Privacy policy

Key points

• We collect little. An account needs a name and an email address, plus a password or a Google or GitHub sign-in. Everything else is the apps and keywords you choose to track.
• No ad trackers, no analytics cookies. We count visits with self-hosted, cookieless analytics. The only cookie we set keeps you signed in.
• We don't sell or share your data for advertising, and we never will.
• Keyword data isn't personal. Our data provider receives keywords, store codes and App Store IDs, never your name or email.
• You're in control. Delete apps, keywords and API keys any time, or email us to export or delete everything.

1. Who we are

Dekadans is an App Store keyword tracking and research service operated by Dekadans (“we”, “us”). We are the controller of the personal data described here. We are a small team and haven't appointed a data protection officer; privacy questions go to [email protected].

This policy covers the Dekadans website, web app, REST API, MCP server and the free keyword checker.

2. Data we collect

Data you give us

• Account details: name, email address and password. Passwords are stored only as a salted hash.
• Google or GitHub sign-in: if you sign in with Google or GitHub, we receive your name, email address, profile picture URL and account ID from that provider, and store the sign-in tokens it issues. We don't use them to access anything beyond your basic profile.
• Subscription data: if you buy Pro, Polar tells us your plan and subscription status (active, trialing, canceled), linked to your account ID. Your name and email address are shared with Polar for checkout and invoices.
• Workspace data: the apps (App Store IDs or names), home stores, keywords and storefronts you track.
• API keys: we store a hash of each key, its first characters so you can recognize it, its name and when it was last used. We can't see the full key after it's created.
• Messages: anything you send us by email.

Data collected automatically

• Session data: a session cookie, plus the IP address and browser user agent recorded with each sign-in session, used to keep you signed in and protect your account.
• Measurements and usage: the ranking, popularity and difficulty history we measure for your keywords, and a daily count of your research calls to enforce plan limits.
• Free keyword checker: your IP address is held in server memory only, to enforce the daily limit. It isn't written to our database and is discarded daily.
• Network logs: Cloudflare, which carries traffic to our servers, processes IP addresses and request metadata to deliver and protect the service.

Non-personal cached data

App Store search results, popularity scores and keyword suggestions are cached on our servers for up to a day and may be served to other users who look up the same keyword. This cache contains public App Store data only, not who requested it.

What we don't collect

We don't use advertising tools, tracking pixels, analytics cookies or cross-site tracking. We never receive or store your card details: payments are handled by Polar (see section 5).

Usage statistics

We run Umami, an open-source analytics tool, on our own servers. It records pages viewed, referrer, browser, operating system, device type and approximate country, plus a few events such as sign-ups and checkout starts. It sets no cookies and doesn't store your IP address; visits are counted with an anonymous identifier that changes daily. This data never leaves our servers and isn't shared with anyone.

3. How we use data

• To run the service: confirm your email address, sign you in, store your workspace, measure your keywords daily and answer research requests.
• To manage your Pro subscription and its billing through Polar.
• To enforce plan limits and prevent abuse, including the daily limits of the free checker.
• To keep the service secure and fix problems.
• To contact you about your account, security issues or changes to our terms and this policy.
• To comply with legal obligations.

We don't use your data for automated decisions with legal or similar effects, and we don't build advertising profiles.

4. Legal bases (EEA and UK)

• Contract: account, workspace and measurement data are needed to provide the service you signed up for.
• Legitimate interests: security, abuse prevention and rate limiting, including IP-based limits on the free checker, and cookieless usage statistics to improve the site.
• Legal obligation: where we must keep or disclose data by law.

5. Who processes data for us

• Cloudflare, Inc. (network, TLS and tunnel to our servers): IP addresses and request metadata. United States and global edge network.
• Polar Software, Inc. (merchant of record for Pro subscriptions): your account ID, name, email address, billing address and payment details you enter at checkout, to process payments, taxes, invoices and refunds. Polar acts as an independent controller for payment data under its privacy policy, and uses Stripe to process cards. United States.
• Resend, Inc. (transactional email): your email address and the confirmation link we send you. United States.
• Google LLC and GitHub, Inc., only if you choose to sign in with them: they authenticate you and share the profile data above with us. Your use of their sign-in is also governed by their own privacy policies.
• Our hosting provider runs the servers and database that store the data described above.
• Our keyword data provider receives keywords, store codes, device platforms and App Store IDs to return rankings, popularity and difficulty. No names, emails or IP addresses.
• Apple's public App Store lookup receives App Store IDs and store codes to fetch app names and details.

We share data with authorities only when legally required, and with a successor if Dekadans is sold or merged, under this policy.

6. AI assistants and the MCP server

The MCP server is off until you create an API key and connect a client. Once connected, the AI assistant you choose (for example Claude, Codex or Cursor) can read and change your workspace data through that key, and the assistant's provider processes that data under its own terms and privacy policy. We secure the endpoint; we don't control what third-party assistants do with data they receive. Revoke a key in Settings to cut off access immediately.

7. Cookies

We set one strictly necessary cookie: the session cookie that keeps you signed in. Cloudflare may set strictly necessary security cookies. Our analytics are cookieless, and we don't use advertising or cross-site tracking cookies, so there's no cookie banner to dismiss.

8. How long we keep data

Deleted data may remain in backups for a limited time, where it stays protected and isn't used.

9. Security

All traffic is encrypted with TLS. Passwords and API keys are stored hashed. Access to production data is limited to the people who operate the service. No system is perfectly secure; if a breach affects your personal data, we'll notify you and the relevant authorities as the law requires (within 72 hours where GDPR applies).

10. International transfers

Our processors may handle data in the United States and other countries. Where EEA or UK law applies, we rely on adequacy decisions or Standard Contractual Clauses (and the UK addendum) for these transfers.

11. Your rights

Wherever you live, you can ask us to:

• access your personal data or receive a portable copy (JSON);
• correct inaccurate data;
• delete your account and personal data;
• restrict or object to processing based on legitimate interests.

Email [email protected] from the address on your account so we can verify it's you. Requests are free. We respond within 30 days (45 days where US state law allows), and tell you if we need more time. You can delete apps, keywords and API keys yourself in the dashboard at any time.

California and other US states

Residents of California (CCPA/CPRA) and of states with similar laws, such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon, have the right to know, access, correct and delete personal information, and to opt out of its sale, sharing for cross-context behavioral advertising, and profiling. We don't sell or share personal information and don't do targeted advertising, so there is nothing to opt out of. We won't treat you differently for using your rights. You may use an authorized agent; we'll verify the request with you. If we deny a request, you can appeal by replying to our answer.

Categories collected in the last 12 months:

We don't collect precise geolocation, biometric or other sensitive data, and we don't sell or share any category above.

EEA and UK

Under the GDPR and UK GDPR you also have the right to withdraw consent where we rely on it and to complain to your local data protection authority (in the UK, the Information Commissioner's Office, ico.org.uk). We'd appreciate the chance to fix things first.

12. Children

Dekadans is a professional tool for app developers and marketers and isn't directed at anyone under 16. We don't knowingly collect data from children. If you believe a child has given us data, email [email protected] and we'll delete it.

13. Changes

We'll update the date at the top when this policy changes. For material changes we'll notify account holders by email or with a notice in the app before they take effect.

14. Contact

Dekadans · [email protected]. See also our terms of service.