Privacy Policy

Last updated November 10, 2026

Appcart, operated by BURD LLC, a California limited liability company (“Appcart”, “we”, “us”), runs a confidential marketplace for buying and selling mobile apps at appcart.ai and its subdomains. This policy explains what information we collect, why, and the choices you have.

Information we collect

• Account information. When you sign in with Google or an email link, we receive your name and email address. We don't receive your Google password. Signing in doesn't give us access to anything else in your Google account; the optional Google connections described under “Google user data” each ask for your permission separately.
• App and listing information. Store links you provide, public store details for your app (name, developer, category, icon, ratings, description), the listing category, deal terms, and other listing details you enter.
• Connected accounts. If you connect App Store Connect, RevenueCat, Superwall, Stripe, or similar services, we store the read-only API keys you provide and use them to confirm you own the app and to read revenue and subscription figures. For Stripe, that's monthly totals of charges, refunds, disputes and Stripe's fees; we never see card numbers and the key can't move money. Keys are encrypted at rest and are never shown to anyone, including other members of your project.
• Documents. Files you upload to your project's data room, along with a log of who viewed or downloaded them.
• Team information. Email addresses of people you invite to a project and the permissions you give them.
• Usage and technical data. Basic logs such as IP address, browser type, and pages visited, used for security and reliability.

How we use information

• To run the marketplace: create listings, verify ownership and revenue, and let you share information with buyers you approve.
• To verify that listings are accurate, including cross-checking revenue reported by stores and monetization platforms.
• To review listings and transactions, prevent fraud, and keep the service secure.
• To communicate with you about your account, listings, and deals.

We use an AI model to draft your anonymous listing profile from your app's public store details. We don't sell your personal information and we don't use it for advertising.

What buyers can see

Listings are confidential. Buyers see your anonymous listing (its category) and verified metrics. Your app's name, store links, and documents are only shared with buyers you approve, and documents only according to the sharing settings you choose.

Messages between buyers and sellers

Conversations in the marketplace are stored on our servers. The Appcart team can read them to review listings, keep the marketplace safe, enforce our rules (such as no contact details before an NDA), and resolve disputes. We don't use them for advertising.

Service providers

We rely on trusted providers to run Appcart, who process data on our behalf:

• Supabase (database and authentication)
• Vercel (hosting)
• Cloudflare R2 (document storage)
• Resend (sending account and notification emails)
• Anthropic (suggesting categories for merchant names from linked accounts)
• Plaid and Mercury (read-only bank and card connections you choose to link)
• Meta, TikTok, and Google (read-only ad account connections you choose to link)
• Google AdMob and AppLovin (read-only in-app ad revenue for your app, if you connect them)
• Google (sign-in, and the optional Google Play and Google Ads connections)

When you connect Apple App Store Connect, RevenueCat, Superwall or Stripe, we request data from those services using the keys you provide, under their own terms and privacy policies.

Security

Data is encrypted in transit and at rest. API keys and sign-in tokens for the services you connect are stored in an encrypted vault, used only on our servers, and never sent to your browser, teammates, or buyers. Every connection is read-only. Deleting a connection, a project, or your account deletes its stored keys and tokens. Documents are stored privately and can only be opened through short-lived links issued to people with access. Access within a project is limited by the permissions its owner sets, and linking a bank account requires two-step verification.

No system is perfectly secure, and we can't guarantee that information will never be accessed, disclosed, or changed without authorization. Please protect your sign-in, give the keys you create only the access Appcart needs, and tell us right away at support@appcart.ai if you think your account or a connected service has been compromised.

If there's a security incident

If we learn that information we hold was accessed or disclosed without authorization, we will:

• Act right away to contain it, including revoking or deleting any affected keys and tokens so they can't be used.
• Notify affected users in the most expedient time possible and without unreasonable delay, as required by law, by email and in the app. The notice will say what happened, what information was involved, what we're doing about it, and what you can do, such as rotating a key or reconnecting a service.
• Notify regulators and, where their terms require it, the affected service providers (for example Google, Meta, or Plaid), and cooperate with them.
• Investigate the cause and fix it to prevent it from happening again.

Bank and card connections

You can choose to link business bank and card accounts so your app's costs fill in automatically. We use Plaid Inc. (“Plaid”) to connect most institutions, and Mercury's API when you provide a Mercury read-only token. You sign in to your bank directly through Plaid; we never see or store your bank login. By linking an account through Plaid, you agree to Plaid's collection and use of your information under the Plaid End User Privacy Policy.

Connections are read-only: we receive account names, the last four digits of account numbers, and transaction history (date, amount, merchant, description). Appcart cannot move money. We use this data only to build your profit & loss, which you and the buyers you approve can see. Merchant names and totals may be sent to Anthropic to suggest categories; account numbers and credentials never are. We never sell, rent, or share your financial data for advertising or any other third-party purpose.

Access tokens are stored encrypted. You can unlink an account at any time from Financials; when you do, we revoke the connection and delete its transactions from Appcart.

Ad platform connections

You can connect Meta (Facebook and Instagram) Ads, TikTok Ads, and Google Ads with a read-only sign-in. We receive the names and IDs of the ad accounts you can access, and performance data for the accounts you choose: spend, impressions, clicks, installs, results, campaign, ad set and ad names and status, and aggregated audience breakdowns (age range, gender, country). We never receive information about the individual people who saw your ads, and we never create, change, pause or delete anything in your ad accounts.

We use this data only to show you and your invited teammates your ad performance and to include ad spend in your profit & loss, which buyers you approve can see. We never sell it or use it for advertising. Access tokens are stored encrypted. You can disconnect at any time from Integrations, which deletes the token and the ad data we read with it. If you remove Appcart from your Facebook settings, Meta notifies us and we delete your Meta connection automatically; see Data deletion.

In-app ad revenue

If you connect Google AdMob (Google sign-in, read-only) or AppLovin MAX (a read-only Report Key), we read estimated ad revenue for the apps in your project, by day or month, and add it to your profit & loss. We don't receive any information about your app's users. Disconnecting deletes the stored sign-in or key.

AI tools you connect (MCP access)

You can create an access token that lets an AI tool you use (for example Claude Code or Cursor) read, and if you allow it, update, your project in Appcart over the Model Context Protocol. You choose what each token can do (for example financials, expenses, ad performance, or documents), and a token can never do more than you can. When your AI tool calls Appcart, the data it asks for, which can include revenue, ad, bank transaction, and document data, is sent to that tool and handled under its provider's terms and privacy policy, not ours. We store only a hashed copy of each token and record when it was last used. You can revoke a token at any time from MCP access, and it stops working immediately. Tokens never work on the sample project.

Requests from public authorities

If a government agency or other public authority asks us for personal data, including data received from connected platforms such as Meta:

• We review every request for legality before responding, including whether the authority has jurisdiction and whether the request follows the required legal process (for example, a valid subpoena, court order, or warrant).
• We challenge requests we consider unlawful, overly broad, or inconsistent with applicable law, using the legal remedies available to us.
• We disclose only the minimum data necessary to comply with a valid request, and nothing beyond its scope.
• We document every request: who made it, its legal basis, what was requested, our assessment, and what we disclosed or declined to disclose.
• Unless legally prohibited, we notify the affected user before disclosing their data, so they can seek their own remedies.

Retention and deletion

We keep your information while your account or project is active. Deleting a project permanently removes its listing, documents, connected accounts, and stored keys right away. To delete your account or request a copy of your data, contact us at support@appcart.ai. We delete your account and its data within 30 days of your request, including from backups. We may keep a limited record where the law requires it or to resolve disputes, such as signed agreements and fees owed under them.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to certain processing. Contact us and we'll respond within 45 days. We won't treat you differently for using these rights.

California residents

We don't sell personal information, and we don't share it for cross-context behavioral advertising. California residents can use the rights above (to know, delete, and correct their information) by contacting us. You can also ask an authorized agent to make a request for you.

Children

Appcart is for businesses and isn't meant for anyone under 18. We don't knowingly collect information from children.

Google user data

Appcart's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Every Google connection is optional, read-only, and started by you. Here is what each one reads and why:

• Google sign-in (name, email address): to sign you in and identify your account.
• Google Play Console (Google Play Android Developer API, Cloud Storage read-only, Play Developer Reporting API): to confirm that the Play developer account you sign in with publishes the app you are listing, and to read that app's monthly earnings report, install statistics, and crash and ANR rates from your Play Console reports. We only read files for the app you choose; we never publish, change, or delete anything in your Play Console or Cloud Storage.
• Google Ads (Google Ads API): to read the ad accounts you can access and, for the accounts you choose, monthly spend, impressions, clicks, conversions, installs, campaign and ad group names and status, and aggregated audience breakdowns. Google Ads only offers a full-access permission, so Appcart enforces read-only access itself: it only sends read (search) requests and never creates, changes, or pauses anything.
• Google AdMob (AdMob API, read-only): to read the AdMob publisher accounts you can access and, for this app, estimated earnings by month (from AdMob and the ad networks AdMob mediation serves). We never change ad units, mediation, or payments, and we receive nothing about your app's users.

What we keep. From these services we store the aggregated figures listed above (for example monthly earnings, spend, installs and rates, and campaign-level results), the names and IDs of the accounts and apps you connect, and the sign-in token for each connection. We don't store data about your app's individual users, and we never receive your Google password.

How we use it. Only to provide the features you use: verifying that you own the app, and showing you, your invited teammates, and the buyers you choose to approve your app's verified metrics, ad performance, and profit & loss. We don't use Google user data for advertising, lending decisions, or anything else, and we don't use it to develop, improve, or train AI or machine learning models.

Who it's shared with. We never sell Google user data or transfer it to data brokers, advertisers, or AI providers. It is shared only (1) with the people you choose: your invited teammates and buyers you approve, who see the aggregated figures, never your tokens; (2) with the infrastructure providers that host and run Appcart (database, hosting, and file storage), which process it only on our behalf to operate the service; (3) with an AI tool you connect yourself through MCP access (below), which can read the figures that token allows, at your request; and (4) when required by law. People at Appcart don't read it except as needed to support you, for security, or to comply with the law.

How we protect it. Data is encrypted in transit (HTTPS/TLS) and at rest. Sign-in tokens are stored separately in an encrypted secrets vault, are only ever used on our servers, and are never sent to your browser, teammates, or buyers. Access within Appcart is limited by project and by the permissions you grant each teammate, and only figures, never tokens, are shown to buyers.

How long we keep it, and deleting it. We keep it while the connection is active, refreshing it about once a day. When you disconnect a Google service from Integrations, we delete its token and the data we read with it right away. You can also revoke access at any time from your Google Account permissions, after which we can no longer read anything new. If you ask us to delete your account, we delete all of your Google user data within 30 days, including from backups.

Changes

We may update this policy. If changes are significant, we'll let you know in the app or by email before they take effect.

Contact

Questions about privacy: contact@appcart.ai.