# Your data, your keys and your rights

> Uptika stores integration keys encrypted with AES-256-GCM, checks workspace isolation on every API call, never sees your card details and lets you download or delete your data whenever you want.

Last updated: 2026-11-05 · https://uptika.app/en/trust

## How do we protect your account and keys?

What we do, and what we do not do yet, plainly.

- **Encrypted keys**: Your App Store Connect, Google Play, Apple Ads and RevenueCat keys and your alert channel secrets are stored encrypted with AES-256-GCM and never shown again once saved.
- **Passwords**: Your password is never stored as plain text; it is hashed with scrypt.
- **Sessions**: The session cookie is HttpOnly and SameSite=Lax, valid for 30 days. Resetting your password signs out open sessions.
- **Workspace isolation**: Every API call is checked so a request only reaches its own workspace data.
- **API keys**: Shown only once; you see when each was last used and can revoke it at any time. The API is read-only; its one write is adding keywords.
- **Ad budget**: Nothing that could raise spend happens without your explicit approval, and every change is logged with its before and after values.
- **Payments**: Card payments are handled by iyzico; your card details never reach Uptika.
- **No two-factor sign-in yet**: Two-factor authentication (2FA) is not available yet. Use a strong password you do not use anywhere else.

## What data do we read and what do we store?

### Read from the stores

Keyword ranks, category charts, app listings and reviews are read from the App Store's and Google Play's public data. None of this needs a connected account.

### What you give us

- **Account:** your e-mail address, your name and a hash of your password.
- **Workspace:** your apps, tracked keywords, competitors, notes, alert rules and channels.
- **Connected accounts:** the keys, encrypted, and the installs, revenue and ad numbers read with them.
- **Payments:** payment and receipt records. Card details never reach Uptika.

### Usage records

To improve the product and find bugs we keep product analytics events, sign-in events and presence for 180 days and the error log for 90 days. Free-tool visitor usage counters are deleted after 2 days. All retention periods are on the [Capabilities](https://uptika.app/en/capabilities) page.

## What do we never show publicly?

The only thing that leaves your dashboard is the score page and badge you switch on.

- **Score page only when you switch it on**: A public score page exists per storefront only if you turn it on. Turn it off and the badge goes neutral with no score; rotate the link whenever you like.
- **Store listing data only**: The public page and the badge show only the parts computed from the store listing.
- **Console data stays inside**: Store console data such as installs, revenue and conversion shows only in your dashboard and your report, never on the public page.

## Which services do we work with?

Uptika uses outside services for a few jobs; each one receives only what that job needs.

| Service | What for | What it receives |
| --- | --- | --- |
| iyzico | Card payments | What the payment needs. Your card details never reach Uptika. |
| Resend | Transactional e-mail: password resets, team invites, receipts, the contact form | The recipient's e-mail address and the e-mail's content |
| DeepSeek | AI text: Uptika's take, Ask AI answers, drafts | Only the numbers on screen and your question. Your store credentials are never sent. |
| Browsers' push services | Delivering Web Push notifications to your phone or computer | The notification text, sent to the subscription address your browser provides |

## What rights do you have over your data?

- **Download it:** [Settings › Plan and billing](https://uptika.app/app/?lang=en#/settings/billing) › Account and data › Download my data. Everything we store about you downloads as JSON.
- **Delete it:** delete your workspace or your account from the same card. Steps, and what is deleted and what is kept: [Delete account](https://uptika.app/en/delete-account).
- **Ask or object:** for any data protection request, write to destek@uptika.app from your account's e-mail address.

Payment and receipt records are kept for 10 years under Turkish tax law, without the Turkish ID number.

## Legal documents

- [Privacy](https://uptika.app/privacy): What data we process and why.
- [Data Protection Notice (KVKK)](https://uptika.app/legal/kvkk.html): Notice under Turkey's Law No. 6698 (in Turkish).
- [Terms of Use](https://uptika.app/legal/kullanim-sartlari.html): The terms for using the service (in Turkish).
- [Cookie Policy](https://uptika.app/legal/cerez-politikasi.html): Which cookies, and why (in Turkish).
- [Distance Sales Agreement](https://uptika.app/legal/mesafeli-satis.html): In Turkish.
- [Pre-contract Information](https://uptika.app/legal/on-bilgilendirme.html): In Turkish.
- [Cancellation and Refunds](https://uptika.app/legal/iptal-iade.html): In Turkish.

## Questions

### Can Uptika change anything in my store accounts?

Uptika reads from the accounts you connect. The one exception is Apple Ads, where a change happens only when you approve it in the dashboard, and it is logged. Your listing and your app are never touched.

### Where does my data go when I use AI features?

For Uptika's take, Ask AI and drafts, only the numbers on screen and your question are sent to DeepSeek. Your keys and account details are not sent.

### Is there two-factor authentication?

Not yet. Until then, use a strong password you do not use anywhere else.

### What if I find a security issue?

Write to destek@uptika.app with the details. We ask that you do not share it publicly until it is fixed.

---

Uptika is an ASO and store-intelligence tool for the App Store and Google Play. https://uptika.app/en