Privacy.

What we process, why, and for how long, in the three situations where AppAdSwap touches personal data: you visit appadswap.com, you have an account, or you see an AppAdSwap card on someone else's website.

Last updated 28 October 2026

Who is responsible

The controller under the GDPR is:

Luis Krin
Munich
Germany
Email: krinapps25@gmail.com

Write to that address or email for anything on this page.

Visiting appadswap.com

Hosting and server logs

The site is hosted by Vercel Inc. (USA). Pages are delivered through Vercel's global network; our server code and our database run in Frankfurt, Germany. Every request passes your IP address, the time, the requested address, the referring page and your browser's user agent to Vercel, which needs them to deliver the page and to fend off attacks. Vercel keeps these logs for a short time only. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a working, secure website.

Visitor statistics

We count page views with Vercel Web Analytics. It sets no cookies and stores nothing on your device. It records the page, the referring site, your country and your browser, device and operating system type, and tells visits apart with a hash of the request that resets every day, so it can't follow you across days or across websites. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing which pages are used.

We also use PostHog to see how people move from landing on the site to submitting an app and installing the widget, so we know where that path breaks down. It sets no cookies either; the browser session it uses to tell your actions apart exists only in memory and is gone on refresh. It records the pages you visit and specific actions — signing up, submitting an app, copying the install snippet, a site going live, an app being approved — nothing about what you type. Once you have an account, those actions are tied to it, so we can see one maker's path rather than isolated, disconnected events. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in understanding and fixing that path.

If you use the checker at appadswap.com/tools/link-preview, our server requests the address you type, with a user agent that names us (AppAdSwapBot), and shows you what the page's tags say. It also asks for the preview image and the icon that page names, reading only their headers. The website you check sees a request from our server, not from you. We don't store or log the address you check. To limit abuse, your IP address is held in the server's memory for up to an hour to count requests; it is not written to our database. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping the tool available and not abused.

Fonts

Our typeface is served from our own domain. Your browser makes no requests to Google or other font services.

Your account

Signing in

You sign in with a link we email you, or with Google. Sign-in and our database are provided by Supabase Inc.; your data is stored in Frankfurt, Germany. If you use Google, Google tells us your email address and the basic profile it shares (name and profile picture, which we don't use), and it learns that you signed in to AppAdSwap. Their own privacy policies apply to that.

What we store

  • your email address and sign-in details (method, time of your last sign-in)
  • the apps you submit: name, tagline, web address, icon, category and button text
  • the sites you add: domain and widget settings, and when the widget was first seen there
  • your views balance and every entry that changed it
  • daily totals of views and clicks for your sites and apps

A person reviews every app before it's shown and opens its web address to do so. Once approved, your app's card is public: it's shown on sites in the network and on Discover.

Legal basis: Art. 6(1)(b) GDPR, because we need this data to run the exchange you signed up for, and Art. 6(1)(f) GDPR for review and fraud prevention.

Payments

If you buy something, you pay on a page run by Stripe. Stripe receives your payment details and billing address, and your VAT number if you give one; we receive your email address, what you bought, the amount, and a customer and payment reference from Stripe. We don't see or store your card number. We keep a record of each purchase for your Billing page, and it is deleted with your account. Invoices and payment records stay at Stripe for as long as tax and commercial law require, which can be up to ten years, even if you delete your account. Legal basis: Art. 6(1)(b) GDPR to carry out the purchase, and Art. 6(1)(c) GDPR for our record-keeping duties.

Cookies

When you sign in, we set cookies that keep you signed in. They're strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG), so we don't ask for consent. They're removed when you sign out. We set no other cookies.

Emails

Sign-in links are sent through Supabase. Emails about something that happened on your account — a card submitted, reviewed, or a site going live — are sent through Resend, to the address on your account.

How long we keep it

Until you delete your account, which you can do yourself under Settings. Deleting it immediately removes your profile, apps, sites, balance history and statistics, and cancels a Pro subscription. Payment records are kept as described under Payments. Copies in our provider's backups are overwritten on its regular schedule.

When you see an AppAdSwap card on another website

The owner of that website placed our widget on it. Your browser then loads a script from appadswap.com, asks our server for a card, tells it when the card was actually visible, and, if you click, goes through appadswap.com/go/… on its way to the app.

What we receive

Your IP address, your browser's user agent, the address of the page showing the card, and the time.

What we do with it

We use your IP address only in memory, while handling the request, to compute a pseudonymous identifier: a SHA-256 hash of your IP address, your user agent and a secret that changes every day. The IP address itself is never stored, and the same visitor gets a different identifier each day.

For each counted view or click we store that identifier, which card was shown on which site, in which format, and when. We use it to count each visitor at most once per app and five times per site per day, and to detect fake traffic, so that the exchange stays fair for everyone in it. After 30 days these records are deleted; only daily totals per site and app remain, with no identifier.

The widget sets no cookies, stores nothing on your device, doesn't fingerprint your browser and loads nothing from third parties. The hosting logs described above apply to these requests too.

If you report a card through its ⓘ menu, we store the reason you give together with the card and the site, and nothing that identifies you. Once you click through to an app, that app's own privacy policy applies.

Legal basis: Art. 6(1)(f) GDPR, the legitimate interest of the site owner and of the network's members in showing each other's apps, and ours in counting those views correctly and preventing fraud. Because we store no IP address, we usually can't tell which records are yours (Art. 11 GDPR). If you don't want to see cards at all, blocking scripts from appadswap.com stops every request described here.

Who else processes data

  • Vercel Inc., USA: hosting, server logs and visitor statistics. Vercel is certified under the EU-US Data Privacy Framework, and our contract with it includes the EU standard contractual clauses.
  • Supabase Inc., USA: database, sign-in and sign-in emails. Data is stored in Frankfurt, Germany. Where Supabase staff or its subcontractors outside the EU can access it, the EU standard contractual clauses apply.
  • PostHog: the analytics described above. Data is processed in the EU.
  • Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA): payments, invoices and fraud checks, as described under Payments. Stripe is certified under the EU-US Data Privacy Framework, and our contract with it includes the EU standard contractual clauses.
  • Resend: the account emails described above. Resend is certified under the EU-US Data Privacy Framework, and our contract with it includes the EU standard contractual clauses.
  • Google: only if you choose it for sign-in, as separate controllers.

We don't sell personal data and don't share it with anyone else.

Your rights

Under the GDPR you have the right to:

  • get a copy of your data (Art. 15) and have it corrected (Art. 16)
  • have it deleted (Art. 17) or its processing restricted (Art. 18)
  • receive it in a portable format (Art. 20)
  • object to processing based on legitimate interest, on grounds relating to your situation (Art. 21)
  • complain to a data protection authority, in particular in the EU country where you live or work (Art. 77)

Email krinapps25@gmail.com to use any of them. We don't make decisions about you by purely automated means that have legal or similarly significant effects. Our fraud checks run automatically, but if one affects your balance, you can ask for a person to review it.

If you show our widget on your site

Your visitors should hear about the widget from your own privacy policy. You can adapt this paragraph. We can't give legal advice, so check it fits the rest of your policy:

For your privacy policy
This website shows a card from AppAdSwap (appadswap.com), a cross-promotion network for independent apps run by Luis Krin, Germany. To show the card, your browser loads a script from appadswap.com and sends your IP address, your browser's user agent and the address of this page to AppAdSwap. AppAdSwap uses the IP address only while handling the request, to compute a pseudonymous identifier that changes every day; the IP address itself is not stored. The identifier is kept for 30 days to count views fairly and to detect fraud. No cookies are set and nothing is stored on your device. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in promoting our app and in preventing fraud). Details: https://appadswap.com/privacy#widget

Changes

We update this page when what we process changes, and change the date at the top. If a change affects your account, we'll email you before it takes effect.