Privacy Policy

1. Owner and data controller

DigitMind Technologies LLP, Astana, Kazakhstan.
Contact: support@applistinglab.com

This Policy covers:

• the AppListingLab website at applistinglab.com, including the free tools under /tools and the developer documentation under /docs;
• the AppListingLab studio at studio.applistinglab.com, where you sign in and work on your projects;
• the AppListingLab API at api.applistinglab.com.

Together these are the "Service". This Policy supplements the Terms of Service.

2. Data we collect

Account data

• Your email address, display name, email-verification status, profile picture if you add one, and the identifier of your sign-in account. If you use Sign in with Google, Google shares your name, email address, and profile picture with us. Passwords are handled by our authentication provider and are never sent to AppListingLab's servers.
• If you allowed analytics before signing up: how you first found us (the referring site, the first AppListingLab page you opened, and campaign tags in the link), saved once when your account is created.
• If you separately agree to Google Ads conversion measurement in the studio after following one of our ads: the Google Ads click identifier associated with that visit, when available, your advertising measurement choice and its time, whether you created a new account, whether you reached your first useful project result, and whether you made your first confirmed payment. A first useful project result means the first saved Screenshot Studio set or ASO listing result recorded for your account. For that result we use only the fact and time that it occurred, not your screenshots, listing copy, prompts, or other project content. The payment record also includes its amount and currency.

Content you provide

• App screenshots and images you upload or link to, App Store / Google Play URLs you submit, app profile details (name, description, brand colors, audience, tone), and text you enter for generation.
• Assets the Service generates for you (screenshot sets, listing copy, icons, media), stored so you can return to them.

Store connections (paid plans)

• If you connect App Store Connect or Google Play Console to publish from the studio: the credential you paste in (an API key or service account key) and the app it applies to. Credentials are encrypted at rest, never shown back to you, and deleted when you disconnect the store or delete the project.
• A history of your publish runs: what was sent to which store and the result.

API keys

• If you create API keys: each key's label, its first characters (so you can recognize it), and when it was last used. The full key is shown to you once; we store only a one-way hash of it. Requests made with a key are handled like studio requests and draw on the same credits.

Usage and technical data

• With your consent (see Section 5): product events such as pages viewed, tools used, and generation actions, together with the page path, your browser type, a random browser identifier, and, when you are signed in, your account identifier.
• Service events our servers record as part of running your account and billing, whatever your analytics choice: for example, reaching a plan limit, opening a checkout, or completing a purchase. These are recorded against your account only.
• Usage and AI-credit counters, credit balances, and records of credit charges and refunds, kept to enforce plan limits.
• IP addresses and request details, which our servers process to deliver the Service, keep it secure, and apply rate limits. IP addresses are not stored with analytics events.

Product analytics is first-party: usage events go to our own servers and are not shared with third-party analytics or advertising providers. Optional Google Ads conversion measurement is a separate choice and sends only the limited conversion data described below. We do not use session recording.

Billing data

• Paid plans and credit packs are sold through our reseller Paddle, in Paddle's own hosted checkout. Your card number and other payment details are entered directly with Paddle and never reach our servers. From Paddle we receive your subscription status, plan, billing interval, renewal date, and transaction history (including credit-pack purchases and refunds), so we can apply the correct limits and show them to you in Billing.
• If you cancel and choose to tell us why, we keep your answer.

Communications

• Messages you send through the feedback form on our sites: your message and its category, your email address, an optional name and reply-to address, and the page you sent it from. Feedback is also forwarded to an internal team chat so we see it quickly.
• Messages you send us by email, and our replies.
• Account emails, such as email-address verification and password reset, which are sent through our authentication provider.

The free tools (app icon generator, image set generator, screenshot resizer) process your images entirely in your browser; those files are not uploaded to our servers.

3. How we use data

• to provide the Service: accounts, generation, storage, exports, API access, and billing;
• to run AI generation: the content needed for a specific generation is sent to our AI model providers only to produce your assets;
• to publish to App Store Connect or Google Play Console when you ask us to, using the credentials you connected;
• to understand and improve the product (first-party analytics and error reports);
• if you separately agree, to measure whether our Google Ads led to a new account, a first useful project result, or a first confirmed payment;
• to enforce usage limits and protect the Service from abuse;
• to respond to your messages and to comply with legal obligations.

We process data on the legal bases of performance of a contract (the Service itself), our legitimate interests (service events, security, abuse prevention), your consent (browser analytics and, separately, Google Ads conversion measurement), and compliance with legal obligations. We do not sell personal data, use account details or your content for remarketing, or use your content to train AI models.

4. Service providers

We use a small number of service providers (processors) to run the Service. Each receives only the data its function requires and processes it on our behalf under its own contractual and privacy terms.

• Cloud hosting and infrastructure: the servers that run the website, studio, and API.
• Database and file storage: account data, projects, generated copy, usage counters, and uploaded and generated files.
• Authentication: email/password and Google sign-in, sign-in sessions, and account emails such as verification and password reset.
• AI model providers: text, vision, image, and video generation. They receive the app details, images, and prompts needed for the specific generation you request.
• Team communication tools: internal notifications of feedback you send us.
• Paddle: payment processing, invoicing, tax collection, and our reseller (merchant of record) for paid plans and credit packs. Paddle receives the billing details needed for your purchase; see Paddle's Privacy Policy.

Google Ads is an optional measurement service. If you agree in Studio, we send the ad click ID and tell Google when you create an account, when you first save a Screenshot Studio set or ASO listing result, or when you make your first confirmed payment. For the project result, we send only that the event occurred and when; we do not send the screenshots, listing copy, prompts, or other project content. For the payment, we also send the amount and currency. We do not send your email address, phone number, project content, or product usage history. We do not use this data for remarketing or personalized ads. Google handles data it receives under its Privacy Policy.

We also exchange data with these services when you ask us to:

• Apple App Store and Google Play: when you submit a store URL, we fetch that app's public listing text and screenshots. When you publish, we read your current listing to show you what will change, then send the listing text and images you confirmed to App Store Connect or Google Play Console using the credential you connected.
• Google: when you use Sign in with Google.

Apple and Google handle that data under their own terms and privacy policies.

5. Cookies and browser storage

Essential (always on)

• Sign-in: when you sign in to the studio, our authentication provider keeps your session in browser storage on studio.applistinglab.com and refreshes a short-lived sign-in token. We also keep that token in an encrypted, HTTP-only applistinglab_session cookie on the same domain, which expires after 12 hours. Browser scripts cannot read this cookie; the studio's own server uses it only to authenticate your requests to the AppListingLab API. It never contains your password.
• Functional settings: a few values kept in your browser so the site works as expected, such as your cookie choice, whether we have already shown you a notice or a feedback prompt, and the status of generations in progress. They stay in your browser and are not used for analytics or advertising.

Analytics (only with your consent)

• If you accept, we store a random identifier in your browser's local storage so our own statistics can recognize returning visitors. If you arrived from another site, we also keep the referring site and any campaign tags for up to 30 days, and save them with your account if you sign up. None of this is shared with third parties or used for advertising, and no third-party analytics scripts run on our sites.
• Until you accept, no analytics identifier is stored and your browser sends no analytics events.

Google Ads conversion measurement (separate, optional choice)

• If you reach our website from a Google ad, its click identifier may pass to the studio through a link fragment. Our public website does not save that identifier. In the studio we ask separately whether we may save it and report the limited conversions listed in Section 4. Accepting first-party analytics does not grant this permission.
• If you decline, we do not retain that click identifier or report conversions to Google Ads. If you accept, the identifier is kept for no longer than 30 days. We do not load Google Ads tracking scripts on the website or in the studio.

The website and studio share your first-party analytics choice in a preference cookie on applistinglab.com for up to one year, so moving between them does not ask you the same question again. You can change this choice at any time with Cookie preferences in the footer: declining removes the stored analytics identifier and campaign data and stops further analytics events from that browser. Advertising measurement has its own control in the studio's privacy preferences; withdrawing that choice removes the stored ad click identifier and stops future Google Ads conversion reports. It cannot erase a conversion already received by Google. Essential storage and the service events described in Section 2 are unaffected by either optional choice.

6. Retention

• Account data and everything filed under your account (projects, generated assets, store credentials, API keys, credit balances, billing records we hold, feedback, and analytics events): kept for the lifetime of your account and for a 30-day recovery period after you request deletion. You can cancel during that period. Future subscription renewals are cancelled when the request is accepted; already-paid access keeps its existing end date, and final deletion starts after the recovery deadline. Backup copies are purged on rotation shortly after. Paddle keeps its own transaction records as merchant of record. To make sure a deletion finishes, we keep a minimal record of it that contains only internal identifiers.
• Store credentials: until you disconnect the store or delete the project, if that happens before you delete your account.
• Temporary publishing data (images prepared for upload to a store): deleted automatically within 24 hours.
• Raw analytics events, both browser and service events: deleted automatically after 90 days. After that we keep only daily totals, which contain no identifiers.
• Google Ads click identifiers used for optional conversion measurement: deleted within 30 days of the ad click, when you withdraw consent, or when final account deletion runs, whichever comes first. We may retain a minimal record that you consented, withdrew consent, or that a conversion was sent, without keeping the click identifier beyond this limit.
• Feedback sent without an account: kept as long as we need it to follow up and improve the product. Ask us and we will delete it.

7. Sharing and international transfers

Data is shared only with the service providers and services described in Section 4, with authorities where legally required, and in the context of a business transfer (merger, acquisition) under equivalent protections. Our service providers operate internationally (including in the United States and the European Union); we take commercially reasonable steps to ensure transfers comply with applicable legal requirements.

8. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, or a portable copy of your personal data, restrict or object to certain processing, and withdraw consent where processing is based on it. You can update your profile and delete your account yourself from Account settings in the studio. For anything else, write to support@applistinglab.com; we respond within a reasonable time and verify your identity before acting. You may also lodge a complaint with a supervisory authority where you live.

9. Children

The Service is not directed to children. You must be an adult under the law that applies to you to use it, and we do not knowingly collect personal data from minors. If you believe a minor has provided us data, contact us and we will delete it.

10. Security

Passwords are handled by our authentication provider and never reach AppListingLab's servers. Data is encrypted in transit (TLS). Store credentials are also encrypted at rest, and API keys are stored only as one-way hashes. Access to production data is restricted, and the API is rate-limited. No system is perfectly secure; notify us immediately at support@applistinglab.com if you suspect a breach of your account.

11. Changes to this Policy

We may update this Policy; changes appear on this page with an updated date. Material changes are additionally announced in the product or by email where reasonably possible.