Privacy Policy
Last updated: 2026-10-16
Short version
We collect your email address when you register an API key, and standard request metadata needed to run and protect the service. We run no ads, no trackers, no analytics scripts. We never sell data.
What we collect
- Email address — only when you self-register an API key. Used to send a one-time verification code and to identify your key.
- Verification codes — a 6-digit code stored with your email for 30 minutes, then it expires automatically.
- Request metadata — our hosting provider (Cloudflare) processes IP addresses, timestamps and requested URLs as part of standard operation, abuse prevention and rate limiting.
- Usage counters — monthly usage counted against your API key (no content), retained about 35 days.
What we do NOT collect
- No accounts, passwords, or payment details (no billing is active).
- No tracking cookies, pixels, or third-party analytics. The site loads a Google Fonts stylesheet; Google may process that request like any font fetch. Nothing about you is shared with them by us.
- No behavioral profiling.
Third-party processors
- Cloudflare — hosting, caching (KV), logs, rate limiting.
- Zhipu AI (open.bigmodel.cn) — for pain-point clustering we send excerpts of public app-store review text. No email addresses, keys, or identifiers of our users are sent.
- Resend — delivers the one-time verification email to your address.
- Apple / Google public endpoints — the data sources we read on your behalf.
Data retention
- Verification codes: 30 minutes.
- Cached app data (reviews, metadata, analyses): 6 hours to 7 days, then automatic expiry.
- API key records: until revoked; revocation is soft (record kept for audit, key immediately inactive).
- Usage counters: ~35 days.
- Platform logs: per Cloudflare's retention policy.
Your rights and choices
Email apppainapi@proton.me to have your key revoked and your email record deleted. Deletion removes the key record and pending data; cached analyses of public reviews are not personal data and expire on their own schedule. If you are in the EU/UK, this serves as our lawful-basis statement: legitimate interest in operating a public API service; you may object at any time via the same address.
Changes
If this policy materially changes we will update the date above. Continued use after changes means acceptance.