Privacy Policy

Last updated: April 14, 2026

Thank you for choosing AppScreenTool ("Company", "we", "us", or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

1. Information We Collect

Information You Provide

  • Account Data: When you register, we collect your email address, name, and password (stored as a bcrypt hash — we never store your password in plain text). If you sign up via Google or GitHub, we receive your name, email, and profile picture from the provider.
  • Profile Information: Optional profile details such as your display name and avatar image.
  • Project Content: Screenshots, images, logos, and design data you upload or create within your projects.
  • Billing Information: Subscription selections and transaction history. We do not directly store credit card numbers — payment processing is handled by third-party providers.

Information Collected Automatically

  • Authentication Cookies: We use HTTP-only cookies (auth_token) to maintain your login session.
  • Analytics Data: We use Google Analytics and Google Tag Manager to collect anonymized usage data such as page views, session duration, device type, browser, and general geographic location. This data helps us understand how users interact with the service and improve the experience. Google may use cookies to collect this information.
  • Performance & Security Data: Our website is served through Cloudflare, which may collect technical data such as IP addresses, browser information, and request metadata for performance optimization, caching, and DDoS protection.
  • API Usage Logs: We log API endpoint paths and response times for security monitoring and performance optimization. These logs are associated with your user account.

2. How We Use Your Information

  • Provide the Service: Operate and maintain your account, projects, and editor features.
  • AI Translation & Generation: When you use AI-powered translation or AI project generation, your text content and app descriptions are sent to our AI provider (OpenRouter) for processing. Only the text needed for the specific task is sent — never your full account data.
  • Image Processing: Uploaded images are processed server-side (resizing, thumbnail generation) using Sharp.js. All processing occurs on our servers — images are not sent to external services.
  • Transactional Emails: We send emails for account verification, subscription changes, account deletion, and security notifications (2FA changes).
  • Security: Rate limiting, CSRF protection, and token validation to protect your account.
  • Service Improvement: Aggregate usage data to understand feature adoption and improve the product.

3. Third-Party Services

We share data with the following third-party services only as necessary to provide our service:

  • OpenRouter (AI): Text content sent for AI translation and project generation. Subject to OpenRouter's Privacy Policy.
  • Google OAuth: If you sign in with Google, authentication is handled via Google's OAuth 2.0 service. We receive your email, name, and profile picture.
  • GitHub OAuth: If you sign in with GitHub, authentication is handled via GitHub's OAuth service. We receive your email, name, and avatar.
  • SMTP Provider: Transactional emails are sent via an SMTP service. Only email addresses and email content are shared.
  • Google Analytics: We use Google Analytics to collect anonymized website usage statistics. Data collected includes page views, session duration, device and browser information, and approximate geographic location. This data is used solely for understanding usage patterns and improving our service. Subject to Google's Privacy Policy.
  • Google Tag Manager: We use Google Tag Manager to manage analytics and tracking scripts on our website. GTM itself does not collect personal data but facilitates the deployment of tags that may. Subject to Google's Privacy Policy.
  • Cloudflare: Our website uses Cloudflare for CDN, performance optimization, and security (DDoS protection). Cloudflare may process technical data including IP addresses and request headers. Subject to Cloudflare's Privacy Policy.

We do not use Facebook Pixel or any third-party advertising services. We do not sell your personal information to third parties.

4. Cookies

We use the following types of cookies:

Essential Cookies

  • auth_token: HTTP-only session cookie for authentication (7-day expiry).
  • 2fa_token: Temporary HTTP-only cookie during two-factor authentication (5-minute expiry).
  • oauth_state: Temporary HTTP-only cookie for OAuth CSRF protection (10-minute expiry).

Analytics Cookies

  • Google Analytics cookies (_ga, _ga_*): Used to distinguish users and track anonymized usage data. These cookies are set by Google Analytics and help us understand how visitors use our website.

Performance & Security Cookies

  • Cloudflare cookies (__cf_bm, cf_clearance): Used by Cloudflare for bot detection, security challenges, and performance optimization.

We do not use any advertising cookies. You can manage or disable analytics cookies through your browser settings.

5. Data Retention

  • Account Data: Retained as long as your account is active. You can delete your account at any time from your account settings page.
  • Free Tier Projects: Projects belonging to free-tier users that have not been updated within 30 days may be automatically deleted to manage storage resources.
  • Account Deletion: You can delete your account directly from the Settings > Security page. When you initiate account deletion, there is a 7-day grace period during which you can cancel the deletion by logging back in. After the grace period, all data — including your account, projects, uploaded images, transaction history, and any associated content — is permanently and irreversibly deleted from our systems.
  • Email Logs: Transactional email logs are retained for operational purposes and de-linked from deleted accounts.
  • Analytics Data: Anonymized analytics data collected via Google Analytics is retained according to Google's data retention policies and cannot be linked back to your account after deletion.

6. Data Security

We implement appropriate technical and organizational security measures:

  • Passwords are hashed with bcrypt (cost factor 10) — we cannot read your password.
  • Two-factor authentication secrets are encrypted with AES-256-GCM.
  • All API routes are protected with CSRF validation and rate limiting.
  • JWT tokens support server-side revocation (logout invalidates your token).
  • Database connections use connection pooling with limited concurrent connections.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have the following rights:

  • Access: View your personal data via your profile and settings pages.
  • Rectification: Update your name, email, and avatar from your profile settings.
  • Deletion: Delete your account from Settings > Security. All data is permanently removed after a 7-day grace period. You can cancel the deletion during this period by logging back in.
  • Data Portability: Your project data is stored as JSON and can be exported.
  • Withdraw Consent: You can stop using the service and delete your account at any time.
  • Opt-out of Analytics: You can disable Google Analytics tracking by using browser extensions such as the Google Analytics Opt-out Browser Add-on, or by adjusting your browser's cookie settings.

If you are in the European Economic Area (EEA), you have additional rights under GDPR including the right to lodge a complaint with your local data protection authority.

8. Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us, and we will take steps to remove that information.

9. International Data Transfers

Your data may be processed on servers located in different jurisdictions. By using our service, you consent to the transfer of your information to countries that may have different data protection laws than your own.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date. We encourage you to review this policy periodically. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at:

Email: hello@AppScreenTool.com