Privacy Policy

1. Who this policy covers

AppGazers (referred to here as “we”, “us” or “our”) operates appgazers.com and its associated API and Model Context Protocol (MCP) service. This policy covers visitors, account holders, people who contact us or receive our business communications, and people whose information appears in the public sources we index. We determine the purposes and means of the processing described here. Contact us at [email protected] for privacy questions or requests.

This policy is a notice about our practices, not a request to waive your rights or consent to every use of information. Our Terms and Conditions address use of the service. Independent stores, websites and AI assistants have their own privacy policies.

2. Information you provide

• Account information: Google sign-in supplies your Google account identifier, name, email address, profile image and email-verification status. We record account creation and sign-in activity. We do not receive your Google password or request access to your Gmail messages, contacts or Drive files for sign-in.
• Workspace information: onboarding answers, preferred stores, countries and categories, saved apps, ads and keywords, folder names, watchlists and tour progress. Research requests and searches also reach our service when you use a feature.
• Connections and usage: API token records, authorized OAuth clients, scopes, connection and usage dates, feature usage counters, credit ledger entries, referral codes, referral qualification and rewards. Tokens and connection credentials are sensitive; do not share them in public links or messages.
• Communications: the email address, message and attachments you send to us, and records needed to deliver welcome, service or product communications. Do not send unnecessary sensitive personal information.

3. Technical information and public sources

Our servers, hosting and security providers process request information such as IP address, time, URL, browser or device details, response status and security events to deliver and protect the service. A country indication supplied by our network provider is used for advertising-cookie settings. Referral and campaign information can include UTM values, the referring website’s hostname, the landing-page path and a timestamp; attribution can be associated with your account when you first sign in.

We index public app-store and extension-store listings, publisher and developer profiles, ratings, reviews and advertising-transparency information. These records can include personal information such as a developer’s or reviewer’s public name, profile identifier, website, public contact email address, review text or information appearing in an ad. Public availability does not remove privacy rights. Contact us with the record URL and your relationship to the information to request correction, removal or an objection review.

We may use publicly listed developer business contact details and app information to prepare relevant research introductions about AppGazers, where lawful. Outreach records include the contact source, app or developer identifiers, messages, send dates, delivery and reply outcomes, opt-outs and campaign attribution. The outreach workflow does not use email-open tracking pixels; following a tagged link can still create the website attribution described above.

We also create market estimates and derived statistics. These are research models, not access to a developer’s private financial accounts or an app user’s private activity.

4. How we use information

• Authenticate accounts, remember preferences, synchronize saved research and provide requested API or MCP functions.
• Measure usage, administer credits and referrals, prevent fraudulent rewards and enforce access limits.
• Operate, troubleshoot and improve the service, understand feature use and measure acquisition and advertising.
• Respond to support and rights requests, send account and service messages, and handle product communications and objections to them.
• Maintain the public research catalog, investigate abuse, protect rights and comply with applicable legal obligations.

Where the GDPR or UK GDPR applies, the relevant bases are performing a contract for requested account and workspace functions; legitimate interests for proportionate security, support and public market research after considering people’s rights; legal obligations where applicable; and consent where required for optional tracking or communications. Calling an activity a legitimate interest does not override consent requirements for cookies or advertising. You may object to processing based on legitimate interests and to direct marketing.

For developer outreach, a legitimate-interest basis may be available for relevant business introductions only where the applicable marketing rules permit it and after considering the recipient’s rights. Where prior consent is required, public contact information does not replace it. To stop promotional emails, reply “no” or use the unsubscribe method in the message, or email our contact address. We keep a minimal suppression record to avoid contacting someone again after an opt-out; this does not authorize further marketing.

Credit and referral qualification uses automated rules. We do not use these records to make decisions intended to produce legal or similarly significant effects on you. If you believe a qualification or access decision is wrong, contact us for review.

5. Cookies, local storage and analytics

We use cookies and browser storage for sessions, security, onboarding, saved research, appearance, attribution and tracking choices. Signing out clears account onboarding cookies; some preferences or saved browser data can remain until you clear them.

• Session and preference storage: authentication sessions are configured for up to 30 days. The onboarding-completion cookie lasts up to 30 days. Theme, research and other local-storage preferences can persist until removed.
• Attribution: the ag_ft campaign cookie lasts up to 90 days; the ag_ref referral cookie lasts up to 30 days. Removing a cookie does not remove attribution already recorded with an account.
• PostHog: when configured, it collects product analytics, such as page views, interactions, device details and identifiers. Signed-in activity is associated with the AppGazers account identifier; our identity integration does not explicitly send your name or email. Depending on project settings, session replay can capture page content and interactions. Avoid entering secrets into research fields.
• Google Firebase Analytics: the browser integration measures visits and usage and can process browser or device identifiers and event information. See Firebase’s privacy information and how Google uses information from partner sites.
• Meta Pixel: when configured, it measures page views and completed registrations on eligible pages. Meta can receive network and browser information and associate events with its own identifiers. This can constitute targeted-advertising “sharing” under some laws. See Meta’s Privacy Policy.

Current controls: the advertising banner and “Cookie settings” control Meta Pixel only. It waits for acceptance outside Bangladesh; in Bangladesh it can load by default unless a stored refusal exists. The current PostHog, Firebase Analytics and attribution integrations operate separately from that banner. Declining Meta does not switch those integrations off. We do not currently provide an automatic Global Privacy Control response.

You can use the available Cookie settings control to change Meta consent, use browser controls to block or clear storage, and email us about objections or sale/sharing opt-out requests where applicable. Clearing storage may sign you out, remove locally saved research or cause a tracking choice to be asked again; browser blocking is not a substitute for our legal obligations. Withdrawing consent does not affect lawful processing before withdrawal.

6. Who receives information

Information is handled by people operating AppGazers and by providers used for hosting, databases, backups, network delivery and security, authentication, analytics, error monitoring and email. Integrations include Cloudflare for network protection, Google sign-in, Google Firebase Analytics, PostHog, Meta when its Pixel is enabled, Sentry when error reporting is configured, Resend for configured account/product email delivery, Zoho Mail for developer outreach, and Hostseba for support and legacy mail. Outreach can come from our separate tryappgazers.com domain. Providers receive information needed for their role; some, including advertising platforms, also process information under their own policies.

Public catalog information and associated market analysis are available to visitors, account holders and authorized API/MCP clients according to the feature’s access rules. Your saved workspace is not a public profile. When you authorize an AI assistant or other client, requested research and account-specific tool results can be sent to that client within its granted access. The client’s operator controls its own storage, model use and onward disclosure. Review its terms before connecting; use Connect AI to revoke connected apps, and contact us if you need help revoking a legacy personal token. Revocation does not erase copies already received by the client.

Opening external links or playing embedded media can disclose your IP address and browser information to the destination. We may disclose information when legally required, to address fraud or threats, or in a business transfer subject to applicable privacy duties. These circumstances do not authorize unrestricted sale or disclosure of personal information.

7. Retention, transfers and security

Retention depends on the record’s purpose: account and saved research records support ongoing use; usage, referral and credit records support limits, reconciliation and fraud prevention; security logs and backups support recovery and investigations; public records support catalog history and accuracy. Daily feature-usage counters are scheduled to expire after 400 days; this does not delete related credit or referral ledger records. Records may also be retained where law requires them or for necessary legal claims. The browser lifetimes above do not describe all server or provider retention. We have not published a single fixed deletion period for all records; contact us for information about a specific category.

Providers and connected clients may process information in countries other than yours, with different legal protections. Our default PostHog integration uses its United States cloud endpoint. Where applicable law requires a transfer safeguard, such as an adequacy decision or standard contractual clauses, the transfer must have a valid safeguard or another lawful transfer basis. Contact us about the destinations and safeguards relevant to your information. Using the service is not blanket consent to international transfers.

We use access controls and other technical and organizational measures designed to protect information. No online service can guarantee absolute security. If we identify a personal-data breach requiring notification, we will notify the relevant people or authorities as required by applicable law.

8. Your choices and privacy rights

Depending on where you live and the law’s applicability, you may request access or a copy, correction, deletion, portability, restriction, withdrawal of consent, or objection to processing. California residents may also have rights to know categories, sources, purposes and recipients, to correct or delete information, to opt out of sale or sharing, to limit certain uses of sensitive personal information, and to use an authorized agent. These rights apply when the relevant law covers the processing; we do not claim every statutory regime applies to every visitor.

Send requests, including account-deletion requests, to [email protected]. Identify the account or public record and the action requested. We may ask for proportionate verification or an agent’s authority; do not send passwords, API tokens or identity documents unless specifically needed through an appropriate channel. We will respond within applicable legal deadlines, explain any lawful refusal or retention exception, and will not unlawfully discriminate against you for exercising rights.

You can remove saved items and revoke connections using the workspace. Signing out or disconnecting Google does not itself delete AppGazers records. Account deletion is handled by request rather than a self-service button. Some legal, security or reconciliation records may need to remain, and backup copies may persist until their normal replacement, subject to applicable obligations.

You may complain to your local data-protection authority, including an EU supervisory authority or the UK Information Commissioner’s Office, where applicable. You do not have to contact us before exercising a regulator complaint right.

9. Children and policy changes

AppGazers is a professional research service intended for adults aged 18 or older. We do not knowingly seek children’s personal information. If you believe a child has provided information, contact us so we can investigate and take appropriate action.

We will update the date above when this policy changes and provide additional notice where required for material changes. New purposes must have their own lawful basis; updating this page does not retrospectively create consent.