Privacy Policy

Last updated 6 October 2026 · applies to ersaso.com and app.ersaso.com

ersASO is a Google Play ASO tool operated by Sanal Apps (Türkiye). This page explains what we store about you, why, and how to get it removed. We keep it short and literal; if something is unclear, write to info@ersaso.com.

What we store when you create an account

• Your e-mail address and a password hash. The password itself is never stored. We use the address to sign you in, to send verification, password-reset and account e-mails, and for alerts you enable.
• Your workspace name (a short handle you choose), your role in the workspace, and the time you accepted these terms.
• What you track: app package names, the store and language you pick, the keywords you add, the competitors you link, and the alert channels (e-mail address or Telegram chat id) you configure. This is your business data; the platform administrator can see counts about it but not the keyword text.
• AI provider keys, only if you add one on the Integrations page. They are stored encrypted with a server-side key and are sent only to the provider you chose, only for requests you trigger. Generated text is not stored.
• Two-step verification, only if you turn it on: the authenticator secret, encrypted with a server-side key, and one-way hashes of your recovery codes. The codes themselves are shown to you once and not kept.
• Sign-in and page activity: the time of your last sign-in, and which panel pages you open (the page type, such as "Rankings", with the day and a count). No app, keyword, search text or filter is recorded, nothing goes to a third party, and page counts are deleted after 180 days. We use them to decide which parts of the panel to improve or remove.
• Which kind of page you signed up from: sign-up links on our site carry a page type, such as “documentation”, “blog” or “free ASO score”. We store only that type with your workspace — not the page address, not where you came from before it, not your IP address — and use it to count which kinds of pages bring people who go on to add an app.

What we store without an account

• The free tools (ASO score, keyword ideas, listing checker, listing comparison) keep nothing about you. They apply a per-address rate limit for one hour, held in memory only.
• The landing site sets one cookie, dil, only when you switch language, so we stop redirecting you by browser language. The panel sets a session cookie and a CSRF cookie needed to keep you signed in.
• If you follow “Track this app” from the free ASO score, the panel keeps that package name, store and language in your browser’s local storage for up to 7 days so the add-app form opens filled in. It is not sent to us unless you add the app, and it is deleted once the form has read it.
• The page type on a sign-up link waits in the same local storage for up to a day and is sent only with the sign-up form; it is deleted once you have signed up.

What we read from Google Play

Everything the product measures comes from publicly visible store listings and search results. We never ask for, read, or store anything from your Google Play Console account.

Who else sees data

• Our hosting provider stores the database and daily backups (kept 14 days, on the same server).
• Our e-mail provider delivers the messages we send you.
• If you add an AI key, the AI provider you chose (Anthropic, Google or OpenAI) receives your app's public listing text and target keywords with each request you trigger, under that provider's own terms.

We do not sell data, run advertising, or use third-party analytics on the panel.

Logs and security

Server logs record request paths, timestamps and IP addresses for security and abuse prevention, and are rotated. Sign-in attempts are rate-limited per address. Administrative actions on the platform are written to an audit log that records who did what, never passwords or keyword text.

How long we keep things

For as long as your account exists. Deleting your account (Team → Your account) removes your user; deleting the workspace removes every app, keyword, ranking history, competitor and stored key in it, immediately and permanently. Aggregated keyword scores derived from public store signals are not tied to you and may remain.

Your rights

You can access, correct, export (CSV on every list) and delete your data from the panel at any time. For anything the panel does not cover, or to exercise rights under KVKK or GDPR, write to info@ersaso.com; we answer within 30 days.

Changes

If this policy changes in a way that matters, we e-mail account holders before it takes effect.