Draft · operator review required before launch

Privacy policy draft.

This document is not an approved production policy. The operator must confirm the responsible entity, contact, processors, lawful basis and retention before launch.

Planned data

Accounts use email sign-in. Connections, library items, watches, reports and event inboxes support the user’s requests. The store does not hold credentials for listed apps. Deliberately submitted developer feedback is saved in a private inbox with its message, receipt id, timestamp and retry-nonce hash. Profiles, conversation transcripts and contact details are not automatically attached. Feedback is not linked to an account and is not removed by account deletion; the operator must review feedback retention before activation.

Measurement

Usage instrumentation is designed for daily aggregate counters with fixed surface and transport labels. It does not retain request bodies, search text, credentials, IP addresses, raw user agents or referrers. Optional server-side PostHog measurement records selected API or MCP operation names, success or failure, status class and event time without inputs, outputs or headers. Person profiles and GeoIP enrichment are disabled. By default each event uses an independent random identifier. If the operator enables connection funnels, a dedicated secret derives a pseudonymous identifier for one verified connection for one UTC day; raw connection and account identifiers are never sent. No browser analytics, cookies, autocapture or replay are added. PostHog is a US-hosted processor when this option is enabled; retention, lawful basis and production settings need operator approval before activation. Deployment settings must be reviewed separately.

Deletion and access

The API provides account export and deletion operations. The guide describes the retention and deletion behaviour implemented by the service.