Privacy policy

1. Who is responsible for your data

TrueLaunch is run by IYGroup Developer Studio, a sole proprietorship based in India. We decide why and how your personal data is used, which makes us the “data fiduciary” under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the “controller” under the EU and UK GDPR. Questions or requests: support@vascario.com. Grievance Officer: iycreateapp@gmail.com. Last updated: 3 November 2026.

2. What we collect

• Account: email address, name, password (stored only as a secure hash), or your Google account's name, email and picture if you sign in with Google; confirmation that you are 18 or older and when you accepted our terms.
• Profile (optional): username, avatar, bio, website and social links you choose to add.
• What you post: app listings (text, icons, screenshots, links), reviews, upvotes, follows, launch dates and reports.
• Sign-in and security: session details, sign-in times, IP address and browser/device type, so you can see your sign-ins, sign out other devices, and so we can stop abuse.
• Visit streak: the last day (UTC) you visited while signed in, and how many days in a row that has been, to show a streak and its badge on your public profile. Only the day is kept, not times or pages.
• Follows and emails: the developers you follow (so we can tell you when they launch; the number of followers is public, not who they are) and whether you get the weekly summary email about your apps. Turn that email off in your settings or with the link in every one.
• Ownership checks: when you claim an app, the developer email shown on its Google Play listing is read from the store to send a one-time code. We keep only a hash of the code and a masked address (like “j•••@studio.com”).
• Sponsored spots, bids and payments: the spots you buy, the bids you place for your apps, what you paid and any refunds (and any old ad balance). Card and billing details are handled by our payment partner, Dodo Payments; we never see or store your card number.
• Server logs: when you load a page our hosting provider records the IP address, the address requested (which can include a search term), the browser and the time, for security and to fix errors. Our email provider keeps delivery logs for the emails we send you.
• Records we keep to show we followed the rules: your cookie choices (with the policy version), when you accepted our terms, and moderation and audit records about your account, listings or reports.
• Anonymous counts: page views, store-link clicks, sponsored impressions and clicks, and search terms (as typed, so please don't search for personal details), counted per day without names, accounts or IP addresses.
• Cookies and similar storage: see the Cookie policy. Google Analytics and Microsoft Clarity run only if you allow it.

We don't collect government IDs, financial account details, health data or precise location, and we never collect or track store ratings or reviews.

3. Why we use it, and on what basis

• To run your account and the service (show your listings and reviews, launches, notifications, sponsored spots): to perform our contract with you, and with your consent given at sign-up under the DPDP Act.
• To keep the service safe and honest (detect fake reviews, rating swaps, spam and abuse; secure sign-ins; moderation): our legitimate interest and, in India, the legitimate uses the DPDP Act allows.
• To send service emails (confirming your email, password resets, ownership codes, important changes): to perform our contract.
• To process payments, keep accounts and meet tax and legal duties: legal obligation and contract.
• To understand how the site is used (Google Analytics and Microsoft Clarity, including heatmaps and session replays with page text hidden): only with your consent, which you can withdraw at any time in “Cookie settings”.

We do not sell your personal data, share it for cross-context behavioural advertising, or use it to make decisions with legal effects about you by automated means alone.

4. What others can see

Your public profile, the apps you list, your reviews and your upvote counts on apps are public. Your email address, balance, payments, sign-in history and reports are never shown to other members. Sponsored spots show which app holds a spot and what it paid, and the bid board shows each app's total bid; neither ever shows who paid, when, or their balance.

5. Who processes data for us

We use these service providers, under contracts that let them use the data only to provide their service to us:

• Google Cloud (hosting and file storage, United States)
• Supabase (database, Australia)
• Resend (sending emails, United States)
• Google (“Sign in with Google”, if you choose it; Google Analytics, only with your consent)
• Microsoft (Clarity heatmaps and session replays, only with your consent, United States)
• Dodo Payments (payments for sponsored spots and bids, as merchant of record)
• Sentry (error reports, without your IP address, cookies or account details, United States)

App icons and screenshots imported from Google Play or the App Store load directly from Google's and Apple's image servers. When you view them, your browser sends those servers your IP address and browser details, as it does for any image on the web. We don't send them anything else about you.

We may also share data when the law requires it, to protect people's safety or our rights, or as part of a transfer of the service (we'll tell you first).

6. International transfers

We are based in India and our providers store data in the United States and Australia. When data moves between countries we rely on our providers' contractual safeguards (such as the EU Standard Contractual Clauses for data from the EU and UK) and transfer data only to countries the Indian government has not restricted.

7. How long we keep it

• Account and profile: while your account is open. When you delete it in Settings, your name, email, profile and sign-ins are removed straight away.
• Reviews and listings: until you delete them or your account. Reviews may be kept in anonymised form (no name or link to you) to keep ratings accurate.
• Sign-in records (session, IP address and browser): until 90 days after the session ends.
• Server logs: about 30 days. Daily search counts: 13 months.
• Cookie choices and terms acceptance: as long as your account exists, so we can show what you agreed to.
• Reports and moderation records: as long as needed to handle disputes and repeated abuse.
• Payments, sponsored spots and invoices: as long as Indian tax and accounting law requires (generally 8 years).
• Backups: up to 30 days after the original is deleted.

8. Your rights

Depending on where you live, you have the right to:

• get a summary or copy of the personal data we hold about you, and who we've shared it with;
• correct or complete it (most of it you can edit yourself in Settings);
• have it deleted, and receive it in a portable format;
• withdraw consent at any time (this doesn't affect what we did before, and some features may then stop working);
• object to or restrict some uses (EU/UK);
• nominate someone to exercise your rights if you die or become unable to (India);
• know that we don't sell or share your data for advertising, and not be treated differently for using your rights (California and other US states). We honour Global Privacy Control signals.

You can download your data or delete your account yourself in Settings, under “Your data”. For anything else, email support@vascario.com from the address on your account. We reply within 30 days (we may need to confirm it's you). If you're not happy with our answer, contact our Grievance Officer at iycreateapp@gmail.com. You can also complain to the Data Protection Board of India, or, in the EU/UK, to your local data protection authority.

9. Security

We use encryption in transit (HTTPS), hashed passwords, access controls and limited staff access. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

10. Children

TrueLaunch is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you believe a child has an account, write to support@vascario.com and we'll delete it.

11. Changes

We'll update this policy when our practices change and show the date at the top. For important changes we'll tell signed-in members before they take effect.