When you sign in, we store your email address (via Supabase authentication). When you connect billing credentials, we encrypt and store those credentials to pull aggregate revenue metrics on your behalf.
Billing credentials are encrypted with AES-256-GCM using a server-side encryption key before being stored in the database. Plaintext credentials are never stored. We only accept restricted or read-only keys — full-access keys are rejected at connection time.
Only aggregate metrics: MRR, 30-day revenue, active customer count, and unit count. We do not store transaction-level data, customer PII, or any detail beyond these aggregates.
Revoking a connection wipes your stored credentials immediately and marks the connection as revoked. Deleting an app removes the app record, all connections, and all revenue snapshots. These actions are irreversible.
The free analyzer tools run entirely in your browser. They call public endpoints directly — no data is sent to our servers. We do not log or store what you search for.
If you connect billing and your app appears in the verified directory, your app name, website, and aggregate revenue metrics are publicly visible. Credentials and contact details are never shown publicly.
We use Supabase for authentication and database hosting. We do not sell or share your data with third parties. Billing credentials are used solely to pull aggregate metrics from the provider you connected.
Questions about privacy? Reach out via the contact email associated with your app.