Privacy

We hold your email address, which apps you look at, and which search phrases you save. That is close to all of it. We do not sell anything to anyone, and we do not run advertising trackers.

Zen Labo Ltd, registered in England and Wales, is the data controller. Email [email protected] about anything on this page.

You can look up an app without paying or signing in. Doing that creates no account, and we store nothing that identifies you. Our servers keep ordinary request logs — the address the request came from, the page, the time — for a short period, to keep the service running and to spot abuse.

One cookie is set once you have seen the introduction, so that we do not show it again. It holds nothing but that fact.

If you arrive from one of our emails, the link carries a short campaign name. We count that visit against the campaign — so we can tell which emails were useful and stop sending the ones that were not — and keep the name in a cookie for up to 30 days so a later purchase can be counted too. It says which mailing the link was in, not who you are.

Your account identifier and email address. Firebase Authentication provides a unique identifier after you sign in with Google or email. We use it to keep your apps, trial and subscription attached to the same account. We do not receive or store your password.

Your Stripe customer reference. So we can connect a payment to an account. We do not receive or store card numbers.

Which apps you look at, which phrases you save, and which competitor apps you register. This is the service. We need it to show you your list and to check your rankings each day.

A sign-in cookie. A signed cookie holding only your account reference, so you stay signed in for 90 days.

The lawful basis for all of the above is performance of a contract — we cannot run the service you paid for without them.

When we measure a search phrase we keep that measurement and reuse it for every customer. Those records are about phrases and public search results. They do not say who asked, and they are not linked to your account.

Account and service email — password resets, receipts, changes to these terms, and important service notices. You cannot opt out of these while you have an account because they are part of running it.

Introductory email to app developers. We also contact developers who have published an app, using the contact address they published with it, to tell them what their app ranks for. The lawful basis is legitimate interests — reaching a business about something directly relevant to it. Every one of those emails has an unsubscribe link, and one click stops all of them. You can also email us and we will remove you.

If you tell us to stop, we keep the minimum needed to remember that — normally a hash of your address — so that we do not contact you again by mistake.

No card details, no name, no address, no phone number. No advertising trackers. The little we measure about usage — which email campaign a visit came from, and which of our own screens get used (through PostHog, listed below) — is never joined with anything outside this service. We do not build a profile of you across other websites. Nothing here is used for automated decisions with a legal effect on you.

The service is not for children, and we do not knowingly collect anything about anyone under 18.

None is for advertising. One keeps you signed in. One remembers that you have already seen the introduction. One remembers which of our email campaigns brought you here (a short campaign name, nothing about you), for up to 30 days. PostHog, our usage analytics, also keeps an identifier in your browser so that two visits count as one person — it is used for nothing else and shared with no one. Clearing them signs you out and shows the introduction again.

Stripe — payments. They receive your email and card details directly; we receive your email and a customer reference back.

Google Cloud and Firebase Authentication — where the service runs, where the data is stored, and how accounts, Google sign-in and password resets are handled.

PostHog — usage analytics. It records which pages and buttons are used so we can see where the product confuses people. Screen recording is off, and it is not used for advertising.

They act on our instructions and may not use your data for their own purposes. That is the whole list. We do not sell or share your data for anyone else's marketing.

If the business is ever sold or merged, your data may transfer with it. We would tell you before that happened.

On Google Cloud, in the United States. Transfers out of the UK are covered by the standard contractual clauses and the UK addendum.

Traffic is encrypted in transit. Access to stored data is limited to the people who run the service. Passwords and Google credentials are handled by Firebase Authentication and are not stored in our database. Our own session cookie is signed and HttpOnly.

No system is perfectly secure. If something happens that puts your data at risk, we will tell you and the regulator where the law requires it.

While your account is active, and for 12 months after you stop, so you can come back to your history. Ask us to delete it sooner and we will, except where we must keep payment records for tax purposes — those we keep for six years.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, or object to what we do with it. Where we rely on legitimate interests — the introductory email above — you can object and we will stop.

Email us and we will answer within one month. We do not charge for this.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office (ico.org.uk). We would rather you told us first.

If we change what we collect or who we share it with, we will update this page and email you.