1. Introduction

Applyra ("we", "our", or "us") is an App Store Optimization (ASO) platform. This Privacy Policy explains what personal data we collect when you use the website, the dashboard, the API, the MCP server and the AI assistants you connect to them, why we collect it, who processes it for us, and the rights you have over it.

Data Controller: Aurélien Weiss, trading as Krnel Studio, 3 rue des Petits Thibauds, 33240 Saint Laurent d'Arce, France. For any question about your personal data, contact us at hello@applyra.io.

2. Information We Collect

2.1 Information You Provide

Account Information: your name, email address and password when you register, or your name and email address from Google or GitHub when you sign in with them
Profile Information: optional details such as a company name, and your email preferences
Payment Information: processed by Stripe; we do not see or store card numbers
App Data: the apps, keywords and competitors you track, and the listing drafts you write, check or score
API and Connected Assistants: the API key you generate, and the AI assistants you connect to your account (which assistant, and when)
Communications: the messages you send us by email or through the contact form

2.2 Information Collected Automatically

Usage Data: pages visited, features used and actions taken
Device Information: browser type, operating system, device type
Log Data: IP address, access times, referring URLs
How You Found Us: the first page you landed on, the campaign parameters of the link you followed, and the referral code of a referral link, kept until you sign up
Error Reports: technical details of an error you ran into, which can include your IP address and account identifier

2.3 Public Store Data

Applyra collects public data from the App Store and Google Play: app listings, rankings, ratings and the developer details stores publish. When a listing names a person or shows a contact email, that public information is part of what we store about the app.

3. How We Use Your Information and Legal Basis

Under the GDPR, we process your personal data on the following legal grounds:

3.1 Contract Performance

To provide and maintain the Service, including the API and the MCP server
To process your subscription and payments
To send you emails about your account and your tracked apps
To answer your questions and support requests

3.2 Legal Obligations

To keep payment and invoicing records as required by tax law
To comply with applicable regulations and legal requests

3.3 Legitimate Interests

To understand how the Service is used and improve it
To know which channels and campaigns bring us new customers, including ads
To find and fix errors
To detect and prevent fraud, abuse and excessive use
To contact app developers about their app, as described in section 7

You have the right to object to processing based on legitimate interests. Contact us at hello@applyra.io to exercise this right.

4. AI Features

When you use an AI feature (AI insights, the AI listing writer, keyword suggestions or a niche analysis), we send AI model providers the data that feature needs: the public store data of the apps involved, the keywords, and the text you ask us to write or rewrite. We do not send them your name, your email address or your payment details. The providers we use are OpenAI, Google, Groq, NVIDIA and Cerebras.

5. The API and Connected AI Assistants

You can give an AI assistant, such as ChatGPT or Claude, access to your Applyra account through our MCP server. The assistant first opens an Applyra page where you sign in and see what it will be able to do, and it gets access only if you allow it. It can then read your tracked apps, keywords, rankings, competitors and scores, and change what your account tracks. It never publishes anything to App Store Connect or Google Play.

The data an assistant reads from Applyra goes to the company behind that assistant, and that company's own privacy policy governs what it does with it. You can see every connected assistant on the MCP page of your dashboard and disconnect any of them at any time; its access stops within the hour. Tools you set up with your API key, such as a local MCP client or your own scripts, stop working when you regenerate the key.

6. Emails

We send emails through Resend: account emails (sign-in, security, billing), which you cannot turn off while you have an account, and product emails (onboarding, recaps of your rankings, competitor alerts and occasional product news), which you can turn off from your email preferences or from the link at the bottom of each one.

7. If We Contacted You About Your App

We sometimes email app developers to show them how their app is doing in store search. For that we use the contact email the developer publishes on their app's Google Play listing, together with the public data of that app. We do this on the basis of our legitimate interest in presenting Applyra to developers it can help.

You can stop these emails at any time with the unsubscribe link in the email, or by replying to ask us to stop. We then keep your address flagged so that we never write to it again. You can also ask us to delete it, and exercise the other rights in section 12, at hello@applyra.io.

8. Data Sharing and Disclosure

We do not sell your personal data. We share it only with the service providers who run parts of the Service for us, under contracts that limit their use of it to that purpose:

Supabase: database and authentication, hosted in the European Union (Privacy Policy)
Vercel: hosting (Privacy Policy)
Hetzner: our own servers in Germany, which run background jobs and rate limiting (Privacy Policy)
Stripe: payment processing (Privacy Policy)
Resend: email delivery (Privacy Policy)
PostHog: product analytics, and forwarding sign-ups and subscriptions to the networks whose ads brought them (Privacy Policy)
Sentry: error monitoring, hosted in the European Union (Privacy Policy)
OpenAI: AI features, and measurement of our ads in ChatGPT (Privacy Policy)
Google: AI features, sign-in with Google, and measurement of our ads on Google (Privacy Policy)
GitHub: sign-in with GitHub (Privacy Policy)
Groq, NVIDIA and Cerebras: AI features (section 4)

We may also disclose information:

Legal Requirements: when required by law or to protect our rights
Business Transfers: in connection with a merger, acquisition, or sale of assets

9. Cookies and Similar Technologies

We use the following cookies and similar technologies:

Essential: to keep you signed in, protect your session and remember your settings
Referral: when you follow a referral link, a cookie keeps its code for 30 days so the person who referred you gets credit when you sign up
Attribution: a cookie keeps the first page and campaign that brought you to Applyra for 30 days, and we read it when you sign up
Analytics: PostHog measures how the website and the dashboard are used, with cookies or local storage
Advertising Measurement: when you arrive from one of our ads, the attribution cookie also keeps the ad's click reference. Google Tag Manager loads the Google tag, which can store identifiers in your browser to measure our ads on Google. When you sign up or subscribe, our servers send our advertising partners (Google directly, and others such as OpenAI through PostHog) a hashed (SHA-256) version of your email address, your IP address, your browser type and the ad's click reference when there is one, so sign-ups can be matched to the ads that brought them

You can block or delete these cookies in your browser settings, or with a content blocker. Everything except the essential cookies can be blocked without affecting the Service.

10. Data Security

We implement appropriate security measures to protect your data:

Encryption of data in transit (HTTPS/TLS)
Encryption of sensitive data at rest
Access controls and authentication
Access for connected assistants limited to the assistants' own addresses, granted only after you allow it
Secure cloud infrastructure (hosted in EU data centers)

While we strive to protect your data, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

11. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service:

Account Data: retained until account deletion
Usage Data: retained for up to 24 months for analytics
Payment Records: retained as required by tax and accounting laws
Deleted Accounts: data is removed within 30 days of account deletion
Developers We Contacted: an address that asked us to stop is kept, flagged, so that we never write to it again

12. Your Rights (GDPR)

If you are in the European Economic Area (EEA), you have the following rights:

Access: Request a copy of your personal data
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data ("right to be forgotten")
Portability: Request your data in a portable format
Restriction: Request limitation of data processing
Objection: Object to certain data processing activities
Complaint: Lodge a complaint with a supervisory authority

To exercise these rights, contact us at hello@applyra.io. We will respond within 30 days.

Right to lodge a complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority. In France, this is the CNIL (Commission Nationale de l'Informatique et des Libertés). You can also contact the data protection authority in your country of residence.

13. International Data Transfers

Our database is hosted in the European Union. Some of our service providers are based in the United States (Stripe, Vercel, Resend, PostHog, OpenAI, Google, GitHub, Groq, NVIDIA and Cerebras), so your data can be transferred outside the EEA. When it is, we rely on appropriate safeguards:

Standard Contractual Clauses (SCCs): the EU Standard Contractual Clauses approved by the European Commission, or the EU-U.S. Data Privacy Framework where the provider is certified
Additional Safeguards: technical measures such as encryption and access controls

You can request a copy of the applicable safeguards by contacting us at hello@applyra.io.

14. Children's Privacy

Our Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through the Service. We encourage you to review this policy periodically.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Owner: Aurélien Weiss
Trade name: Krnel Studio
Address: 3 rue des Petits Thibauds, 33240 Saint Laurent d'Arce, France
Email: hello@applyra.io
Business Registration (SIREN): 750003089
VAT Number: FR92750003089
Website: applyra.io