Privacy policy

Who we are

AppHitlist operates the AppHitlist website and related services. Contact us at hello@apphitlist.com.

Data we collect

Account data: name, email address, and an OAuth provider identifier when you sign in with Google or GitHub.

Preferences: preferred language, email alert settings, and the apps on your watchlist.

Subscription status linked to your account (managed by Creem as merchant of record).

Technical logs such as IP address and request metadata, used for security and rate limiting.

Anonymous page-view counts: page path, referring website, UTM tags, country, browser, operating system and device type, and a daily-changing code. No cookies, and the IP address is not stored in these records.

We store with your account which link brought you at signup (source, medium, and campaign name, for example instagram / bio). We read it from a cookie if you accepted cookies; otherwise, unless you rejected cookies, we match your sign-up to your anonymous visit of the last 24 hours. It contains no personal data and is deleted when you delete your account.

Purposes and legal bases

We process account and subscription data to provide the service under a contract with you.

We use Sentry for error monitoring and send limited server-side events to PostHog (signup, login, welcome-step answers, first app views, which locked figures you click, API key creation and first MCP call, newsletter subscription, saved-app limit, checkout, payment and subscription events). We also keep these events, plus which app profiles you open, in our own database to measure whether new accounts find value; they are deleted with your account. This is done on the basis of legitimate interest (no browser cookies).

We count page views without cookies on the basis of legitimate interest, to understand which links and pages bring visitors.

Browser analytics with PostHog and Google Analytics run only after you give consent through our cookie banner.

Processors

Creem processes payments, tax and invoices as merchant of record.

Resend sends transactional email. Sentry receives error reports. PostHog and Google Analytics receive analytics events when you consent.

Cloudflare R2 stores media files. The application is hosted on Hetzner.

International transfers and retention

Some processors may process data outside Türkiye or the European Economic Area. We rely on their contractual safeguards.

We keep your account data until you delete your account. Creem retains billing records as required by law.

Your rights

Under the GDPR and Türkiye’s KVKK you may access, rectify, export or delete your data, object to certain processing, and lodge a complaint with a supervisory authority (including the KVKK Kurulu).

You can delete your account from the Account page. To export your data or make other requests, email hello@apphitlist.com.