Legal

Privacy Policy

This policy describes what Unstar.app collects, why it is collected, who processes it, how long it is kept, and how to get a copy of it or have it deleted.

Last updated: 2026-08-05

1. Who Is Responsible

Unstar.app (the “Service”) is operated by Kenan Atmaca (the “Operator”), established in Türkiye. The Operator is the data controller for the personal data described in this policy. For any question or request relating to your data, write to [email protected].

2. Browsing Without an Account

You can read every public page on the Service without signing in and without giving any personal data. In that case the following is processed:

  • Server logs. IP address, user agent, requested URL, and timestamp, written by the web server and used for security, abuse prevention, and diagnosing faults.
  • Daily usage limits. Free analyses are capped per day. For signed-out visitors the counter is keyed to a hashed IP address held in memory, not to a stored IP address, and it is discarded when the counter resets.
  • Bot protection and delivery. Traffic passes through Cloudflare, which processes connection data to filter automated abuse and to serve pages.

The legal basis for this processing is legitimate interest in keeping the Service available, secure, and usable.

3. Accounts and Purchases

Signing in is optional and is handled by Google. When you sign in, the Service receives and stores your email address, display name, and profile image URL, and creates an account record so that saved apps, alerts, and purchases can be attached to it. The Service never receives your Google password.

  • Account data. Email, display name, profile image, subscription status, and the applications on your watchlist or covered by a purchased report.
  • Content you submit. Community reviews (Review Plus) and alert keywords. Published community reviews show a masked display name, for example “Jo*** Sm***”.
  • Payment data. Payments are processed by Polar.sh as merchant of record. Card numbers are never received or stored by the Operator. The Service stores only the resulting subscription or purchase status and the identifiers needed to reconcile it.

The legal basis is performance of a contract for account and purchase data, and consent for optional features you choose to use.

4. Email We Send

Email is delivered through Resend. Two kinds go out. Transactional messages relate to your own account or a request you made: a welcome message, purchase confirmations, a health report you asked for, and monitoring alerts for the applications where you switched alerts on. Optional messages are the weekly watchlist digest and product or offer emails, which include the notice when you reach the daily limit and the follow-ups after a Full App Report purchase. There is no marketing newsletter and email addresses are never sold or shared for third-party marketing.

Every optional email carries an unsubscribe link that works without signing in, and the same two switches live under Email Preferences in your dashboard. Per-application alerts are switched off in the watchlist, and removing an application from the watchlist also stops its digest entries. If you would rather we do it, write to [email protected].

5. Analytics

The Service uses Google Analytics 4 to measure aggregate traffic: which pages are visited, from which country, on which type of device, and which buttons are used. This is used to decide what to build and what to write. The Operator does not use analytics data to identify individual visitors and does not combine it with account data to build advertising profiles.

6. Advertising and Cookies

Article, application, and listing pages carry display advertising served by Google AdSense. Third-party vendors, including Google, use cookies or similar identifiers to serve ads based on prior visits to this and other websites, and to measure whether an ad was seen. The Operator does not choose which advertiser appears on which page and does not receive the browsing history behind an ad.

  • Essential cookies. Sign-in session cookies set when you log in. Without them an account cannot stay signed in.
  • Analytics cookies. Set by Google Analytics to measure aggregate traffic.
  • Advertising cookies. Set by Google and its advertising partners to serve and measure ads.

Visitors in the European Economic Area, the United Kingdom, and Switzerland are shown a consent message before any non-essential cookie is set, and can allow, refuse, or manage individual purposes. Your choice can be changed at any time by reopening that message. Refusing does not restrict access to any page.

Ad personalization can also be turned off independently of this site at Google Ads Settings, and Google’s explanation of how it uses data from sites that run its services is at policies.google.com/technologies/partner-sites.

7. Affiliate and Sponsored Links

Some pages link to third-party products through affiliate links, and a qualifying purchase may earn the Operator a commission at no additional cost to you. Clicking such a link takes you to the partner’s site, where that partner’s own privacy policy applies and where a cookie may be set to attribute the referral. These links carry rel=“sponsored” and are disclosed on the page. How this and other paid placements work is described in section 4 of our Terms of Use.

8. Who Else Processes Your Data

The Service does not sell personal data. Data is shared only with the providers needed to run it:

  • Google for sign-in, analytics, and advertising.
  • Polar.sh as merchant of record for payments, invoicing, and refunds.
  • Resend for transactional email delivery.
  • Cloudflare for content delivery and bot protection.
  • Hetzner for server hosting in Germany, where the database resides.
  • OpenRouter and its model providers for generating review summaries. Only public review text is sent for analysis, never account data.

Several of these providers are established outside your country, so data may be transferred internationally. Such transfers rely on the providers’ own safeguards, including standard contractual clauses where required.

9. How Long Data Is Kept

  • Account data is kept while the account exists and is deleted on request.
  • Purchase and billing records are kept as long as tax and accounting rules require, and are also held by Polar as merchant of record.
  • Community reviews stay published until you delete them or the account is deleted.
  • Server logs rotate automatically and are kept for a short operational window, currently around a week.
  • Hashed usage counters are held in memory only and disappear at the daily reset or on restart.

10. Your Rights

Depending on where you live, you may have the right to access the personal data held about you, to correct it, to have it deleted, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw consent at any time. Users in the European Economic Area and the United Kingdom have these rights under the GDPR, users in Türkiye under KVKK, and users in California under the CCPA, which also includes the right not to be discriminated against for exercising them.

To exercise any of these, write to [email protected] from the address on the account. Requests are answered within 30 days. Account deletion removes the account record, watchlist, alert settings, and community reviews. If you believe your data has been mishandled, you may also complain to your local data protection authority.

11. Children

The Service is not directed at children and accounts are not knowingly created for anyone under 16. If you believe a child has created an account, write to [email protected] and the account will be removed.

12. Changes to This Policy

This policy is updated when the Service changes, when a new provider is added, or when the law requires it. The “Last updated” date at the top of this page shows the most recent revision, and material changes are announced on the site.

Want your data, or want it deleted?

Write from the email address on the account and say what you want. No form, no account-closure survey, answered within 30 days.

[email protected]

Looking for the content and trademark policy instead? See our Terms of Use.