Privacy Policy

Last updated: October 26, 2026

Data controller

Storelift is operated by Volkan Günay, an individual based in Türkiye, who is the controller of your data. Any question: hello@storelift.net.

What we collect

For your account we store: your email, the app identifiers you add (App Store id / package name), your keywords, and the measurement history we produce from them. On a paid plan we also store your subscription status, plan, amount and your customer id at the payment provider; card details never reach us. If you use the contact form we keep the name and message you write. The website collects no phone numbers or device identifiers. The iPhone app stores your device's notification token only if you turn notifications on (see "The iPhone app" below). We set no tracking cookies of our own (Microsoft Clarity's cookies are described below).

The iPhone app

The Storelift iPhone app (App Rank Tracker by Storelift) uses the same account as the website. In addition to what is described above, it handles the following:

Sign-in. You can sign in with Apple, Google or your email and password; all three go through the same sign-in service (Amazon Web Services) as the website. With Sign in with Apple, Apple gives us an identifier for your Apple account, your email address and, if you choose to share it, your name. If you choose to hide your email, we receive an Apple private relay address instead, and our emails reach you through Apple.
Notifications. Notifications are optional. If you allow them, we store your device's notification token on your account, together with the app language, to tell you when a rank you track changes; alerts are sent on every plan, Free included. Alerts go through the Apple Push Notification service and carry the app name and a short line about the change (keyword, country, rank). The token is removed when you sign out in the app or when Apple reports that it is no longer valid; otherwise it expires 120 days after the app last refreshed it. A separate record linking the token to the last account signed in on that phone expires on the same 120-day schedule. You can turn notifications off at any time in your iPhone's Settings.
App Store purchases. Subscriptions bought in the app are paid to Apple; your card details never reach us. RevenueCat receives your Storelift account id and the purchase and subscription events for it. On your account we store the plan, product, subscription status, renewal or expiry date, and whether the purchase was a test (sandbox) purchase.
Platform marker. We record whether your account was first created on iPhone or on the web, and the last day you used each. We use this only for our own usage statistics.
No tracking. The app shows no ads and contains no advertising or third-party analytics tools. It does not track you across other companies' apps or websites.

How the site and dashboard are used

To improve the product we run a cookieless measurement on our own servers: the pages you open, time spent on them, where you came from (e.g. the link you clicked), your time zone, and steps such as signing up. It is kept under a random identifier specific to the browser tab; your IP address and device identifiers are not written to it. If you are signed in, that tab's record is associated with your account. Tab-level records are deleted automatically after 30 days; anonymous daily totals (e.g. daily visit counts) remain. None of it is shared with third parties.

On public pages, including sign-up and email verification, we use Microsoft Clarity to see how the site is used: it builds heatmaps and session replays from clicks, scrolls and mouse movement. It never loads on the dashboard, the sign-in, password reset, invitation and contact pages, or personal links such as shared links and unsubscribe links. It doesn't load when the page opens, only on your first interaction (click, key press or tap). Once loaded, Microsoft may set cookies on its own domains (clarity.ms, bing.com); Clarity sets no cookies on our domain. It does not record text you type into form fields: on sign-up and verification, every field and the line showing your email address are masked. Microsoft's privacy statement: privacy.microsoft.com.

IP addresses and technical logs

The tab-level record above does not contain your IP address. Other parts of the service do process it:

Daily visitor count. To avoid counting the same visitor twice, your IP address and browser details (user agent) are combined with a random value that changes every day and turned into a short one-way code. The IP address itself is not stored in this count. The random value is set to expire after two days and the codes after 45 days.
Server logs. Requests to our API are logged with the IP address, browser details, time, the address requested and the result. These logs are set to be kept for two weeks and are used to fix faults and stop abuse.
Abuse protection. Request limits are counted with short codes derived from the IP address and the date; these are set to expire within two days. If an address is blocked for abuse, the address itself stays on the block list until the block is lifted.
Account and workspace security. When you are signed in, the IP address of your most recent session is stored on your account. Changes made in a workspace (for example adding or deleting a keyword) are written to an audit log with the user, the action, the time and the IP address. The log is kept for 365 days and can be seen by the workspace owner and admins.

Emails we send

In our product, alert and newsletter emails we measure whether an email was opened and whether its links were clicked. To do this, a small invisible image is added to the email and links are routed through our email provider, Amazon Web Services. We do this to see which emails are actually useful and to send fewer of the rest. We keep only total counts per email type and day; we don't record who opened which email or what they clicked. Sign-in and security emails (verification codes, password resets) are not measured. If your email app doesn't load images automatically, opens aren't measured either.

What we measure

Rank and rival figures come from the public endpoints of the App Store and Google Play (search results, ratings, autocomplete). We don't connect to your accounts for these.

Retention and deletion

Data is stored encrypted and never sold. Keyword rank history and reviews are kept for as long as your account exists and are not deleted. Top chart ranks, store listing changes, competitor events, alerts, AI visibility results, and revenue, download and store conversion history are kept for at least 560 days; older records may be deleted. Your plan sets how far back the screens can look: Free 30 days, Pro 9 months, Studio up to 18 months, Enterprise unlimited. Rank history outside that window is not deleted and shows again after an upgrade. Account deletion follows the process below.

Connections

If you want revenue, download or ad figures, you can connect your own accounts (App Store Connect, Google Play, Apple Ads, RevenueCat, Adapty, Google Analytics, AdMob). These credentials are stored encrypted, never shown back on any screen, and deleted when you remove the connection. Connecting is optional; the product works without it.

RevenueCat and Adapty webhooks contain more than aggregate figures: we also process subscription and purchase events, user or profile identifiers that can be associated with an app end user, product, store, country, amount and source or cohort information. Normalised event records receive a 400-day retention setting and user or cohort records an 800-day setting; some user record updates renew that period. Expired records are removed in the background. Account deletion is described below.

Store measurements and our models

We keep the public App Store and Google Play measurements we make for the apps and keywords our customers track in a shared market data pool (Hive), and use them to improve Storelift's estimates and scores, such as keyword popularity, difficulty and download estimates. Data from accounts you connect, such as App Store Connect, Apple Ads or RevenueCat, can feed these shared models only in aggregated, de-identified form: one customer's figures are never shown to other customers, customer identity is not used as a model feature, and which apps and keywords a customer tracks is not revealed to anyone else. Google Analytics and AdMob data is not used for this (see the Google section below). The scores and estimates the models produce are derived data and may be shown to all customers. Deleting your account removes your workspace's records; public store measurements and aggregated data derived from them may stay in the pool. To ask about this use or to object to it, email hello@storelift.net.

AI and conversation history

Ask Storelift may send your question, the conversation history you submit, page context and relevant parts of reports you are authorised to access to the AI provider to prepare an answer. Personal information in an input or review text may also be included in the content sent.

Ask questions and answers are stored as workspace history with a 90-day retention setting. A record also includes the names of tools used, the requesting user, model information and any feedback. History visibility depends on workspace roles and data access permissions. Expired records are removed in the background. This period does not describe retention in the AI provider's own systems.

In the iPhone app nothing is sent to an AI provider until you allow it on the AI data sharing screen. You can withdraw that consent at any time in Account › AI data sharing; the next AI request then asks again. Withdrawing doesn't affect requests already made.

AI assistant connections (MCP)

When you connect an AI assistant such as Claude or ChatGPT to Storelift, the assistant sends us the name and inputs of each tool it calls, such as an app id, a keyword or a storefront, and we answer from your workspace's data. The conversation itself stays with the assistant's provider. The assistant's provider receives the tool results and handles them under its own privacy policy.

For each connection we keep the assistant's name, its return address, when you approved it, the permissions you approved and its usage counts. Write actions, such as tracking a keyword, replying to a review or changing a campaign, show a preview first, are applied in a second step and are recorded in the workspace's audit log. Calls use your workspace's credit balance. Access tokens expire after one hour and refresh tokens after 30 days; removing the connection under Settings → API → Connected apps ends its access.

Service providers

We process data with these providers only to run the service:

Amazon Web Services — hosting, database and sign-in (Frankfurt, Germany); email delivery (Stockholm, Sweden).
Polar — payments and invoicing; as merchant of record it takes the payment.
Google — sign-in if you use Google; Analytics/AdMob reports if you connect them.
Microsoft — usage measurement on public pages via Clarity (loads on first interaction; Microsoft may set cookies).
Anthropic — Storelift AI questions, keyword ideas, store text drafts, screenshot text reading, review summaries and reply drafts, and AI visibility measurement. Sent content may include store details, keywords, review text, your question, conversation and page context, and parts of reports accessed within your permissions. Personal information in these inputs may also be sent.
Apple — in the iPhone app: App Store subscriptions, Sign in with Apple and push notifications. Processes your Apple sign-in identifier and email address (a private relay address if you hide yours), subscription status, the device's notification token and the short alert text (United States).
RevenueCat — subscription records for purchases made in the iPhone app: your Storelift account id, product, purchase and renewal dates, and subscription status (United States).

AI visibility questions may also be sent to OpenAI and Google Gemini. Each provider listed here processes personal data only on our instructions to run Storelift and is bound by contract to protect it to at least the standard described in this policy and required by Apple's App Store guidelines.

Slack, Telegram, Google Sheets and webhook destinations you connect receive enabled reports or events; destination copies follow that provider’s retention settings.

Storelift's own data is stored in the EU (Frankfurt). Some of the providers above process data outside Türkiye, mostly in the US.

Data from your Google account

If you connect Google Analytics or AdMob, we read read-only report data only: user counts, sessions, country breakdown and ad revenue summaries. We change nothing in your account and never request write access.

Storelift's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice that means:

We use this data only to run the screens you see in your own dashboard.
We do not use it for advertising, do not sell it, and do not transfer it to third parties.
No human reads it — unless you explicitly permit it or the law requires it.
Removing a connection deletes its stored credentials. You can also revoke source access in the provider console. Previously collected reports are retained separately; use account deletion or the contact below to request their removal.

Deletion

You can delete your account in the iPhone app under Account › Delete account, or by emailing hello@storelift.net from the address on the account. In the app you sign in again and type your email address to confirm; for an account that uses Sign in with Apple, the app's Apple authorization is also revoked. For an email request, we verify that it came from that address and start the same process.

Deletion starts with a 30-day waiting period. During it you can sign in and choose "Keep my account" on the website or in the app to cancel the deletion. When the period ends, account and app records, including notification tokens, are cleaned from the primary database and removal of sign-in records is requested. A minimal deleted-account marker has a further 30-day expiry setting; expiry processing is asynchronous. Backups expire under their own retention policy; anonymous totals are separate.

Subscriptions paid through Polar on the web are ended when deletion starts. Deleting your account does not cancel an App Store subscription: cancel it in your Apple ID subscription settings (the app reminds you before you delete). You can also exercise your rights under GDPR and KVKK (access, correction, deletion, objection, portability) by emailing hello@storelift.net. Financial records needed for accounting are retained separately by Storelift and Polar for the periods required by their applicable obligations. Email suppression records are also retained during account deletion to prevent unwanted email from being sent again. Shared caches of public store data are outside the scope of account deletion.