Privacy Policy

Last updated: 6 October 2026

This policy explains what personal data AsoBeast collects, why, who receives it, how long it is kept and what you can do about it. It covers:

the website at asobeast.com and the documentation at docs.asobeast.com,
the hosted AsoBeast service at app.asobeast.com, including its REST API and MCP server,
the emails the service sends and any message you send us.

It does not cover a copy of AsoBeast you run on your own server. That case is described in Self-hosted installations.

Who we are

AsoBeast is operated by Adex77, an independent developer based in Poland, who is the data controller for the processing described here. In this policy “AsoBeast”, “we” and “us” mean Adex77.

For anything about your personal data, write to support@asobeast.com.

The short version

We collect what is needed to run your account, bill you and track the apps and keywords you choose.
We use Google Analytics on the website and in the app to understand how they are used, only after you accept analytics cookies.
We use Sentry to catch errors, with account details, cookies, headers and request bodies stripped out.
Plans are sold through Link, a Stripe affiliate, which uses your checkout details under its own privacy policy. We never see or store your card number.
We never collect data about your app’s users, and we do not sell personal data.
You can export everything and delete your workspace at any time.

What we collect

When you visit the website

Usage data, if you accept analytics cookies: pages viewed, how you arrived (referrer and campaign parameters), approximate location derived from your IP address, device, browser and language. This is collected by Google Analytics.
Technical data that any web server receives: IP address, browser and the page requested. Our hosting and delivery provider uses it to serve the page and protect the site from abuse.

When you use the hosted service

Account data you give us

Email address and a hash of your password. We never store the password itself.
Your display name, if you set one.
The names and emails of teammates you invite.

Workspace data you give us

Store URLs and identifiers of the apps you track, your competitors and groups.
Keyword phrases and the markets you track them in.
Alert settings, webhook URLs and email recipients.
The iOS keyword field, if you paste it in.
Personal API tokens, which we store only as a hash.

Data we derive for you

Rankings, search results, listing snapshots, category ranks, public reviews of the apps you track, audits, keyword scores and recommendations. All of it comes from publicly visible App Store and Google Play pages.

Billing data

Your plan and subscription status, and the details you enter at checkout: billing name, email and address, and a tax ID if you add one. Link needs them to charge you, calculate tax and issue your invoice, and shares the order details with us so we can attach the plan to your workspace. Card details are entered in Link’s own checkout and never reach our servers.

Usage and technical data

Usage data from Google Analytics, if you accept analytics cookies, as described above.
Server logs with the request path, workspace identifier, a correlation identifier and timing. Secrets are removed before a line is written.
Error reports sent to Sentry, described in Who receives your data.
A record of each AI call: which feature you ran, for which app, when, the model and the number of tokens. It counts your monthly AI allowance and never holds the prompt or the answer.

Messages

What you write to us by email or through support, and our replies.

What we never collect

Your app’s users. AsoBeast reads public store listings. It has no SDK, no tracking pixel and no way for your users’ data to reach us.
Card numbers. Link and Stripe handle them.
Advertising identifiers. We run no advertising cookies and do not use your data for ads.

Why we use it and our legal basis

Where the GDPR applies, each use rests on one of these legal bases:

What we do	Legal basis
Create and secure your account, run the daily tracking, send alerts	Performance of our contract with you
Manage your subscription and keep accounting records	Contract, and our legal obligations under tax law
Send service emails: confirmation, alerts you set up, billing notices	Performance of our contract with you
Measure how the website and app are used with Google Analytics	Your consent, which you can withdraw at any time
Find and fix errors with Sentry, keep server logs, prevent abuse	Our legitimate interest in a working and secure service
Count AI calls against your plan’s monthly allowance	Performance of our contract with you
Answer your messages and handle complaints	Contract, or our legitimate interest in answering you
Send product news	Your consent. We send none without it
Respond to lawful requests and defend legal claims	Legal obligation, or our legitimate interest in defending one

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Cookies

We use as few cookies as the service needs, plus analytics cookies only when you accept them.

asobeast_session, set by the app. Keeps you signed in. Strictly necessary. Kept for 7 days.
sidebar_state, set by the app. Remembers whether the sidebar is open and carries no identifier. Kept for 7 days.
_ga and _ga_*, set by Google Analytics. Count visits and tell returning visitors from new ones. Kept for up to two years.
Stripe and Link cookies, set on the checkout and billing pages and on link.com for payment security, fraud prevention and, if you choose to save your details with Link, faster checkout, under their own policies.

Strictly necessary cookies do not need consent. Google Analytics cookies are set only after you accept them in the cookie banner, and your browser remembers your choice so the banner does not return on every visit. You can change it at any time from the cookie settings link in the footer, or by clearing cookies in your browser.

Who receives your data

We use service providers that process data on our behalf, under data processing terms that bind them to our instructions. They are:

Hosting and content delivery runs the website, the app, the database and the queue. It receives everything the service stores and the IP address of each request.
Google Analytics (Google) measures website and app usage, with your consent. It receives pages and screens viewed, events, device and browser, and approximate location. Google Analytics 4 does not store IP addresses.
Sentry (Functional Software, Inc.) monitors errors. It receives the error type, a message and stack trace with secrets removed, workspace and correlation identifiers, and the request path with identifiers masked. It never receives your account details, cookies, headers, query strings or request bodies.
Webshare carries requests to the App Store and Google Play. It receives the store request itself, a keyword phrase and a storefront, and no account data.
An email delivery provider sends confirmation, alert and billing emails. It receives the recipient address and the message body, which can name your apps and keywords.
An object storage provider holds offsite backups. It receives encrypted archives only. The key never leaves our control, so the provider cannot read them.
OpenAI powers the optional AI features. It receives the listing metadata of the app you run a feature on, at the moment you run it.

Stripe and Link

When you buy a plan, Sold through Link, LLC, an affiliate of Stripe, sells it to you as the merchant of record. Stripe and Link run the checkout, the payment, tax collection, receipts, invoices and the billing portal. They process your name, email, billing address, tax ID, payment details and order details as independent controllers, not under our instructions, as described in the Link privacy policy and Stripe’s privacy policy. We pass them your email and a workspace identifier when you start a checkout, and they share the order details with us.

We may also disclose data when the law requires it, to protect our rights or the safety of others, or to a buyer of the service if AsoBeast is ever sold, in which case this policy continues to apply to your data.

We do not sell or rent personal data, and we do not use one customer’s keywords to serve another.

AI features

AI features are optional. A request goes to OpenAI only when you invoke one, never on a schedule or in the background. It carries the title, subtitle, description and keyword context of the app you ran it on. On the hosted service those requests use our OpenAI account and are processed under OpenAI’s API terms, which do not allow OpenAI to train its models on them. If you do not want this, do not use the AI features.

International transfers

We are based in the European Union. Some providers above, including Google, Sentry and OpenAI, may process data in the United States or other countries outside the European Economic Area. Where they do, the transfer is covered by the EU-US Data Privacy Framework for certified companies, by the European Commission’s Standard Contractual Clauses, or by another safeguard recognised under Chapter V of the GDPR. You can ask us for a copy of the relevant safeguard.

Stripe and Link also process checkout data in the United States, where Sold through Link, LLC is based. They transfer the data they control under the safeguards described in their own privacy policies.

How long we keep it

Data	Kept for
Account and workspace data	While your account exists, then deleted as described below
Keyword rankings and category ranks	365 days
Search result entries	90 days
Listing snapshots	180 days, and the newest snapshot of each app is always kept
Reviews, listing changes, audit scores	While you track the app
Closed action items	180 days
Alert delivery log	30 days
AI call records	400 days, and the current month is always kept for the allowance
Billing events stored by the app	90 days
Receipts, invoices and payment records	Kept by Link as seller of record, under its own legal obligations
Our own accounting records	As long as tax and accounting law requires, usually five years after the tax year
Server logs	30 days
Google Analytics data	At most 14 months
Error reports	At most 90 days
Backups	56 days, encrypted
Support messages	As long as needed to resolve your request and any follow-up

Export and deletion

You can export every row your workspace owns at any time, from the app as CSV or JSON, or as a complete archive through the API.

The workspace owner can delete the workspace from Settings. Deletion waits seven days so it can be cancelled, then removes the workspace and everything it owns, and cancels any subscription. Three limits apply:

Backups still hold the deleted data until they rotate out, at most 56 days later.
Stripe and Link keep their own payment records under their legal obligations. Link keeps your receipts and invoices as the seller of record, so ask Link directly about those.
A keyword phrase that other workspaces also track is shared and carries no owner, so it stays while anyone tracks it.

The full detail is in Data export, deletion and retention.

Your rights

Under the GDPR and similar laws you have the right to:

access the personal data we hold about you and get a copy,
correct data that is wrong,
delete your data,
restrict how we use it,
port it to another service in a machine-readable format,
object to processing based on our legitimate interests,
withdraw consent at any time, which does not affect processing that happened before.

Most of this you can do yourself in the app. For the rest, write to support@asobeast.com. We answer within one month, which the law allows us to extend by two further months for complex requests, and we may ask you to confirm your identity first.

You can also complain to a data protection authority. Ours is the President of the Personal Data Protection Office in Poland (uodo.gov.pl), and you can also go to the authority in the country where you live or work.

California residents have the right to know, delete and correct personal information and not to be discriminated against for using those rights. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you.

Security

Passwords are hashed with Argon2, API tokens are stored only as hashes, traffic is encrypted in transit and backups are encrypted before they leave the server. Access to production data is limited and every support access is logged. No system is perfectly secure. If a breach puts your rights at risk we will notify the supervisory authority within 72 hours and tell you without undue delay where the law requires it.

To report a vulnerability, follow the security policy.

Children

AsoBeast is a professional tool for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, write to us and we will delete it.

Self-hosted installations

AsoBeast is open source under AGPL-3.0. If you run it on your own server, we receive nothing from it: the software sends no telemetry and contacts no service of ours. Every outbound integration, such as email, webhooks, OpenAI or a proxy, stays off until you configure it. You are the controller for everything your installation holds, and this policy does not apply to it.

Changes to this policy

We will post changes on this page and update the date at the top. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.

Contact

Adex77, Poland. Email: support@asobeast.com