Privacy Policy

appps.io is a product studio based at 1500 N Grant St, Ste R, Denver, CO 80203, United States. For anything in this policy, including a request to see or delete what we hold, write to [email protected] and a person will answer.

This policy covers appps.io and its subdomains. It does not cover any separate application we have built for a client, which is governed by that client’s own policy.

Very little, and most of it only when you hand it to us. There is no advertising on this site, no ad pixel, and nothing that follows you to another website. We do count visits. See “Analytics” below, which you can decline.

Two things are collected through the contact form:

• What you type into the contact formYour name, your email address, your company if you give one, which services you selected, the budget range you selected, and the description of your project. Name, email, and description are required; the rest are optional.
• A one-way hash of your IP addressWhen you submit the form we hash your IP address together with a fixed secret and store only the result. The hash cannot be reversed into an address. It exists so we can tell repeat submissions apart and stop a flood of spam from one source, and nothing else. We do not store your raw IP address.
• Your browser’s user-agent stringThe line your browser sends identifying itself, truncated. It helps us tell a real submission from an automated one.

To reply to you. That is the whole purpose. A submission is a message asking us to get in touch, so we use it to get in touch, to scope the work you described, and to keep a record of the conversation.

We do not use it for marketing, we do not add you to a mailing list, and we do not sell or rent it. If you are in the EU or UK, our lawful basis is legitimate interest. Responding to someone who deliberately contacted a business is exactly the correspondence you would expect it to be.

Your submission is stored in a MongoDB Atlas database and emailed to us. You also receive an automatic acknowledgement at the address you gave, sent through our email provider. Those messages pass through the following services, each of which processes data on our behalf:

• Our hosting providerServes the site and keeps standard server request logs.
• MongoDB AtlasStores contact form submissions.
• Our email providerDelivers the notification to us and the acknowledgement to you.
• CloudinaryServes the video and imagery on the work pages. Like any file request, loading one tells Cloudinary your IP address and browser, and this happens whether or not you ever use the contact form.

The typefaces on this site are served from our own servers. Nothing is fetched from Google Fonts or any other font host at page load, so no request about your visit reaches them.

There are no embedded social widgets, comment systems, or chat scripts. The social icons in the footer are ordinary links. Nothing loads until you click one, and then you are on that company’s site under that company’s policy.

The one third party that runs code on this site is Google Analytics, covered in its own section above. It loads on every page so a visit can be counted, but with storage denied it holds nothing about you until and unless you accept.

We use Google Analytics to count visits and see which pages people read. We use it for nothing else: it is not connected to Google Ads, we run no advertising, and the advertising and personalisation signals Google Analytics can carry are switched off permanently rather than left to your choice.

It is off until you say otherwise. The tag loads with storage denied, so on your first visit it sets no cookie and cannot recognise you. It can only report that an anonymous visit happened. If you accept in the bar at the bottom of the page, it sets two cookies (named _ga and _ga_ followed by our property ID) which let it tell a returning visitor from a new one. If you decline, no cookie is ever set.

You can change your mind at any time by clearing this site’s data in your browser, which erases both the cookies and the record of your choice; the bar will ask again on your next visit.

Aside from the two analytics cookies above, which only exist if you accepted them, this site sets no cookies. Nothing here is used to advertise to you or to build a profile.

Two small items are written to your browser’s own storage, and neither is a cookie or leaves your device. A flag named "preloaded" records that you have already seen the intro animation so it does not replay as you move between pages; your browser discards it when you close the tab. A second, named "appps-analytics-consent", remembers whether you accepted or declined analytics, so we do not ask you twice. Both are readable only by this site.

Contact submissions are kept while the enquiry is live and afterwards as a business record of who approached us and about what. We review and clear old submissions periodically.

You can ask us to delete yours at any time. Email [email protected] from the address you used, and we will remove it from the database and confirm within 30 days.

Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. Email [email protected]. We do not charge for this and we do not require you to create an account.

If you are in Colorado, the Colorado Privacy Act gives you these rights specifically, along with the right to appeal a refusal. If we ever decline a request we will tell you how to appeal it and how to contact the Colorado Attorney General. If you are in the EU or UK, the GDPR gives you the same rights plus the right to object to processing and to complain to your national data protection authority. If you are in California, the CCPA applies.

For the avoidance of doubt: we do not sell personal information and we do not share it for targeted advertising. The only thing on this site you can opt out of is analytics, and you can do that in one click without giving us anything.

We operate from the United States and the services above are US-based. If you contact us from outside the US, your submission will be transferred to and stored in the US.

This is a business-to-business studio site. It is not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has sent us something, email [email protected] and we will delete it.

The site is served over HTTPS and the contact endpoint is rate-limited and origin-checked. Submissions sit in an access-controlled database. No system is perfect, and we will not pretend otherwise. But there is very little here to take, by design.

If we change how any of this works, we will change this page and move the date at the top. There is no version we can email you, because we do not keep a list to email.