Privacy Policy
Last updated 31 October 2026
This policy explains what AppRate (“we”) collects when you use AppRate, why, and the choices you have. Questions: [email protected].
What we collect
- Account data: your email address, a hashed password (or your Google account identifier if you sign in with Google), and your workspace and team membership.
- Settings you provide: workspace name, alert email, Slack, Microsoft Teams and Discord webhook URLs, and reply guidance.
- Credentials you connect: App Store Connect API keys, Google Play service-account keys, and Zendesk, Jira or Freshdesk API tokens. These are encrypted at rest (AES-256-GCM) and used only to read reviews, post the replies you send and create the tickets you ask for.
- Public store data: app listings, ratings, reviews and search rankings that are publicly available on the App Store and Google Play, plus reviews and responses from your connected developer accounts. Reviews include the reviewer nickname the store shows.
- Technical data: server logs (IP address, browser, timestamps) kept for security and debugging.
How we use it
- To run the service: sync store data, show dashboards, send the alerts you configure, and post replies you approve.
- To label reviews (sentiment, topics, language, likely spam), draft and translate replies, and suggest store listing text with AI, when that feature is enabled.
- To secure the service, prevent abuse and fix problems.
- To email you about your account and important changes. We don't send marketing email without your consent.
We don't sell personal data and don't use it for advertising.
Service providers
We use these processors to run apprate. Each only receives what it needs for its job.
| Provider | Purpose |
|---|---|
| Supabase | Database and authentication |
| Fly.io | Application hosting |
| Cloudflare | DNS, network security and storage of app icons |
| Amazon Web Services (SES) | Sending email |
| Anthropic | AI labelling of reviews, reply drafts, translations and listing suggestions. Anthropic does not use API data to train its models. |
| Stripe | Payments for paid plans, as merchant of record. Stripe collects your card and billing details; we never see the card number. |
| Apple, Google | Reading store data and posting your replies through their official APIs |
| Slack | Delivering alerts, only if you add a webhook |
Some providers process data outside your country, including in the United States, under appropriate safeguards.
Retention
We keep your data while your account is active. Deleting your account (Settings → Your account) removes your login and every workspace where you're the only member, including its connected keys and stored reviews. Backups roll off within 30 days.
Your rights
Depending on where you live you can access, correct, export or delete your personal data, and object to or restrict some processing. Email [email protected] and we'll respond within 30 days. You can also complain to your local data protection authority.
Cookies
We use only the cookies needed to keep you signed in and remember your selected workspace. No advertising or tracking cookies.
Changes
If we change this policy in a meaningful way we'll email account owners before it takes effect.