Privacy Policy

This policy explains what personal data we collect when you use ASO Atlas, why we process it, who else sees it and what you can do about it. It applies to asoatlas.com, the ASO Atlas application for macOS and the API.

1. Who is the controller

The controller of your personal data is:

Nielogiczny Karol Labuda Luzińska 2, 84-217 Zęblewo, Poland NIP 5882505100 · REGON 526924027 Contact: [email protected]

We have not appointed a data protection officer. Write to the address above with any privacy question and a real person will answer.

2. What we collect and why

Account data

Your name, email address, a hashed password, and the date you confirmed your email. If you enable two-factor authentication or a passkey we store the secrets needed to verify it. We process this to create and secure your account, which is performance of our contract with you (Art. 6(1)(b) GDPR).

If you choose to continue with Google or Apple instead of a password, that provider confirms your identity and sends us your name, your email address (with Apple, possibly a private relay address you chose) and an identifier for your account with them. We receive nothing else from them, we never see your Google or Apple password, and we do not post or read anything on your behalf.

Billing data

Your subscription status, plan, billing period and the customer and subscription identifiers held by our payment processor. We never receive or store your card number - Stripe handles the card and holds it under its own policy. We process billing data to take payment and to meet accounting and tax obligations (Art. 6(1)(b) and 6(1)(c) GDPR).

Product data

The apps you track, the keywords, keyword lists and metadata drafts you create, the competitors you add and the searches you run. This is what the Service is for, so we process it to provide it to you (Art. 6(1)(b) GDPR).

Aggregated, non-identifying keyword measurements derived from public App Store data feed our shared keyword dataset. That dataset describes keywords and apps, not people, and is not linked back to your account when it is used to serve other customers.

App Store Connect integration (optional)

If you connect App Store Connect, we store the issuer ID, key ID and the private key you supply. The private key is encrypted at rest and is never sent to your browser. We use it only to fetch your own sales, subscription and analytics reports and show them back to you. Disconnecting the integration deletes the key. This is processed on the basis of your request to use the feature (Art. 6(1)(b) GDPR).

Connected AI assistants (optional)

If you connect an AI assistant such as ChatGPT, Claude or Codex to your account, we store the access token it receives (or the personal access token you create) and when it was last used. The assistant can then read and change your ASO Atlas data through our tools, only while you use it and only within your own account. What the assistant does with the answers is governed by that assistant's provider, not by us. You can see and revoke every connection under Settings → Connect your AI; a revoked token stops working immediately. This is processed on the basis of your request to use the feature (Art. 6(1)(b) GDPR).

AI features (optional)

When you generate app icons, the text prompt you write is sent to our image generation provider. Do not put personal data in prompts.

Technical and log data

Your IP address, browser user agent, session records, request timestamps and error logs. We use these to keep the Service secure, prevent abuse, enforce rate limits and diagnose failures. This is our legitimate interest in a working and secure service (Art. 6(1)(f) GDPR).

Usage analytics

We use a self-hosted analytics tool on our own infrastructure. It records page views, referrers and coarse device and country information without cookies and without a cross-site identifier, and it does not build a profile of you. No usage data is sent to an advertising network. This is our legitimate interest in understanding which pages work (Art. 6(1)(f) GDPR).

Support and email

If you contact us, we keep the message and our reply so we can handle the case and any follow-up. We send transactional email such as email verification, password resets, billing notices and important service notices. These are part of the Service, not marketing.

Marketing email (consent only)

We send product updates and ASO tips only if you opted in - via the optional, unticked checkbox at registration or the toggle in your profile settings. This is based on your consent (Art. 6(1)(a) GDPR), we record when you gave it, and you can withdraw it at any time in profile settings or through the unsubscribe link in any such message. Withdrawing does not affect your account or any transactional email.

Referrals

If you arrive through a referral link we store the referral code in a cookie for 30 days, and if you register we record which account referred you so the reward can be applied. Referrers see that a referral converted, never your account details.

How you found us

When you register, we record how you reached us during that visit: the site that linked to us, the first page you opened, any campaign tags in that link, and whether you signed up on the website, in the Mac app or through an AI assistant. After subscribing we may ask how you heard about us; answering is optional. We keep this with your account to learn which channels work, under our legitimate interest (Art. 6(1)(f) GDPR). It is held in your session while you browse, so it needs no extra cookie, and it is deleted with your account.

3. What we do not do

• We do not sell your personal data.
• We do not share it with advertising networks or data brokers.
• We do not use it to train AI models.
• We do not run behavioural or cross-site tracking.

4. Who processes data on our behalf

We share the minimum necessary with the following processors:

Processor	Purpose	Where
Hetzner Online GmbH	Hosting, servers and backups	Germany
Cloudflare, Inc.	DNS, CDN and abuse protection in front of the site	Global, EU edge
Stripe, Inc. / Stripe Payments Europe	Payment processing and invoicing	EU and USA
PurelyMail	Transactional email delivery	USA
kie.ai	AI image generation for the icon generator	Outside the EEA

We also query Apple's public App Store endpoints. Those requests carry keyword and app data, not your identity.

Where a processor is outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or another mechanism permitted under Chapter V GDPR. We can send you details on request.

We may also disclose data where the law requires it, or to establish or defend legal claims.

5. Cookies and local storage

We do not use advertising or tracking cookies, so there is no cookie banner. The cookies we do set are strictly necessary or functional:

Name	Purpose	Lifetime
aso-atlas-session	Keeps you logged in and holds the free tool's usage counter	Session, up to 2 hours idle
XSRF-TOKEN	Cross-site request forgery protection	Same as the session
appearance	Remembers light or dark mode	1 year
referral_code	Attributes a referral to the person who invited you	30 days

Your browser's local storage also holds your appearance preference. Cloudflare may set its own security cookie to distinguish a browser from a bot.

6. How long we keep data

• Account and product data: while your account exists, then deleted or anonymised within 30 days of closure.
• Billing records: 5 years from the end of the accounting year, as Polish tax law requires.
• Logs and technical data: up to 12 months.
• Support correspondence: up to 3 years.
• Aggregated keyword measurements: kept indefinitely, since they describe keywords rather than people.

7. Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you (access);
• correct data that is wrong (rectification);
• delete your data (erasure);
• restrict or object to processing that relies on our legitimate interests;
• send your data to you or another provider in a portable format;
• withdraw consent at any time, where processing is based on consent, without affecting what was done before.

Email [email protected] and we will respond within one month. You can delete your account yourself from account settings.

If you think we have handled your data wrongly you can complain to the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, or to the authority where you live.

8. Security

Data is encrypted in transit with TLS. Passwords are stored as salted hashes and App Store Connect private keys are encrypted at rest. Access to production systems is limited to accounts that need it and protected by key-based authentication. Backups are held with our hosting provider. No system is perfectly secure; if a breach affects your data and carries a high risk to you, we will notify you and the supervisory authority as required by law.

9. Children

The Service is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

10. Changes to this policy

We may update this policy. Material changes are announced by email or in the application before they take effect. The date at the top of the page shows when it was last changed.

Feedback

This section is for you if you sent feedback to an app's developer through a feedback form or button that runs on ASO Atlas, for example a page saying "Sent to the developer of ... via ASO Atlas".

The developer of that app is the controller of your feedback. They decide why it is collected and what happens to it, and their own privacy policy applies. ASO Atlas stores and processes it on their behalf, only to deliver your messages to them and their replies to you.

What we store for the developer:

• the messages you write, their category, and the screenshots or log files you attach. Images are re-encoded when they arrive, which removes hidden metadata such as location;
• your email address and name, if you give them;
• what the app sends along to help the developer: an install identifier, the developer's own user id for you, the platform, app version and build, operating system version, device model and language;
• a one-way hash of your IP address, used only to apply rate limits and block abuse.

The developer sees your conversation, can reply, and may forward events to their own tools. Replies reach you in the app and on your conversation page; we never email you about your feedback. If you left an email address, the developer may write to you from their own mailbox. We do not use your feedback for anything else, and the general commitments in section 3 apply to it too.

How long it is kept: a conversation with no new messages for 24 months is deleted automatically, with its files. Conversations the developer marks as spam are deleted within days. If the developer deletes the conversation, their feedback inbox or their ASO Atlas account, your feedback is deleted with it.

Deleting it yourself: open the conversation page (the link you received after sending) and choose Delete this conversation, or use the delete option in the app if it offers one. You can also ask the developer, who can delete it at any time.

To exercise your other rights, such as access or correction, contact the developer of the app. If you write to us at [email protected] instead, we will pass your request to them and help them answer it.