Privacy Policy
Last updated 23 October 2026
This policy explains what apprate (“we”) collects when you use apprate, why, and the choices you have. Questions: hello@apprate.io.
What we collect
- Account data: your email address, a hashed password (or your Google account identifier if you sign in with Google), and your workspace and team membership.
- Settings you provide: workspace name, alert email, Slack webhook URL and reply guidance.
- Store credentials you connect: App Store Connect API keys and Google Play service-account keys. These are encrypted at rest (AES-256-GCM) and used only to read reviews and post the replies you send.
- Public store data: app listings, ratings, reviews and search rankings that are publicly available on the App Store and Google Play, plus reviews and responses from your connected developer accounts. Reviews include the reviewer nickname the store shows.
- Technical data: server logs (IP address, browser, timestamps) kept for security and debugging.
How we use it
- To run the service: sync store data, show dashboards, send the alerts you configure, and post replies you approve.
- To label reviews (sentiment, topics, language) and draft replies with AI, when that feature is enabled.
- To secure the service, prevent abuse and fix problems.
- To email you about your account and important changes. We don't send marketing email without your consent.
We don't sell personal data and don't use it for advertising.
Service providers
We use these processors to run apprate. Each only receives what it needs for its job.
| Provider | Purpose |
|---|---|
| Supabase | Database and authentication |
| Fly.io | Application hosting |
| Cloudflare | DNS, network security and storage of app icons |
| Amazon Web Services (SES) | Sending email |
| Anthropic | AI labelling of reviews and reply drafts. Anthropic does not use API data to train its models. |
| Apple, Google | Reading store data and posting your replies through their official APIs |
| Slack | Delivering alerts, only if you add a webhook |
Some providers process data outside your country, including in the United States, under appropriate safeguards.
Retention
We keep your data while your account is active. Deleting your account (Settings → Your account) removes your login and every workspace where you're the only member, including its connected keys and stored reviews. Backups roll off within 30 days.
Your rights
Depending on where you live you can access, correct, export or delete your personal data, and object to or restrict some processing. Email hello@apprate.io and we'll respond within 30 days. You can also complain to your local data protection authority.
Cookies
We use only the cookies needed to keep you signed in and remember your selected workspace. No advertising or tracking cookies.
Changes
If we change this policy in a meaningful way we'll email account owners before it takes effect.