What we keep, and for how long.

AppCited is run by BMNova (Türkiye), [POSTAL ADDRESS · street, city, postcode, country]. This policy covers the AppCited website, the free report card, accounts, the weekly report and the Monday email. It does not cover the AI assistants, Apple's App Store or Paddle, which have their own policies; we link to them where they apply.

The domain this product will run on is not final. The policy applies to whichever domain serves it. Questions go to hello@appcited.app.

You paste an App Store link and we ask four AI engines eight questions each about that app. No account, no email. For this we process:

• The link. We keep the App Store ID and the store country from it, not the full link. We look the app up with Apple's iTunes Lookup API and cache the public listing (name, developer, category, description, icon) for everyone who scans or tracks the same app.
• A hashed IP address. To limit how many cards one visitor can start per day we store a SHA-256 hash of your IP address mixed with a salt that changes daily. The hash is deleted after 7 days. Different days cannot be linked together and the IP cannot be recovered from the hash. The preview step before a scan counts plain IP addresses in the web server's memory for the current day only; that count is never written to the database.
• Where you came from. The referring site's host name, or a utm_source tag, never a full URL, so we can tell which channels send people.
• The card. The questions, the engines' answers and the sources they cited, which apps each answer named, and the counts. The card lives at a link with an unguessable 10-character ID.

A card shows nothing about the person who ran it. If you scan a rival's app the card looks the same as if they had. If the same app was scanned in the last 7 days you get that card again instead of a new run, and the page says so.

Signing in sends a one-time link to your email; there is no password. For an account we store:

• Your email address, the plan you are on, your theme choice and whether you want the Monday email.
• The apps you add (store link, name, developer, icon, market, and a Google Play package name if you give one), the rivals you pick, and your question set, including drafts we generate from the listing and your edits.
• The answers we collect for your questions every week: each engine's raw answer, the apps it named, the sources it cited, and what each call cost us.
• The changes you log (what you changed, where, since when, an optional link) and which suggestions you marked done or skipped.
• A log of each Monday email we sent you: address, date, whether it was delivered, and the delivery provider's ID.
• Sign-in session data handled by Supabase Auth, our authentication provider.

If you sign up from a report card you ran in the last 7 days, that card's answers are copied into your account as your first week of data.

We use these providers to run the service. Each one receives only what its job needs.

• Supabase (database and authentication), hosted in Frankfurt, Germany, in the European Union. Everything above is stored here. Row-level security means an account can only read its own rows.
• Cloudflare (web hosting) serves the site and runs report cards.
• Umami (visitor analytics, EU region) receives a page's path without IDs, the referring site, screen size, browser language and a few funnel steps (for example “report card viewed” or “checkout opened” with the plan name). It sets no cookies and gets no email, account, app or card ID.
• Sentry (error reports, stored in Frankfurt) receives technical details when the site or a job fails: the error, the page path and the browser and system version. We switched off IP addresses, cookies, headers, request bodies and user details, and email addresses in error text are masked.
• GitHub Actions runs the weekly measurement job and the daily report card clean-up. Data passes through the job while it runs and is not stored on GitHub.
• OpenAI, Google (Gemini), Perplexity and Anthropic receive the question text, with web search turned on, and return answers. Anthropic also receives each answer so a model can list the apps it names, and, when we draft questions for you, the public parts of the store listing, the keywords you give us, your rivals' names and the market. We call their APIs under their API terms. We never send your email address, your account or the fact that an account exists.
• Apple receives the App Store ID when we look a listing up.
• Resend (email delivery) receives your email address and the content of each Monday email, which is your app's numbers for the week. Sign-in links are sent through Supabase Auth or Resend.
• Paddle is the merchant of record for paid plans: you buy from Paddle, and Paddle collects your payment details, billing address and tax information under its own privacy policy. We receive your subscription status, your Paddle customer ID, your email and country. We never see or store card numbers.

We do not sell personal data and we do not share it with anyone else. Lawful basis, where the GDPR or a similar law applies: performing our contract with you (accounts, billing, the Monday email), and our legitimate interest in running a free, public measurement tool safely (the hashed IP, the referrer, the cached public listings).

• Sign-in cookies set by Supabase Auth keep you signed in. They are strictly necessary and are set only when you sign in.
• A short-lived cookie (30 minutes) remembers which page to return you to after you open a sign-in link.
• Your theme choice (light or dark) is kept in your browser's local storage so the page can paint in the right theme before it loads.

There are no advertising or social media trackers on the site. Visitor analytics (Umami) and error reports (Sentry) work without cookies or local storage and are described in section 4.

When you sign up from a report card, the copy of its answers in your account follows the account rules. The card itself stays at its link until it expires, and deleting your account removes its link to you. Clean-up runs daily.

Report card pages (/r/…) and their share images can be opened by anyone who has the link. We mark them noindex so search engines are asked not to list them, but a link that is posted somewhere public is public. We cannot take a card back once it has been shared, though every card expires after 90 days.

The engines' answers name apps and sometimes the people or studios behind them. That is public information from the App Store and the open web, and we store it to count who was named. If you are an app developer and want an answer that names you removed from a card, write to us.

• Monday email: switch it off in Settings or with the one-click unsubscribe link in every email. Your apps keep being measured and the report stays in the app.
• Deletion: in Settings, choose Delete account and type your email to confirm. It happens right away and can't be undone: everything in section 3 is deleted and you are signed out. If you have a paid plan we cancel it with Paddle first, effective immediately; the unused part of the period isn't refunded (see the Refund Policy), so cancel in Settings first if you want to use it up. We keep only the billing records in section 6, without your name or email. Paddle keeps its own records as merchant of record; ask Paddle to delete those. You can also ask us by email.
• Access, correction, export: email hello@appcited.app from the address on your account. We will answer within 30 days.
• Objection and restriction: you can object to processing based on legitimate interest; tell us what and why.
• Complaints: we are based in Türkiye, so the Personal Data Protection Law (KVKK) applies to us and you can complain to the Personal Data Protection Board (KVKK Kurulu). If you live in the EU or the UK you can also complain to your local supervisory authority, and we honour GDPR and UK GDPR rights for you.

Traffic is encrypted in transit. Database access is restricted by row-level security, so one account cannot read another's rows, and the keys that bypass it are only used by our server-side jobs. Sign-in uses one-time links that expire after 15 minutes. No system is perfectly secure; if we learn of a breach that affects you we will tell you without undue delay.

AppCited is a tool for app developers and is not directed at children. We do not knowingly collect data from anyone under 16. If you think we have, write to us and we will delete it.

We will post changes here and update the date at the top. If a change matters to you as an account holder, for example a new provider that receives personal data, we will also email you before it takes effect. The Terms of Service and Refund Policy are separate pages.