Privacy policy
Short version: we collect as little as we can, we only use analytics if you say yes, we don't use advertising trackers, and we never sell or share your data for advertising.
Last updated Oct 25, 2026
Who we are
AppBreakup is run by the company below, which is the controller (under India's Digital Personal Data Protection Act, the “Data Fiduciary”) of your personal data:
Tedora TechnologiesBengaluru, Karnataka, India
Email: [email protected]
What we collect, why, and for how long
You can read every page on AppBreakup without giving us anything. We only collect data when you act:
| When | What we keep | Why | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Reviews | Name you choose, email, rating, review text, the app you switched from, any proof you send (for example a profile link or screenshot) | Publish your review, check it's genuine, contact you about it | Legitimate interests (running honest reviews); your choice to submit | While the review is published. Emails on rejected reviews are erased after 30 days. |
| App submissions | Your name, email and the details of the app | Review the listing and tell you the outcome | Legitimate interests; your choice to submit | Your email is erased 180 days after we decide |
| Maker accounts | Your name, email, a scrambled (hashed) password if you set one, your Google account ID if you sign in with Google, when you confirmed your email and last signed in, and which submissions and apps are linked to you | Let you sign in, follow your submissions and see stats for apps you manage | Contract (providing the account you asked for) | Until you delete your account in Settings. Accounts never confirmed are deleted after 30 days. |
| Claiming an app | Which app, how you showed you run it (email domain, a code on your site or DNS, or what you tell our editors) | Check that only the people who run an app see its stats | Legitimate interests (keeping app stats private to their makers) | Until you delete your account or the claim |
| Corrections and reports | Your message and, if you give it, your email | Fix the listing and reply to you | Legitimate interests (keeping information accurate) | Your email is erased 180 days after the report is closed |
| Visiting any page | The page, the site that sent you there, your device type, browser, country, and a visitor code that changes every day (made from your IP address and browser with a random daily key we delete after two days). No cookies; we never store your IP address. | Count visits and see which pages help people | Legitimate interests (understanding and improving the site) | 25 months. After two days the visitor code can't be linked to anyone, even by us. |
| Returning visits (only if you accept analytics) | A random visitor ID saved in your browser's local storage and sent with each page view | See how many visitors come back and how often | Your consent | The ID lasts up to 13 months in your browser; we erase it from our records after 13 months, or straight away from your browser if you withdraw consent |
| Clicks on “Visit” links | The app, the page you came from, the date, and a one-way hashed code derived from your IP address (we never store the IP itself) | Count real visits for rankings and stop click fraud | Legitimate interests | The hashed code is erased after 90 days; the anonymous count stays |
| Votes on alternatives | The hashed code above and your vote, plus a cookie listing what you voted on | One vote per person | Legitimate interests | Vote records 12 months; cookie 90 days |
| Abuse limits | Counters keyed by the hashed code | Stop spam and brute-force attempts | Legitimate interests (security) | Deleted a day after they expire |
| Emails we send you | A copy of each email (recipient, subject, text) | Show we sent it, and fix delivery problems | Legitimate interests | 90 days |
Your email is never shown publicly. Your review's name, text, rating and date are public, and may appear in our open data feed. Server logs kept by our hosting provider may briefly include IP addresses for security; see the provider below.
Cookies and analytics
Some cookies are needed for the site to work: a vote cookie (90 days) so you can't vote twice, a note in your browser remembering your cookie choice, and sign-in cookies for makers (30 days) and our own editors (12 hours). Google sign-in only runs when you click it, and we don't let it keep anything in your browser afterwards. We don't use advertising or cross-site tracking cookies. Our own visit statistics (see the table above) don't use cookies at all.
With your consent only, we also keep a random visitor ID in your browser's local storage to count returning visits, and use Google Analytics (through Firebase) to count visits and see which pages are useful. It sets cookies starting with _ga (kept up to 2 years) and Google receives your IP address, device and browser details and the pages you view; Google keeps this data for up to 14 months. Nothing is stored until you click Accept, and you can withdraw consent any time with “Cookie settings” in the footer, which stops analytics and deletes its cookies and the visitor ID. Legal basis: your consent.
Who processes data for us
We never sell personal data or share it for advertising. These providers process it on our behalf, under contract:
- DigitalOcean (server) and Cloudflare (CDN and security): hosting the website and its server logs (New York City, USA (Cloudflare: global network))
- Self-hosted PostgreSQL server operated by Tedora Technologies: storing the database (New York City, USA)
- Resend: sending emails, such as review decisions (USA)
- Google (Firebase): Google sign-in for maker accounts, if you choose it; and counting visits and page use with Google Analytics, only if you accept analytics cookies (USA)
Your data may be processed outside your country, including in India and the USA. Where data leaves the UK or EEA, we rely on the provider's Standard Contractual Clauses or the EU–US Data Privacy Framework. We may also disclose data when the law requires it.
Your rights
Wherever you live, you can ask us to access, correct, delete or export your data, or object to how we use it. Email [email protected] from the address you used, and we'll reply within 30 days. You can ask us to remove your review at any time; we'll delete it and the email stored with it.
- India: under the Digital Personal Data Protection Act, 2023 you can ask for a summary of your data and how it's used, have it corrected or erased, nominate someone to act for you, and raise a grievance with our Grievance Officer (below). If you're not satisfied, you can complain to the Data Protection Board of India.
- EU and UK: you can also complain to your data protection authority (in the UK, the ICO).
- California and other US states: we don't sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information. We won't treat you differently for using your rights.
Grievances
Grievance Officer: Sameer, Tedora Technologies, Bengaluru, Karnataka, India. Email: [email protected].
We acknowledge complaints within 24 hours and resolve them within 15 days.
Children
AppBreakup isn't meant for children. You must be at least 16 to write a review or submit an app. If you think a child has sent us personal data, email us and we'll delete it.
Security
Data is encrypted in transit, editor accounts use strong password hashing and rate limits, and we keep as little as possible for as short a time as possible.
Changes
If we change this policy, we'll update the date at the top. Significant changes will be noted on this page. See also our terms of use.