Privacy Policy

About this policy

NorthYak is an independently operated App Store intelligence service. We decide how information is used to operate NorthYak. For privacy questions or requests, email privacy@northyak.com.

Information we use

• Accounts, when available. Name, email, verification status and profile image; a password hash for email/password accounts; and provider account identifiers for social sign-in. Sessions include an identifier, expiry, IP address and browser user agent. We also process verification, password-reset and account-deletion tokens.
• Searches and app information. Keywords, app identifiers, selected App Store country or region (storefront), device and related results. We retain shared observations and derived ASO metrics to answer requests and reuse collected information. Please avoid entering personal or confidential information in searches.
• Security and operation. Connection metadata, including IP addresses, user agents and referrers; challenge results; request times, status, errors and usage counters. Rate limiting uses an address-derived identifier. It is not anonymous simply because the address is hashed.
• Messages. Your email address and the information you send when contacting us, plus account emails such as verification, reset and deletion messages.

Google and GitHub sign-in

When Google sign-in is available and you choose it, we request openid, email and profile: your Google account identifier, name, email, email-verification status and profile picture. We use Google user data only for authentication and account functionality, not advertising or AI explanations. We do not request access to Gmail, Drive or Calendar. GitHub sign-in similarly supplies profile, account identifier, avatar and email information for your account.

Our authentication integration stores provider identifiers and can retain access, refresh and ID tokens supplied by the provider. These are credentials, distinct from your password. Signing out of NorthYak does not by itself revoke a provider grant; you can also remove access in your Google or GitHub account settings.

Why we process information

We use information to provide requested searches and account features, send essential account messages, respond to support requests, prevent abuse and keep the service reliable. Where the GDPR applies, providing the service you request relies on performance of our contract; security, troubleshooting and service measurement rely on our legitimate interests in operating and improving NorthYak, subject to your rights. Processing required by law relies on the relevant legal obligation. Providing account details is necessary to create an account; the public inspector can be used without one.

Service providers and data flows

• Cloudflare delivers and protects the website and API. Turnstile processes browser and device signals and challenge results to distinguish legitimate requests from abuse. See its Turnstile privacy notice.
• Oracle Cloud and our own server host the backend and data. The API runs in Frankfurt, Germany; storage, monitoring and backups use an operator-managed server in Ukraine.
• Google, GitHub and Resend support sign-in and transactional email. Resend receives the recipient address and message content, including account action links. Email also passes through the sender’s and recipient’s mail providers.
• Apple and network proxy providers support App Store searches and lookups. Search inputs go to Apple through direct connections or managed proxy routes, including Spider and a separate proxy pool. Proxy operators handle connection and destination metadata. NorthYak account cookies and OAuth credentials are not added to these Apple requests. Your browser also contacts Apple’s image servers directly to load app artwork, exposing normal connection metadata.
• OpenRouter and the selected model provider process keyword, storefront, device and relevant metric evidence when an AI explanation is generated. The prompt does not include account email or OAuth credentials, but a keyword can itself contain personal information. Explanations and usage records are stored for reuse and operation. Provider retention and data use vary; see OpenRouter’s provider policies.

These services may process information internationally, including outside your country and the European Economic Area. Countries can provide different protections. Contact us for information about recipients and the safeguards applicable to your data.

Website measurement and cookies

Cloudflare Web Analytics measures visits, page views, referrers, browser/device information, country and performance. Our current setting excludes visitors in the European Union. Cloudflare describes this as cookieless measurement; see its Web Analytics documentation. We do not run Google Analytics, PostHog, Meta Pixel, session replay or advertising and retargeting integrations. We do not sell personal data or share it with advertising networks. Authentication cookies and other browser storage are explained in the Cookie Policy.

Retention and deletion

We retain account information while your account exists, until you request deletion. Sessions normally expire after seven days, with renewal during use; the cookie cache lasts five minutes. Verification and recovery links have shorter validity periods. Expiry prevents use of a token but does not always immediately remove its stored record.

Central operational logs and metrics are currently configured for 31 days of retention, with deletion processing afterward. Local diagnostic files rotate by size. Nightly backups target seven days; failed rotation and separate migration snapshots can leave older copies until cleanup. Account deletion does not immediately remove every recovery copy.

Shared App Store observations, search inputs and AI results are not automatically removed with an account. We keep them for the catalogue and reusable history; they currently have no fixed expiry. If an input contains your personal data, identify it in your request so we can assess its removal. Support correspondence is kept as needed to resolve the request and document its handling. Providers apply their own retention to data they hold.

Your choices and rights

Email privacy@northyak.com to request access, correction or deletion. Depending on applicable law, you may also request a copy in a portable format, restrict processing, object to processing based on legitimate interests, or complain to your local data-protection authority. We may ask for proportionate proof of identity and will respond within the time required by applicable law. Account deletion is available through our email request process.

Security, age and changes

We use HTTPS, password hashing, access controls, request limits and security challenges. No system can guarantee absolute security. NorthYak is intended for professional use by adults aged 18 or over. If a child has provided personal information, contact us to request removal. We update the dates on this page when the policy changes and will highlight material changes on the website or by email where appropriate.