Privacy Policy

Who is responsible

Bytefig LLC, of 5900 Balcones Drive, STE 100, Austin, TX 78731, USA, is the data controller for the personal data described here. Contact us at hello at asotraction.com.

For the app data you upload about your own users or customers, you are the controller and we are a processor acting on your instructions.

What we collect

Account data — your name, email address, hashed password, and which team you belong to. Needed to give you an account.

Usage data — which features you use, how much AI you consume, and how many messages you send the in-app assistant each day, so we can enforce plan and daily limits and bill correctly.

Technical data — IP address, browser user-agent, and session timestamps. Used for security: rate limiting, spotting suspicious sign-ins, and showing you your active sessions. Session records are kept for 30 days.

Two-factor data — if you turn on two-factor sign-in, the authenticator secret (encrypted at rest) and hashed recovery codes.

Audit records — who on your team published something to a store or social account, changed a role, or asked to delete an account, and when. Visible to the team owner.

Connector credentials — API keys and service accounts you add for App Store Connect, the Google Play Console, Apple Search Ads and similar. Encrypted at rest and used only to make the calls you ask for.

Content you create — apps you track, metadata drafts, screenshots and icons, keyword research and generated copy.

Store data about your apps — listings, ratings and reviews fetched from the App Store and Google Play. Reviews can include the reviewer's public nickname.

Waitlist data — if you joined the waitlist, your email and any name or company you gave, plus the referring page, your IP address and browser user-agent, which we use to tell real signups from automated ones.

Analytics — if you accept the cookie banner, Google Analytics and Mixpanel record the pages you visit, the buttons and links you click (with their labels, which can include a name shown on screen, such as an app or keyword), the actions you take (saving, generating, exporting and so on) and roughly where you are. Google Analytics truncates IP addresses and has its advertising and personalisation signals switched off. When you're signed in, both receive your account id, and Mixpanel also your email, name, plan and team, so we can see how each account uses the product. Mixpanel also records sessions as replays, so we can see where the product is confusing: the page's text and everything you type are masked, and only menus, tabs, buttons and headings stay readable. Nothing you type is recorded. Nothing is loaded until you accept, and refusing changes nothing about how the product works.

Why we're allowed to use it

Most processing is to perform our contract with you: you can't have an account without account data, or plan limits without usage data.

Security logging, rate limiting and fraud prevention rest on our legitimate interest in keeping the service safe — balanced against your interests, which is why we keep the minimum and not more.

Waitlist emails rest on your consent, given when you submitted the form. You can withdraw it at any time by asking us.

Some records are kept to meet legal obligations, particularly tax records relating to payments.

Payments

We don't see or store your card details. Sold through Link, LLC (Stripe's merchant of record service, which appears at checkout, on receipts and on your card statement as "Link") is the merchant of record and handles payment, invoicing and tax. We receive the subscription's status, the plan, and an identifier — not your card number.

What Sold through Link, LLC collects at checkout — your name, email, billing address and payment details — is covered by their own privacy policy: https://link.com/privacy.

Who we share it with

We use a small number of processors, each doing one job:

Sold through Link, LLC — payments, invoicing and tax.

Anthropic — AI generation. Prompts include the app data needed for the task. We don't send your connector credentials or other customers' data.

When you use the in-app assistant, your messages go to Anthropic together with the list of pages you can open, the public listing details of the apps your role can see, and — only for people who manage keys — which connectors are set up (yes or no, never the keys). API keys, private keys and key files you paste or attach are swapped for placeholders in your browser before a message is sent, so they never reach Anthropic or our servers' logs; the real value is sent only to your own settings when you press Save.

Resend — transactional email (invitations, password resets, billing notices).

Cloudflare — DNS, and protecting the site from abuse, including the Turnstile check on the sign-in form.

DataForSEO — Google Play search and listing lookups. It receives search terms and app identifiers, not personal data about you.

Google Analytics — usage measurement, and only with your consent.

Mixpanel — product analytics tied to your account, and only with your consent.

Apple, Google Play, RevenueCat, Mixpanel, Google Analytics and the social platforms are contacted using credentials you supply, at your instruction, to fetch or publish your own data.

We don't sell personal data, and we don't share it for advertising.

Where your data is held

Our processors operate internationally, so your data may be transferred outside your country. Where that involves personal data leaving the EEA or UK, transfers rely on the appropriate safeguards — normally Standard Contractual Clauses.

How long we keep it

Account and content data: while your account is open, and for up to 30 days after it closes so you can ask for an export.

Session and security logs: a rolling short window, not indefinitely.

Assistant conversations: not stored by us. The conversation lives in your browser tab and is gone when you reload or close it. We keep only a daily count of messages and AI usage per person, for as long as your account is open.

Billing and tax records: as long as tax law requires, which is usually several years and is not something we can shorten on request.

Waitlist entries: until you ask us to remove them, or until launch, whichever comes first.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing based on legitimate interest. You can also ask for it in a portable format.

Two of those you can exercise yourself, without asking. Under Profile, *Download my data* gives you everything we hold about you as a single JSON file, and *Delete my account* erases it. Deletion waits seven days before it runs so you can change your mind, or you can choose to have it happen immediately.

For anything else, email hello at asotraction.com and we'll respond within a month. We may need to confirm who you are first.

If you think we've handled your data badly, you can complain to your local data protection authority. We'd rather you told us first so we can put it right.

Cookies and local storage

The app keeps your session token and interface preferences in your browser's local storage. That's necessary for signing in and staying signed in; without it the product can't work, so it doesn't ask permission for it.

We use Google Analytics and Mixpanel to understand which parts of the product get used. They store identifiers in your browser, so they load only if you accept the banner — and if you refuse, or ignore it, nothing is stored and neither is ever contacted.

You can change your mind at any time. Withdrawing consent stops collection and deletes the analytics data already stored in your browser.

We don't use advertising cookies, and we don't sell or share your data for advertising.

Security

Passwords are hashed with bcrypt and never stored in readable form. Connector credentials are encrypted at rest. Invitation and password-reset links are stored only as hashes, are single use, and expire.

You can turn on two-factor sign-in with an authenticator app. Sessions can be revoked individually or all at once from your profile, and changing your password signs out every other session.

No system is perfectly secure. If a breach affects your personal data we'll tell you and the relevant authority as the law requires.

AI

Metadata suggestions, screenshot captions, icon concepts, review replies and social copy are generated with AI and are advisory. Review them before publishing — anything published under your name is your responsibility.

The in-app assistant's answers are AI-generated too, and can be wrong. It never saves settings or adds an app on its own: it proposes the change and you confirm it.

We don't use your content to train AI models.