Privacy Policy

Who is responsible

Paywall Parity is responsible for the personal information described in this policy, except where a named provider acts independently for its own purposes. Privacy and data requests can be sent to admin@paywallparity.com. Service support is available at support@paywallparity.com.

Information we process

• Account data: name, email address, authentication and session records, workspace membership, and account preferences.
• Store and catalogue data: app identifiers, products, plans, offers, regional prices, import status, recommendations, approvals, deployments, verification results, and audit events.
• Credentials: encrypted provider credentials are held in a dedicated credential vault; the application database stores an opaque reference rather than the credential itself.
• Revenue signals: normalised, aggregate-safe events and pseudonymous identity digests from configured RevenueCat connections. We do not retain raw RevenueCat webhook bodies or raw app-user IDs.
• Billing data: Dodo customer, product, subscription, status, cadence, and entitlement identifiers. Dodo Payments processes card and payment-method details; Paywall Parity does not store full card numbers.
• Technical data: IP address, user agent, timestamps, security logs, error details, and request metadata needed to secure and operate the service.

Why we process it

We process information to:

• create accounts, authenticate users, and enforce workspace permissions;
• import catalogues and calculate, explain, publish, and verify approved pricing changes;
• provide billing, trials, app-capacity enforcement, support, and service communications;
• protect the service, prevent abuse, investigate incidents, and maintain audit records;
• meet tax, accounting, and dispute obligations; and
• improve reliability using aggregated or de-identified operational information.

Depending on the context, we rely on performing our agreement with you, your consent, obligations we are required to meet, and our legitimate interest in operating and securing the service.

Service providers and disclosures

We disclose only what is needed to the providers that run the service: cloud hosting, a managed database, credential storage, and background job processing. You sign in with Google or GitHub, and whichever you choose handles that sign-in; we never receive a password. Google receives authorised requests when you connect or publish to Google Play. RevenueCat supplies revenue events only when you configure that integration. Dodo Payments acts as merchant of record and processes checkout, tax, invoices, refunds, and subscription events under its own terms and privacy policy.

We may disclose information where we are legally required to, to protect rights or safety, or as part of a business transaction subject to appropriate safeguards. We do not sell personal information or share it for third-party behavioural advertising.

Where information is processed

Our providers and users are in different countries, so information may be processed outside the country where you live. When it is, we use contractual and technical safeguards appropriate to the information.

Retention

We retain account and workspace information while the account is active and for a reasonable period afterward. Billing, security, deployment, and audit records may be kept longer where needed for tax, dispute, or fraud-prevention purposes. Credential material is deleted or made inaccessible when a connection is removed, subject to backup and incident-recovery cycles. We delete or de-identify information when it is no longer reasonably needed.

Security

Measures include encryption in transit, scoped tenant access, role-based permissions, separate credential storage, signed webhook verification, bounded request bodies, and audit records for sensitive operations. No system is perfectly secure; please report a suspected incident to admin@paywallparity.com.

Cookies and local storage

We use essential session and preference storage for authentication, security, workspace selection, and interface settings. We do not currently use third-party advertising cookies. If optional analytics or marketing cookies are introduced, this policy and any consent controls they call for will be updated first.

Children

The service is built for app developers and businesses. It is not directed to children, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will remove it.

Your choices and rights

You can ask to access, correct, or delete your personal information, to restrict or object to how we use it, to receive a portable copy, or to withdraw consent where consent is the basis. Depending on where you live, you may have further rights, including the right to raise a concern with your local data-protection authority. We may need to verify your identity before completing a request.

Changes to this policy

We will publish changes here with a revised effective date. If a change materially affects how we use account information, we will provide additional notice through the service or account email where reasonably possible.