Privacy Notice

2. Visitors

When you browse AppKade we receive the technical information every website receives, such as your IP address, browser type and the page you asked for. Our hosting provider keeps this in short-lived server logs to run and secure the site.

We count page views with Vercel Web Analytics, which does not use cookies and reports only totals, such as views per page, referring sites, countries and device types. It does not let us identify you. Vercel Speed Insights, also cookieless, measures how quickly pages load for visitors so we can keep the site fast.

We also use Google Analytics to understand how visitors find and use AppKade. It sets cookies that give your browser a random identifier, and records the pages you view, how you arrived, your approximate location and device, which apps you view, how many results a search finds, and when an enquiry or a request is sent (but never what you search for, what you write, or your details). Google processes this on our behalf. You can block it with your browser’s cookie settings or Google’s opt-out add-on.

When you search AppKade, we count each search term per day and how many results it found, so we can see what people look for. On the for-sale pages we also count, per day, which filters are used and how often “Make an offer” is pressed. We store only these daily totals, not who searched or clicked, and we skip terms that look like an email address or phone number. We delete them after 90 days.

Some app and for-sale listings have a demo video on YouTube or Vimeo, shown in the listing’s gallery. Nothing loads from those sites until you press play; then the video plays from YouTube’s privacy-enhanced (no-cookie) player or Vimeo with do-not-track, and that provider receives your IP address and browser details under its own privacy policy.

When you select Buy, Visit website, Try demo or Contact support on a listing, we record which link was used and when, so we can show developers and ourselves how often listings lead to visits. To count each visitor once per link per day, and to show developers what share of their visitors used a link, we store the visitor code described below with the click, and clear it after 180 days.

When you open an app or for-sale listing, we count a view of it so its developer can see how many people look at their listing and how they found it. To recognise the same browser across visits, we give it a random visitor ID in a first-party cookie (ak_vid, kept for 180 days after your last visit). It contains nothing about you, and we store only a one-way code of it, keyed with a secret. With that code we keep, for each listing and day you view it, how you arrived (an AppKade page and your AppKade search term, a search engine, an AI assistant, a social network, another website’s name, or a tagged link), your device type and operating system from your browser, and your country from your IP address (never the IP address itself), for 180 days. We also keep a one-way code of your IP address and browser for 2 days, to stop one browser being counted many times. When a listing’s card is shown to you in AppKade’s lists, or you use a listing’s Share button, we count that too (for a share, the network you chose), with the same code, deleted after 2 days. Shared links carry a short tag naming how they were shared, never who shared them. Developers see only totals, such as visitors, sources, devices and countries, never who viewed. Search engines, link previews, automated browsers and developers’ own visits, including from devices they have signed in on, are not counted.

To learn how people find AppKade, we count how each visit started: the kind of source (a search engine, an AI assistant, a social network, another website’s name, a tagged link or a direct visit), the first part of the page address, your device type and your country from your IP address (never the IP address itself). These are only daily totals, with no cookie and nothing that identifies you. A small share of visitors are also asked one question about what they hoped to find. Answering is optional, one answer is kept per browser using the visitor ID above, and we ask you not to include contact details; a comment that looks like an email address or phone number is discarded.

3. Buyers who send an enquiry

When you send an enquiry from a listing, or an offer or question about source code or a business for sale, we collect:

• your name, email address and, if you give it, your phone number;
• your message, any offer amount, which listing it is about, and the time you agreed to share it.

We share these details with the developer of that app, or the seller of that listing, with your consent, so they can reply to you. The developer then handles them under their own privacy practices, and our Developer Agreement allows them to use your details only to respond to your enquiry. We email the developer to say they have a new enquiry, but the email does not contain your details; they read it in their AppKade dashboard.

If the listing is confidential, you must accept our confidentiality terms to send an offer. We record when you accepted them with your offer and show it to the seller, and record when the seller shares the business’s private details with you. After a sale is marked complete, we ask you how it went; your rating and comment are seen only by AppKade.

When you report a listing, we keep the reason, any details you write, your email address if you give one (so we can reply), the listing, and a one-way code made from your IP address to stop repeated reports. The developer or seller never sees who reported them. We delete the code after 30 days and the report after 12 months.

When you send an offer or question about something for sale, we email you a private link to your offer. On that page you and the seller exchange messages and counter-offers, which we store with your offer. The seller can see the conversation in their dashboard. We email you when the seller replies, makes a counter-offer or decides, and email the seller when you reply, without your contact details. If you accept a deal, the seller may record an escrow service and transaction reference there for you both to see. Anyone who has your link can see and reply to your offer, so don’t share it.

AppKade also reviews enquiries to mark spam and tests, so we can measure genuine interest and keep the service safe. About a week after an app enquiry, we email you once to ask whether you’d like to review the app. We don’t ask again about the same app, send at most 3 such emails to an address in 30 days, and stop them all if you choose “stop review emails” in one (we then keep only a one-way code of your address, so we know not to ask). Otherwise we don’t contact you about your enquiry unless you report a problem to us.

To stop spam, the enquiry form uses Cloudflare Turnstile, which checks your browser for signs of automation. We also limit how many enquiries can be sent, using one-way codes made from your IP address and email address, which we delete after 30 days.

We keep enquiries and offers, including their conversations, for 12 months after they are sent and then delete them. Developers and sellers may keep their own copy of your details under their own policies.

4. Buyers who write a review

If you review an app from the link in our email, we keep your rating, title, review, whether you’re using the app or tried it, the name you choose to show (your first name and initial unless you change it), the enquiry it came from, and your email address.

Your review and chosen name are public once AppKade publishes it, marked “Verified enquiry”. Your email address and enquiry are never shown, including to the developer. We use the address only to stop more than one review per buyer of an app, and delete it after 12 months. Reviews we decline to publish are deleted after 12 months.

Published reviews stay on the app’s page while the app is listed. To change or remove yours, email us from the address you used. Read how reviews work.

5. Visitors who ask a question about an app

When you ask a question on an app’s page, we keep the question, the app, your email address if you give one, and a one-way code made from your IP address to stop spam (with Cloudflare Turnstile, as for enquiries).

AppKade checks the question, then sends it to the developer without your email address. Once the developer answers, the question and answer are public on the app’s page, without your name.

If you gave an email address, we email you once: the answer, or a note that the developer didn’t answer within 14 days. We then delete the address. Addresses for questions that are never sent on are deleted after 30 days, and the IP code after 30 days. Questions that aren’t published are deleted after 12 months.

6. Visitors who tell us what they’re looking for

When a category or search has no suitable app, you can tell us what you’re looking for. We collect your request, the search or category you were on, and the time. We use requests to understand what people need and to find developers and apps to list. We don’t share them with developers in a way that identifies you.

If you also ask to be emailed when a matching app is listed, we collect your email address and first send one email asking you to confirm. Nothing else is sent unless you confirm. After that we email you, at most once a day, when a matching app is listed. Every alert has an unsubscribe link; unsubscribing deletes your email address straight away. If you don’t confirm within 7 days, we delete the address.

This form uses Cloudflare Turnstile and a one-way code made from your IP address to stop spam, as the enquiry form does. We delete that code after 30 days. We keep requests for 12 months; the email address of an active alert is kept until you unsubscribe.

7. Weekly email and saved apps

You can sign up on the home page or at the foot of any page for a weekly email listing the apps that went live on AppKade that week. We collect your email address and when you signed up, and first send one email asking you to confirm. Nothing else is sent unless you confirm. After that we email you on Monday mornings, only in weeks with new apps. Every email has an unsubscribe link; unsubscribing deletes your address straight away. If you don’t confirm within 7 days, we delete the address. The sign-up form uses Cloudflare Turnstile and a one-way code made from your IP address to stop spam, which we delete after 30 days.

When you save an app, the list of saved apps is kept only in your browser (its local storage), not on our servers, and you can clear it at any time. We count how many times each app is saved per day, without identifying you, using the one-way visitor code we use to count page views; the copy kept for saves is deleted after 2 days. Developers see these daily totals for their own apps.

8. Feedback about AppKade

When you send us a suggestion, feature request or problem from the Feedback page, we collect your message, the kind of feedback, the page you came from and the time. If you’re signed in, we link it to your account so you can follow it in your dashboard and we can tell you when we reply or change its status. If you’re not signed in, you can leave an email address, which we use only to reply about that feedback.

Feedback is seen only by AppKade and helps us decide what to build and fix. This form uses Cloudflare Turnstile and a one-way code made from your IP address to stop spam, which we delete after 30 days. We keep feedback for 24 months.

If a listing you started stays a draft for a few days, your dashboard may ask once what’s stopping you from publishing it. Answering is optional; your answer and any note become feedback from you, kept the same way.

9. Developers

If you create an account to list apps, we collect:

• Account details: your email address, and, if you sign in with Google, the name and profile picture Google shares with us. If you sign in with or connect GitHub, we receive your GitHub username, name and public profile details (bio, website, location and picture) once, to fill in your profile; we don’t ask for access to your repositories or private data. When a new account is created we check that its address can receive mail (a public DNS lookup of its domain), that it isn’t a temporary inbox (using a public list, and by sending only the address’s domain, for example “example.com”, never the full address, to UserCheck or DeBounce, which track temporary-mail services), and that the same mailbox isn’t already used by another account or a banned one. We don’t keep anything extra from this check.
• Profile details: display name, profile address, bio, website, GitHub link, and optional town or city, how you publish (an individual, a brand or nickname, or a company), and company name and registration number (the number isn’t displayed on your profile). These are public on your developer profile and listings, as are your profile picture (a square copy of the picture you upload or import from GitHub, stored on our media server), the month you joined, and any badges AppKade awards you (with the date). On a confidential sale listing we don’t show your profile.
• Listings: the content, links, logo and screenshots you submit, and for a dataset its sample file (published for anyone to download; it must not contain personal data, and we check it for obvious personal data when you upload it), including drafts and earlier versions, and your confirmation that you own each app, or what you sell, or have the right to list it. For a confidential sale listing, the business name, website and other private details you give us are seen only by you, our reviewers and the buyers you choose to share them with.
• Links you ask us to read: if you fill a listing from a link (your Google Play, App Store, GitHub, Hugging Face or website page), the link, when you asked, and which listing you used it on, with what that public page says about the app (its publisher, website and how many downloads, ratings or stars it has). We read only that public page and its images, to limit how often links can be read, to show our reviewers where a listing’s details came from, and to ask you to prove you own a well-known app before it’s listed. We keep this with your account.
• Sale feedback: if you sell something, your answer to “how did it go?”, seen only by AppKade.
• Review records: our review decisions, reasons and notes, and a record of each administrative action, kept for accountability.
• Private details: your legal name or company. This is not public: only you and AppKade see it, and we use it when we review your listings.
• Mobile number you confirm: if you confirm a Sri Lankan mobile number, the number, when you confirmed it, and a record of each code we text you (when it was sent, kept as a one-way code, never the code itself, with a one-way code made from your IP address to stop the form being used to send unwanted texts). The number is not public unless you choose to show it on your profile, where visitors can reveal it; otherwise only you and AppKade see it, and buyers see only that you are “Contactable”. If you added a phone number to your profile before 13 October 2026 and haven’t confirmed it, we no longer show it and keep it privately so you can confirm it. We use it to check you are reachable and to contact you about verification. We delete the records of sent codes after 30 days, and keep the number until you change it or close your account.
• Text messages: when SMS is enabled, we use Text.lk to send phone confirmation codes and transactional account messages. We keep the recipient number, message text with confirmation codes hidden, delivery status and cost for 90 days. Codes are never stored in the message log. SMS template history contains no recipient details.
• Verification: if you ask for the Verified badge, which proof you used (your website or GitHub account), when we confirmed it, and our decision and notes. It needs the mobile number you confirmed by SMS code; we don’t call you, and never ask for identity documents. We keep this while your account is open.
• Notifications: the updates we show in your dashboard and email to you, such as review decisions, new enquiries and replies to your feedback.
• Activity: how many views, link clicks, enquiries and offers your listings receive, the status you give each enquiry, and any sale value you choose to record.

We use this to run your account, review and publish your listings, contact you about them, deal with complaints and keep AppKade safe.

10. Why we are allowed to use it

• Consent, for sharing enquiries with developers and for app alert emails. You can withdraw consent for the future at any time (for alerts, by unsubscribing), but a developer who has already received an enquiry keeps it.
• Providing the service you asked for, for developer accounts and listings.
• Legitimate interests that do not override your rights, for security, fraud and spam prevention, moderation records, anonymous usage counts and understanding what apps visitors are looking for.
• Legal obligations, where we must keep or disclose information by law.

11. Service providers and where your information is stored

We use these providers to run AppKade. They process information on our behalf, under their own data protection terms:

• Supabase: database and sign-in, hosted in the United States.
• Vercel: website hosting, server logs and Web Analytics, mainly in the United States.
• Resend: sending sign-in, notification and app alert emails.
• Cloudflare: storage and delivery of the logos and screenshots developers upload (R2), and Turnstile spam protection on the enquiry, request, report and feedback forms.
• Text.lk: sending confirmation codes and account text messages to developers. Only the number and the message are sent.
• TypeSafe AI: only when you ask for it. When a developer asks for suggestions while editing a listing, its name, “What is it?”, tagline, description and website domain are sent to suggest its category, platforms and audience; nothing else about the developer is sent. When a visitor chooses “Find apps that fit” after a search, the search text is sent to work out the kind of software, platform and price they want. We keep what was understood with a one-way code of the search (not the search itself) and of the visitor’s IP address, to limit lookups, for 30 days.
• UserCheck and DeBounce: when a new account is created, the domain of its email address (never the full address) is checked against their lists of temporary-mail services.
• Google: if you choose to sign in with Google, and Google Analytics for visitor statistics. The links on a listing (its website, demo, buy, support and sample links, and the addresses they redirect to) are checked with Google Web Risk when it’s submitted and while it’s live, to keep phishing and malware off AppKade. Only the links are sent.

This means your information is processed outside Sri Lanka, mainly in the United States. We choose providers that give contractual commitments to protect personal data, and we will follow the Data Protection Authority’s requirements on transfers outside Sri Lanka as they are issued.

We do not sell your information or use it for advertising. We disclose it to others only as described here, or when required by law.

12. Cookies

We use cookies to keep developers signed in, to count listing visitors for their developers (see Visitors) and, through Google Analytics, to measure visits (see Visitors). We do not use advertising cookies. Cloudflare Turnstile may store small items in your browser while it checks our forms. Your saved apps, and unsent text in some forms, are kept in your browser’s storage on your device; they are not cookies and aren’t sent to us.

13. How long we keep information

• Enquiries, offers and offer conversations: 12 months after the enquiry or offer is sent.
• “What are you looking for” requests: 12 months. Alert email addresses: until you unsubscribe, or 7 days if you never confirm.
• Dashboard notifications: 12 months.
• Spam-protection codes: 30 days. Listing visitor codes, with how each visitor arrived and their device and country, and link-click codes: 180 days; IP address and impression codes: 2 days; view and click counts are kept. Daily search, filter and “Make an offer” counts: 90 days.
• Confidentiality acceptances and post-sale ratings: kept with the offer they belong to (12 months).
• Listing reports: 12 months; the IP code inside them, 30 days.
• Questions about apps: answered questions while the app is listed; others, 12 months; your email address until we’ve emailed you once (at most 30 days if the question isn’t sent on).
• Reviews: published reviews while the app is listed; reviews we don’t publish, 12 months; reviewers’ email addresses, 12 months.
• Feedback about AppKade: 24 months; the IP code inside it, 30 days.
• Weekly email: your address until you unsubscribe, or 7 days if you never confirm. Saved apps: in your browser until you remove them.
• Developer accounts, profiles and listings: while the account is open. If you ask us to delete your account, we delete it within 30 days.
• Review and administrative records: up to 2 years after a listing is closed, to handle complaints, disputes and repeat abuse.
• Server logs and emails held by our providers: for the limited periods their services keep them.

14. Your rights

Under the PDPA you can ask us to:

• tell you what information we hold about you and give you a copy;
• correct information that is wrong or incomplete (developers can edit their profile and listings in the dashboard);
• delete your information, or stop using it, where we no longer have a valid reason to keep it;
• withdraw consent you have given.

Email support@appkade.lk from the address we have for you, or tell us which enquiry you sent. We may need to confirm your identity. We aim to reply within 21 working days.

If you are not satisfied with our response, you can complain to the Data Protection Authority of Sri Lanka.

15. Security

We protect information with access controls in the database, encrypted connections, and by keeping administrative keys off the public website. No system is perfectly secure; if we become aware of a breach that affects you, we will tell you and the authorities as the law requires.

16. Children

AppKade is not directed at children. Developer accounts are for people aged 18 or over, and we do not knowingly collect information from children under 16.

17. Changes to this notice

We will update this notice when our practices change, and change the “last updated” date above. For significant changes we will tell registered developers by email. See also our Terms of Use.