Privacy Policy

TODO — Your Registered Company Name (StoreRank), registered under number TODO — company / registration number at TODO — Street address, TODO — Postal code TODO — City, TODO — Country, is the data controller for the personal data described in this policy.

For anything to do with privacy, write to privacy@storerank.app. We answer within 2 business days.

StoreRank is a local-first macOS application. The following never leaves your device and is never transmitted to us:

• The apps you track and the keywords you research.
• Your notes, tags, targets and saved competitor lists.
• Ranking history and every chart derived from it.
• Apple Search Ads credentials. If you connect them, the private key is stored in the macOS Keychain and the signing token is generated on-device.
• App Store Connect credentials and any listing content you draft in the app.

Requests to Apple’s public endpoints are made directly from your Mac. We operate no proxy and keep no log of which terms or apps you look at. The personal data we do hold, described below, exists only to sell you a licence and support you.

We do not buy personal data, we do not sell it, and we do not use your content to train machine-learning models.

Lemon Squeezy, LLC is our merchant of record. When you buy a subscription you contract with them for the payment, and they process your payment details as an independent controller under their own privacy policy. We never see or store your full card number.

We receive from them the order record needed to issue and support your licence: your name, email, country, plan and order reference.

The marketing website uses a small number of cookies and similar technologies. Non-essential ones are set only with your consent, which you can withdraw at any time. The full list, and how to control them, is in our Cookie Policy.

The macOS application itself sets no cookies and shows no ads.

We share personal data only with the service providers we need to run the business, each bound by a data-processing agreement and permitted to use the data solely for us. The current list, with the country each operates in, is published at Sub-processors.

We may also disclose personal data where we are legally required to, to establish or defend legal claims, or to a buyer as part of a merger or sale of the business — in which case we will tell you before your data becomes subject to a different policy.

Some of our providers are outside the UK and the European Economic Area, principally in the United States. Where personal data is transferred there, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where relevant), together with the additional safeguards agreed with each provider. You can ask us for a copy of the relevant safeguards.

• Billing and invoice records — for the period required by tax law in our jurisdiction, typically 7 to 10 years.
• Licence records — for as long as the licence is active, plus 24 months.
• Support correspondence — 24 months after the conversation ends.
• Crash reports — 90 days.
• Website analytics — 14 months, in aggregate form.

When a retention period ends we delete the data or irreversibly anonymise it.

We keep the amount of personal data we hold deliberately small, which is the strongest control available to us. In addition: all traffic to our website and licence service is encrypted in transit with TLS; data at rest is encrypted by our hosting providers; access to production systems is limited to those who need it and protected by multi-factor authentication.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and tell you without undue delay.

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — a copy of the data we hold about you.
• Rectification — correction of anything inaccurate.
• Erasure — deletion, where we have no overriding obligation to keep it.
• Restriction and objection — including to processing based on legitimate interests.
• Portability — your data in a structured, machine-readable format.
• Withdrawal of consent — at any time, without affecting earlier processing.

To exercise any of them, email privacy@storerank.app. We respond within 30 days and never charge for a first request.

If you are unhappy with our response you can complain to your local data protection authority — for us, TODO — e.g. the Czech Office for Personal Data Protection (ÚOOÚ).

If you are in California

You have the right to know what personal information we collect, to request deletion, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising any right.

The Service is a professional tool intended for people aged 16 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, write to privacy@storerank.app and we will delete it.

We update this policy when our practices or the law change. The date at the top always reflects the current version. If a change is material we will email active customers before it takes effect.