What we collect, why, and who has access

What we collect

Account. You sign in with a magic link sent to your email, or with an email and password. We store your email and the name you give us so we recognise you on return. If you set a password, we never hold it in plain text.

Billing. Stripe handles the card; we receive a customer identifier, the plan you chose, your invoices, and the billing address you give Stripe. We never see card numbers.

Product. The Shopify apps you choose to track, the keywords you tag, your notes, and your saved views. This is the data you came here to manage.

Derived. Daily rank readings for every tracked keyword × app, built from public App Store data. No personal data is involved.

Technical. Structured request logs (paths, response codes, timings) and a session record with your IP address and browser user-agent, kept so we can keep accounts secure. Errors go to Sentry with a stack trace.

Analytics. We use PostHog across the whole site, including the dashboard, to see which pages people visit, where they click, and how the pages perform. We also record sessions so we can see where the product trips people up. Everything you type is masked, so we never capture what you enter in form fields or billing details. PostHog reads an approximate location (country and city) from your IP address. This is on from your first visit; you can opt out from the notice we show then, or any time from the Cookies section below. Once you sign in, these events tie to your account so we can understand the path from first visit to active use. We don’t use Google Analytics, Segment, or advertising trackers.

What we never ask for. We don’t connect to your Shopify Partners account or your Google Analytics, and we never ask for your store’s admin login. Everything we track comes from public App Store data, so none of your private store metrics pass through us.

Why we collect it

• Account data: to authenticate you and bill you.
• Product data: to render the dashboard you’re paying for.
• Derived data: to power KES, anomaly detection, and the public Market Intelligence page.
• Technical data: to keep accounts secure, monitor performance, and fix errors.
• Analytics data: to understand which pages convert and improve the sign-up flow.

Who we share it with

We use a small set of subprocessors, each with one job. We don’t sell, lease, or barter personal data, ever.

Cookies

From your first visit we turn on product analytics, which sets a first-party cookie so PostHog can recognise a returning visitor and stitch a session together. This runs on every page, including the dashboard. We show a short notice the first time you visit; you can opt out there, or any time with the control below. Opting out stops analytics and session recording on your device. Sign-in sets two more cookies: a session cookie to keep you logged in, and the security token that protects forms. We don’t set advertising cookies.

How long we keep it

• Account data: for the life of your account, then removed from our systems as soon as you delete it.
• Billing data: held by our payment processor for seven years, to meet tax law in our home jurisdiction.
• Product data: for the life of your account; deletable on request from the dashboard.
• Derived data: indefinitely, since it’s aggregated from public pages and not tied to you.
• Technical data: 30 days for logs, 90 days for errors.
• Analytics data: retained by PostHog and deletable on request.

Your rights

Wherever you are, you can:

• Ask for a copy of the data we hold about you.
• Ask us to correct anything that’s wrong.
• Delete your account, and the data attached to it, from the dashboard.
• Export your tracked apps, keywords, and notes as CSV or JSON.

EU/UK readers: under GDPR/UK-GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection. California readers: CCPA rights to know, delete, and opt out apply. We do not sell personal data.

Email hello@asomify.com with any of the above. We answer within five working days.

International transfers

Our primary infrastructure runs in the EU. Where data must move to other jurisdictions (Stripe, Sentry, OpenRouter, PostHog), we rely on Standard Contractual Clauses or an equivalent adequacy mechanism.

Children

The product isn’t directed at children under 16, and we don’t knowingly collect data from them.

Changes to this policy

We update the version and date at the top of this page when we make material changes. Pro subscribers also get an email when something material changes.