Sign in

Privacy Policy

Last updated: 11 November 2026

This policy explains how personal data is processed on the App Store Operator website (https://app-store-operator.com), its dashboard and its services (together, the "Service"). It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, for people in the European Economic Area, under Articles 13 and 14 of the General Data Protection Regulation ("GDPR").

1. Who we are

The Service is run by Nefarius Apps Bilgi Teknolojileri Limited Şirketi ("Nefarius", "we"), Fatih Sultan Mehmet Mah. Balkan Cad. Meydan İstanbul AVM No:62A, 34771 Ümraniye/İstanbul, Türkiye, MERSIS No. 0630141599800001.

For the data described in sections 3 to 7, Nefarius is the data controller (veri sorumlusu). For the data our customers send or connect for their own apps (sections 8 and 9), the customer is the controller and Nefarius processes the data on the customer's behalf, as its processor (veri işleyen).

Paid plans are sold and charged by Yusuf Demirci, the founder of Nefarius, as an individual (see our Terms of Use, section 3). For the billing data of paid plans (section 10), Yusuf Demirci is the data controller.

Contact for anything in this policy: [email protected].

2. The Service today

App Store Operator is in early access. Sign-ups may be limited or opened in stages; while they are closed, the website lets you join a waitlist. This policy covers the website, the waitlist, accounts and the dashboard; we will update it if what we process changes.

3. Waitlist

When you join the waitlist we collect:

  • your name and email address;
  • the language of the page you used;
  • which button on the page you used to open the form;
  • the page that sent you to our site (referrer) and the campaign tags in the link you followed (UTM source, medium, campaign, term and content), if any.

We use this data to send you a confirmation email ("you're on the list") and one email when sign-ups open, in your language, and to see which pages and campaigns bring people to the waitlist. We do not use your email for other marketing and do not sell or share it.

Legal basis: taking the steps you asked for before a possible contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)), and for the referrer and campaign tags, our legitimate interest in measuring our own marketing (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

Retention: until we send the launch email and for at most 12 months after sign-ups open, unless you create an account, then deleted. You can ask us to remove you at any time by writing to [email protected].

To protect the form against abuse, we count sign-up attempts per IP address in memory for one hour. That count is never written to our database.

4. Website analytics

We measure visits to the website with Umami, an analytics tool we host ourselves. It sets no cookies and stores nothing on your device. Our server passes your IP address to Umami only so that it can determine your country; Umami does not store the IP address. It records the page you visited, the referring site, campaign tags, your browser, operating system, device type, screen size, language, country and the buttons you clicked. It is used only for aggregate statistics about our own website, and nothing is shared with advertising networks.

Legal basis: our legitimate interest in understanding how our website is used (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

5. Accounts and the dashboard

If you have an account we process:

  • your email address, name, preferred language and a securely hashed password (we never store your password in readable form);
  • your workspaces, their members and roles;
  • what you do in the dashboard (for example metadata drafts, replies to reviews, funnels you create) and when.

We use this data to provide the Service, keep your account secure, and send you emails the Service needs to send (for example password resets). Legal basis: performance of our contract with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).

Retention: for as long as your account exists. You can ask us to delete your account at any time by writing to [email protected] from the email address on your account; we then delete this data within 30 days, except what the law requires us to keep.

6. Technical logs and security

When your browser or app talks to our servers we log the request: time, address requested, response, duration, your IP address, browser user agent and, if you are signed in, your user ID. We use these logs to keep the Service secure and working, to investigate errors and to prevent abuse. They are deleted automatically after 90 days. Requests to the Events API (section 9) are logged without the IP address.

To find and fix errors, our servers, the website and the dashboard send an error report to Sentry when an error occurs in the live Service. A report contains the type and message of the error, where in our code it happened (stack trace), the method and path of the request (without the query string), a short trail of the steps before the error (for example pages opened, requests made and buttons clicked, without query strings or console messages), the software version, the environment, your browser or runtime and operating system, your browser's language and time zone, and an internal request ID. Reports do not include the contents of requests or responses, headers, cookies, query strings, your user ID or email address, or the contents of events that apps send to the Events API. In rare cases an error message can quote a value from a request (for example a value that failed a check). Sentry also sees the IP address from which a report reaches it, which can be your IP address, and currently stores it with an approximate location (city and country) derived from it. Reports are stored in Sentry's EU region (Germany) and deleted automatically by Sentry after at most 90 days.

Legal basis: our legitimate interest in the security and operation of the Service (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)), and where applicable our legal obligations (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).

7. Cookies and similar technologies

We use only cookies and browser storage that are necessary for the Service or that remember a choice you made. We do not use advertising or tracking cookies, so we do not ask for cookie consent.

  • aso_at and aso_rt: keep you signed in (the second for up to 30 days). Set only after you sign in.
  • aso_signed_in: tells the website that you are signed in, so it can send you to the dashboard. Up to 30 days.
  • NEXT_LOCALE: remembers the language you chose.
  • aso.sidebarCollapsed: remembers whether you collapsed the dashboard sidebar.
  • In the dashboard, your browser's local storage keeps the app you last selected, unsaved metadata drafts and your view preferences. This stays on your device and is not sent to us.

8. Data you connect from the app stores

To use the Service you connect your App Store Connect account with an API key that you create in App Store Connect. We store the key encrypted (AES-256-GCM) and use it only to perform the actions you ask for and the regular syncs you enable. With it we retrieve, for your apps: metadata and version history, customer reviews (including reviewers' nicknames and the text they wrote), App Store analytics reports and sales reports. Apple provides analytics and sales data in aggregated form, not per person. When Google Play support becomes available, data you connect from Google Play will be handled in the same way.

For this data you are the controller and we act as your processor, only on your instructions and to provide the Service. We keep it while your workspace and the store connection exist. When you revoke a connection in the Service we delete its key at once; the connection's data stays in your workspace until you ask us to delete it. When you ask us to delete a removed connection's data or a workspace, by writing to [email protected], we delete the related data within 30 days. You can also revoke the key in App Store Connect at any time.

9. In-app events (Events)

Events lets customers measure how people use their mobile apps. If you use an app whose developer has added Events, this section applies to you.

Who is responsible: the app's developer is the controller of the data its app sends. Nefarius processes that data only on the developer's behalf and instructions, as its processor, under a data processing agreement. The app's own privacy policy explains why the developer collects the data and on what legal basis; please read it.

What the tracker collects, depending on the developer's setup:

  • the names and times of actions in the app (for example "paywall viewed") and details the developer attaches to them;
  • a random identifier created for the app on your device;
  • the developer's own user ID for you, if you have an account in the app;
  • the app version and build, operating system version, device model, language and region setting, and whether it is a test or store build;
  • your country, derived from your network connection.

What it does not collect: the tracker does not read your device's advertising identifier (IDFA or Android Advertising ID), your location, contacts or anything you type, and developers are not allowed to send your name, email address, phone number, precise location, advertising identifiers or text you entered. We do not keep your IP address; our network provider sees it only while delivering the request and uses it to determine your country.

What we do with it: we store it and show it to the developer as statistics and funnels. We do not sell it, use it for advertising, combine it with other customers' data or use it for our own purposes.

Retention: 13 months from receipt, then deleted automatically.

Your rights: because the developer decides about this data, please send your requests to the app's developer. If you write to us instead, we forward your request to the developer where we can identify it and let you know.

10. Payments for paid plans

Paid plans are sold by Yusuf Demirci as an individual, and he receives the payments. For the data in this section he is the data controller, not Nefarius.

When you subscribe to a paid plan, the following is processed:

  • your name, email address, and the billing address and, if you give them, company name and tax number asked for at checkout;
  • your payment method: card brand, last four digits, expiry date and country. You enter your full card number and security code on Stripe's page; they never reach Yusuf Demirci or Nefarius;
  • your subscription, invoices, payments, refunds and payment disputes.

This data is used to charge you, calculate taxes, issue invoices and receipts, handle refunds and payment disputes, and keep the accounting and tax records the law requires. Nefarius runs the billing pages of the Service on Yusuf Demirci's behalf and receives from Stripe only what it needs to switch your plan's features on and off, such as your plan, its status and period.

Legal basis: performance of the contract with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)); legal obligations for invoices and accounting records (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)); and, for payment disputes and fraud prevention, establishing and defending legal claims and the legitimate interest in being paid (KVKK Art. 5(2)(e) and (f); GDPR Art. 6(1)(f)).

Retention: while you have a paid plan; afterwards, invoices and the records behind them are kept for as long as tax and accounting law requires, then deleted.

Payments are processed by Stripe Payments Europe, Limited (Ireland), Yusuf Demirci's payment provider. For some purposes, such as preventing fraud and meeting its own legal obligations, Stripe acts as an independent controller under its own privacy policy (https://stripe.com/privacy).

To use your rights over this data, write to [email protected], as described in section 14.

11. Who receives your data

We do not sell personal data. We share it only with the service providers we need to run the Service, who process it on our instructions:

  • Amazon Web Services: hosting of our servers, database and backups, in the Frankfurt (Germany) region.
  • Cloudflare: network delivery, protection against attacks, and private file storage (for example sales report files).
  • Resend: sending our emails (confirmation, launch, account emails).
  • Sentry (Functional Software, Inc.): error monitoring for our servers, website and dashboard (section 6), with reports stored in the EU (Germany).
  • Stripe: payment processing for paid plans, for Yusuf Demirci (section 10).

We may also disclose data to courts and public authorities when the law requires it (KVKK Art. 8; GDPR Art. 6(1)(c)), and to a successor if Nefarius's business is transferred, under the same protections.

Apple (and, when supported, Google) receive the requests the Service makes on your behalf through the API key you provide; their own privacy policies apply to that data.

12. Transfers abroad

Our data is stored in the EU (Frankfurt, Germany). Nefarius manages it from Türkiye, and Cloudflare, Resend and Sentry are companies based in the United States whose services operate in several countries (Sentry stores our error reports in Germany). Billing data is processed by Stripe in Ireland and, within the Stripe group, in the United States. Your data may therefore be processed outside the country you are in.

For transfers out of Türkiye we rely on the mechanisms provided in Article 9 of KVKK. For transfers out of the EEA we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. You can ask us for details of the safeguard used for a given transfer.

13. How we protect your data

Data is encrypted in transit. App Store Connect keys are additionally encrypted at the application level. Access to production systems is limited to the people who need it to run the Service. Backups are kept for 30 days, so deleted data leaves our backups within 30 days.

14. Your rights

Under Article 11 of KVKK you have the right to: learn whether your personal data is processed; request information about it; learn the purpose of the processing and whether it is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; ask for incomplete or inaccurate data to be corrected; ask for it to be deleted or destroyed under the conditions in Article 7; ask for these corrections and deletions to be notified to third parties to whom it was transferred; object to a result against you that arises only from automated analysis; and claim compensation for damage caused by unlawful processing.

If you are in the EEA, under the GDPR you also have the right to access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests, and to withdraw any consent at any time without affecting earlier processing.

To use your rights, write to [email protected] from the email address we know you by, or send a signed letter to our address in section 1. We answer within 30 days at the latest and free of charge, unless the request requires a separate cost, in which case the fee set by the Personal Data Protection Board may be charged.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) in Türkiye, or, in the EEA, to the data protection authority of the country where you live or work.

15. Children

The Service is meant for app developers and businesses. It is not directed at children under 18, and we do not knowingly collect their data.

16. Changes to this policy

We will update this policy when what we process changes. The date at the top shows the latest version. If a change is significant and you have an account or are on the waitlist, we will tell you by email before it takes effect.

17. Language

This policy is published in Turkish and English. If the two differ, the Turkish version prevails for people in Türkiye and the English version for everyone else.