Encrypted keys
Your App Store Connect, Google Play, Apple Ads and RevenueCat keys and your alert channel secrets are stored encrypted with AES-256-GCM and never shown again once saved.
Trust
Your data, your keys and your rights
Uptika stores integration keys encrypted with AES-256-GCM, checks workspace isolation on every API call, never sees your card details and lets you download or delete your data whenever you want.
How do we protect your account and keys?
What we do, and what we do not do yet, plainly.
Passwords
Your password is never stored as plain text; it is hashed with scrypt.
Sessions
The session cookie is HttpOnly and SameSite=Lax, valid for 30 days. Resetting your password signs out open sessions.
Workspace isolation
Every API call is checked so a request only reaches its own workspace data.
API keys
Shown only once; you see when each was last used and can revoke it at any time. The API is read-only; its one write is adding keywords.
Ad budget
Nothing that could raise spend happens without your explicit approval, and every change is logged with its before and after values.
Payments
Card payments are handled by iyzico; your card details never reach Uptika.
No two-factor sign-in yet
Two-factor authentication (2FA) is not available yet. Use a strong password you do not use anywhere else.
What data do we read and what do we store?
Read from the stores
Keyword ranks, category charts, app listings and reviews are read from the App Store's and Google Play's public data. None of this needs a connected account.
What you give us
- Account: your e-mail address, your name and a hash of your password.
- Workspace: your apps, tracked keywords, competitors, notes, alert rules and channels.
- Connected accounts: the keys, encrypted, and the installs, revenue and ad numbers read with them.
- Payments: payment and receipt records. Card details never reach Uptika.
Usage records
To improve the product and find bugs we keep product analytics events, sign-in events and presence for 180 days and the error log for 90 days. Free-tool visitor usage counters are deleted after 2 days. All retention periods are on the Capabilities page.
What do we never show publicly?
The only thing that leaves your dashboard is the score page and badge you switch on.
Score page only when you switch it on
A public score page exists per storefront only if you turn it on. Turn it off and the badge goes neutral with no score; rotate the link whenever you like.
Store listing data only
The public page and the badge show only the parts computed from the store listing.
Console data stays inside
Store console data such as installs, revenue and conversion shows only in your dashboard and your report, never on the public page.
Which services do we work with?
Uptika uses outside services for a few jobs; each one receives only what that job needs.
| Service | What for | What it receives |
|---|---|---|
| iyzico | Card payments | What the payment needs. Your card details never reach Uptika. |
| Resend | Transactional e-mail: password resets, team invites, receipts, the contact form | The recipient's e-mail address and the e-mail's content |
| DeepSeek | AI text: Uptika's take, Ask AI answers, drafts | Only the numbers on screen and your question. Your store credentials are never sent. |
| Browsers' push services | Delivering Web Push notifications to your phone or computer | The notification text, sent to the subscription address your browser provides |
What rights do you have over your data?
- Download it: Settings › Plan and billing › Account and data › Download my data. Everything we store about you downloads as JSON.
- Delete it: delete your workspace or your account from the same card. Steps, and what is deleted and what is kept: Delete account.
- Ask or object: for any data protection request, write to destek@uptika.app from your account's e-mail address.
Payment and receipt records are kept for 10 years under Turkish tax law, without the Turkish ID number.
Legal documents
- PrivacyWhat data we process and why.
- Data Protection Notice (KVKK)Notice under Turkey's Law No. 6698 (in Turkish).
- Terms of UseThe terms for using the service (in Turkish).
- Cookie PolicyWhich cookies, and why (in Turkish).
- Distance Sales AgreementIn Turkish.
- Pre-contract InformationIn Turkish.
- Cancellation and RefundsIn Turkish.
Questions
Can Uptika change anything in my store accounts?
Uptika reads from the accounts you connect. The one exception is Apple Ads, where a change happens only when you approve it in the dashboard, and it is logged. Your listing and your app are never touched.
Where does my data go when I use AI features?
For Uptika's take, Ask AI and drafts, only the numbers on screen and your question are sent to DeepSeek. Your keys and account details are not sent.
Is there two-factor authentication?
Not yet. Until then, use a strong password you do not use anywhere else.
What if I find a security issue?
Write to destek@uptika.app with the details. We ask that you do not share it publicly until it is fixed.