Privacy Policy

This Privacy Policy explains how Extenify ("Extenify", "we", "us" or "our") handles personal data when you visit our website or use our dashboard, alerts and related services (the "Service"). It should be read together with our Terms of Service.

The product data we present, such as install counts, ratings and reviews, comes from publicly available store listing data. That is information about products, not about you, and it is treated as product data rather than personal data about our users.

• Account information. When you sign in with Google we receive your email address, your name and your profile picture (avatar) URL from Google, along with a stable account identifier. We never receive your Google password.
• Content you create. The trackers, listing URLs, product names, notification channels (for example an email address, webhook URL, or chat destination) and preferences you configure.
• Usage and diagnostic data. Basic technical logs such as request timestamps, requested routes, HTTP status codes, approximate error details, browser and device type, and IP address. These are used to keep the Service secure, reliable and within plan limits.
• Billing information. Purchases are processed by our payment processor, Polar. We receive and store only the subscription state we need to grant access, such as plan identifier, status, renewal date and processor customer and product identifiers. We do not collect, see or store your full card number, CVC or bank credentials.
• Communications. Messages you send us by email, including support requests and their contents.

We do not knowingly collect special category data (such as health, biometric or political data), and we ask that you do not send it to us.

We use personal data to:

• create and authenticate your account and keep you signed in;
• operate the Service, including fetching and refreshing the listings you track and computing changes between snapshots;
• deliver the notifications and digests you have asked for, on the channels you configured;
• process payments, apply plan entitlements and usage limits, and send billing related messages;
• provide support, respond to your requests and communicate important service or security notices;
• monitor, debug, secure and improve the Service, prevent abuse and enforce our Terms;
• comply with legal, tax and accounting obligations.

Where data protection law requires a legal basis, we rely on performance of our contract with you (running your account and alerts), our legitimate interests (security, abuse prevention, product improvement), compliance with legal obligations (tax and accounting), and your consent where we ask for it, for example for optional marketing email. You can withdraw consent at any time.

We do not sell your personal data, and we do not share it with third parties for their own advertising.

We keep cookie use to the minimum required to operate the Service. After you sign in we set a session cookie containing a signed JSON Web Token (JWT). It identifies your account on each request, is HTTP-only, is transmitted over HTTPS in production, and expires after a defined period or when you sign out.

We may also store a small preference value, for example your light or dark theme choice. These are strictly necessary or functional cookies, not advertising cookies. Blocking them will prevent sign-in from working.

Google Analytics sets its own first-party cookies (names beginning with _ga) to count returning visitors and measure aggregate traffic. Blocking them does not affect any feature of the Service.

We use a small number of processors and sub-processors to run the Service. Each receives only the data needed for its function:

• Google (sign-in). Authenticates you and provides your email, name and avatar. Governed by Google's privacy policy.
• Polar (payments). Processes checkout, subscriptions, invoices, tax handling and the billing portal, and holds your payment method on its own systems.
• Amazon Web Services (email delivery). Amazon Simple Email Service (SES) sends transactional email such as alerts, digests and account notices.
• Messaging destinations you configure. If you add a chat or webhook channel, the alert content you asked for is delivered to that destination and is then subject to the operator of that destination.
• Hosting and database infrastructure. Providers that host the application and store its data.
• Google Analytics (product analytics). Measures aggregate traffic and feature usage, for example page views, referrers, approximate location derived from IP address, and device and browser type. We do not use it to build advertising profiles and we do not send it your account credentials or store data. Governed by Google's privacy policy.

We may also disclose data where legally required, to protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets, in which case we will require the recipient to honour this Policy.

• Account and configuration data is kept for as long as your account exists.
• Historical listing snapshots are retained according to the history window of your plan, then trimmed.
• Technical and security logs are kept for a short rolling period, normally no more than 90 days.
• Billing and tax records are kept for as long as required by law, typically several years, and are held by us and our processor independently of your account.
• When you delete your account, we delete or anonymise the associated personal data within 30 days, except records we must keep for legal or accounting reasons or to resolve a dispute.

Depending on where you live, you may have the right to access, correct, export, restrict, object to, or delete your personal data, and to withdraw consent or lodge a complaint with your local supervisory authority.

• Access and export. Most of your data is visible in the dashboard, and eligible plans can export tracked data as CSV. We will provide a copy of your account data on request.
• Correction. Update your details in settings, or write to us.
• Deletion. Delete individual trackers, apps or channels at any time, or ask us to delete your whole account.
• Communication preferences. Alerts and digests can be disabled per tracker or per channel. Transactional messages about security or billing cannot be switched off while your account is active.

Requests go to [email protected]. We may need to verify your identity before acting, and we will respond within the period required by applicable law.

We use industry standard safeguards, including HTTPS in transit, encrypted storage at our infrastructure providers, HTTP-only signed session cookies, scoped access to production systems, and secrets held in environment configuration rather than in code.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and any relevant authority as required by law.

We and our processors may store and process data in countries other than your own, including the United States. Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with the technical measures described above.

The Service is a business tool and is not directed at children. It is not intended for anyone under 13, and in the European Economic Area and the United Kingdom it is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Policy as the Service evolves or as legal requirements change. We will revise the "last updated" date above and, for material changes, take reasonable steps to notify you, for example by email or an in-product notice.

For privacy questions, data requests or complaints, write to [email protected]. We aim to respond to every message within two business days.