudflare and Hostinger for e-mail), each under a data processing agreement; by Stripe and Link as their own controller when you pay for Pro; and by authorities if we are legally required to disclose it.

We do not use automated decision-making or profiling that has legal or similarly significant effects on you.

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on our legitimate interests (Art. 21). You can withdraw consent at any time, with effect for the future (Art. 7(3)). Write to [email protected] or [email protected].

You can also complain to a data protection authority, for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

We update this policy when the service or the law changes. The date at the top shows the current version. If a change affects how we use your account data, we will tell signed-up users by e-mail.