Privacy policy
1. Controller
Tobias Goral, Carrer Fastenrath 176, 08032 Barcelona, Spain, email: info@appreviewx.com. This is also our contact for privacy questions.
2. What we process and why
- Account: email address, password hash (never plain text), language, time of sign-up and last use, your acceptance of the terms with version and time. Purpose: running your account and the contract (Art. 6(1)(b) GDPR). If you sign in with Google or Apple we only receive an identifier and your verified email address, no password and no other profile data.
- Profile (optional): nickname and profile photo. Both are visible to developers you are connected to through a task, test group or chat. We never show your email address to other users. Without a nickname you appear as "Dev" with a number (Art. 6(1)(b)).
- Apps and content: listed apps (name, store link, platform, category, icon), feedback text and screenshots. Feedback and screenshots are visible only to the tester and the owner of the tested app. Anonymous publication as a developer review happens only if tester and owner agree (Art. 6(1)(b) and (a)).
- Store data: for each app we read the name, icon and rating from the public store page (Apple iTunes lookup, Google Play). No data about you is sent, only the public address of the app and the IP address of our server (Art. 6(1)(f): up-to-date display in the interest of developers).
- Test groups and packs: the Google account email you give for a test group. Only the app owner sees it and may use it solely to add you to the test (Art. 6(1)(b)).
- Messages (chat): message text, sender, recipient, time and read status, block lists. Chat is possible only between developers who share a task or test group. We do not read messages routinely. Only when a message is reported, moderation sees it (Art. 6(1)(b); moderation: (f) and (c) together with the DSA).
- Credits, purchases and history: balance, booking history (for example "Feedback accepted", "Credits purchased") and purchase numbers. Paddle sells the credits as merchant. We receive no payment details, only purchase number, pack and amount (Art. 6(1)(b); retention duties (c)).
- Invitations: anyone who signs up through your invite link is linked to your account so you receive the bonus. You see only counts, never names or email addresses (Art. 6(1)(b)).
- Emails: confirmation, password reset, receipts and notifications about your tasks, packs and test groups. This is not a newsletter. You can switch off optional notifications in your profile (Art. 6(1)(b)). They are sent via ein selbst betriebener Mailserver auf demselben Server bei dogado GmbH.
- Security and moderation: reports of illegal content, our decisions with reasons and the log of moderation actions, account suspensions (Art. 6(1)(f) and (c)).
- Server logs: IP address, time, requested address, status and browser identifier. Purpose: security, debugging, abuse prevention (Art. 6(1)(f)). Logs are rotated daily and deleted after 52 days.
No automated decision with legal effect takes place. The optional AI check of screenshots (see below) is only a hint to the app owner, who decides.
3. Cookies and local storage
We set only strictly necessary cookies and show no advertising. Fonts are served from our own server. A session cookie is set for login (legal basis section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR).
| Name | Purpose | Duration | Consent |
|---|---|---|---|
session | Login session | 14 days | not required (strictly necessary) |
ar_nonce | Protection for sign-in with Google or Apple | 10 minutes | not required |
ar_consent (local storage) | remembers your cookie choice | 12 months | not required |
ref (session storage) | remembers an invite code until you sign up | until the tab is closed | not required |
4. Recipients and processors
- Hosting: Alfahosting GmbH, Deutschland. Where required, a data processing agreement (Art. 28 GDPR) is in place with the provider.
- Email delivery: ein selbst betriebener Mailserver auf demselben Server bei dogado GmbH.
- Paddle (Paddle.com Market Limited, merchant of record and payment processing, separate controller for payment data): the Paddle script loads only when you open the credit purchase.
- Google and Apple only if you sign in with them, and when we read public store data (see above).
- Anthropic (USA): only if the automatic screenshot check is enabled, an uploaded screenshot is sent for checking. The result is only a hint for the app owner.
- Authorities and courts where we are legally required to.
5. Retention
- Account, profile, apps, feedback, messages and history stay until you delete your account. On deletion we remove them, except purchase records.
- Purchase records are kept for the commercial and tax retention periods, usually up to ten years, without a link to your profile.
- Reports and moderation decisions are kept for up to three years so we can prove decisions and review objections.
- Server logs: 52 days.
- For suspended accounts we keep the account with the reason to prevent the same person from signing up again (Art. 6(1)(f)).
6. Your rights
You can export your data (JSON) and delete your account yourself in the app under "Profile". You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests (Art. 15 to 21 GDPR). You can withdraw consent at any time with effect for the future. Write to info@appreviewx.com. You may also complain to a data protection authority. The one responsible for us is the Spanish Agencia Española de Protección de Datos (aepd.es); you can also contact the authority where you live.
7. Security
The connection is encrypted with HTTPS. We store passwords only as hashes. Uploaded images are stored outside the public web directory, accepted only as PNG or JPEG and served without execution rights.
8. Changes
We update this policy when the service changes. The version published here applies.