Privacy Policy

ASOGrade is a keyword research tool for the App Store. This page describes exactly what it stores, why it stores it, who can access it, and how you can have it removed. It is written to be read, not to be survived.

What we collect and why

We collect only what is needed to run the service. Nothing more.

• Your email address and Google profile info. When you sign in with Google, we receive your email address, name, and avatar from Google and use them to identify your account and tie your keyword list to you. We do not send marketing emails unless you explicitly opt in. Authentication is handled by Supabase.
• The keywords you look up. Stored against your account so your list persists between sessions and across storefronts. You own this list — you can delete individual keywords at any time inside the app, or request full deletion by email.
• Keyword scores. Popularity, difficulty, and competing-app counts are cached per keyword and storefront. This cache is shared across all accounts and contains no personal information — it is simply a performance optimisation so a keyword scored yesterday does not need to be re-fetched today.
• Basic request logs. Our hosting provider (Vercel) retains standard server logs (IP address, timestamp, path, response code) for a short period for security and debugging purposes. These logs are not analysed for marketing or advertising.

What we do not collect

• No payment card details. If billing is added, card data goes directly to the payment processor (Stripe) and never reaches our servers.
• No passwords — sign-in is exclusively via Google OAuth. We never see, receive, or store a password.
• No advertising, analytics, or cross-site tracking cookies. The only cookie is the one Supabase sets to keep you signed in.
• No selling, renting, or sharing of your keyword list or email address with third parties for commercial purposes.
• No profiling or automated decision-making that produces legal or similarly significant effects.

Who processes your data

Your data passes through a small number of carefully chosen sub-processors:

• Vercel — hosting, CDN, and edge request logs. Data centres in the US and EU.
• Supabase — relational database and authentication. Your email and keyword list live here. Supabase is SOC 2 Type II certified.
• Apple — public App Store lookups are made to resolve app names and icons when you analyse a competitor. These requests contain an App Store app ID, never anything that identifies you.

Keyword scores are sourced through a licensed third-party desktop tool running on hardware we control. It receives a keyword string and a storefront code — nothing that identifies you or your account.

Cookies and local storage

ASOGrade uses a single session cookie set by Supabase to keep you signed in. No third-party advertising cookies are set. No analytics scripts (Google Analytics, Mixpanel, etc.) are loaded. If you block all cookies, you will not be able to sign in, but the public marketing pages will still work.

Data transfers

ASOGrade is incorporated and operated from India. Supabase and Vercel may store data in the United States or European Union depending on region configuration. By using ASOGrade you acknowledge that your data may be transferred to and processed in these jurisdictions. We apply standard contractual clauses and rely on sub-processors that maintain adequate protection under applicable data protection law.

How long we keep your data

Your keyword list and account remain active until you delete them or ask us to close your account. Cached keyword scores are refreshed on a rolling daily basis and are not personal data. Server logs are retained by Vercel for up to 30 days. Ask us to delete your account and everything tied to your email — keywords, scores linked to your user ID, and the account record itself — is permanently removed within 30 days.

Your rights

Depending on where you are located, you may have rights under applicable law including:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to fix inaccurate data.
• Deletion: Request that your account and associated data be permanently erased.
• Portability: Ask for your keyword list in a machine-readable format (CSV).
• Objection: Object to processing in certain circumstances.

To exercise any of these rights, email support@asograde.com from your account address. We will respond within 30 days.

Children

ASOGrade is not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

Security

All data is transmitted over HTTPS. Supabase encrypts data at rest. We follow industry-standard practices including access controls, least-privilege principles, and dependency audits. No system is perfectly secure; if you discover a vulnerability, please disclose it responsibly to support@asograde.com.

Changes to this policy

If this policy changes in a way that affects what we collect or how we use it, the date at the top of this page updates and all account holders are notified by email at least 14 days before the change takes effect. Minor clarifications (grammar, formatting) will not trigger a notification.

Contact

Questions, deletion requests, or data access requests: support@asograde.com