Privacy Policy

Last updated: 26 September 2026

1. Who we are

App Software Ltd ("we", "us") is the controller of the personal data described here. We are a company registered in England and Wales with company number 07109450, and our registered office is 1 Derwent Business Centre, Clarke Street, Derby, Derbyshire, England, DE1 2BU.

For anything about your data, including the requests in section 7, email mail@appsoftware.com.

2. What this policy covers

This policy covers:

this website, www.appsoftware.com, including any account you create on it;
the payments you make to us for any of our products, which Stripe processes for us;
messages you send us.

Each product has its own privacy policy, which covers the data that product handles when you use it.

Product	Privacy policy
EtherPK	www.etherpk.com/privacy
AS Notes	www.asnotes.io/privacy
Agent Kanban	www.agentkanban.io/privacy
NumeroMoney	www.numeromoney.com/privacy

3. What we collect and why

Visiting the website

Server logs. Each request is logged with your IP address, your browser's user agent, the page requested and, if you are signed in, your username. We use the logs to keep the website secure and working (legitimate interests).
Our own page-view records. When a page loads, we record its address and title, the site you came from, your browser, language and screen size, and your IP address. Each page load gets a random ID that is not stored on your device, so your page views are not linked to each other. We use the records to see which pages are read (legitimate interests).
Umami analytics. We also count page views with Umami, which we run ourselves at analytics.appsoftware.com. It records the page, the site you came from, your browser, screen size and language, and an approximate location worked out from your IP address, which it does not store. It sets no cookies.
Maps. A page that shows a map loads it from Mapbox, which then receives your IP address and browser details under its own privacy policy. No other page contacts Mapbox.

Neither analytics tool records a page whose address contains a password reset or email validation link.

Cookies

The website sets only the cookies it needs to work, so it does not ask for consent:

Cookie	Purpose	Lasts
`.AspNetCore.Antiforgery.*`	Protects forms against cross-site request forgery	Until you close your browser
`.AspNetCore.Mvc.CookieTempDataProvider`	Carries a message to the next page, for example after a failed Google or Microsoft sign-in	Until you close your browser
`google-soc-auth-`, `microsoft-soc-auth-`	Connect a Google or Microsoft sign-in to the page that started it	5 minutes
`auth-appsoftware-prod`, `auth-refresh-appsoftware-prod`	Keep you signed in	30 days

We set no analytics or advertising cookies.

Accounts on this website

You can create an account with an email address and password, or by signing in with Google or Microsoft. For an account we hold:

your email address and username;
your password, stored only as a hash;
whether your email address is verified;
your Google or Microsoft account ID and email address, if you sign in with them, and the access tokens they issue, stored encrypted;
your two-factor authentication secret, if you turn it on;
your email preferences, which start with every type of email turned off;
a record of each sign-in session, including the IP address it started from;
anything you create on the website, such as comments, notes, saved calculator inputs and uploaded files.

We use this to provide your account (contract). Google and Microsoft confirm who you are to us under their own privacy policies.

Contacting us

The contact form sends your email address, subject and message to our mailbox, and we use them to reply to you (legitimate interests). The name you enter is not kept. A message that our spam checks reject is not sent; it stays in our logs instead (section 6).

Our mailing list

If you join the mailing list through its form, we hold your email address, your first name if you give it, the page you joined from and the date. We use them to send you news about our products and articles (consent). Creating an account does not add you to the list. To leave it, email us, or turn the emails off on your profile page if you have an account.

Paying for our products

We sell our products ourselves, and Stripe processes the payments for us. Stripe collects your card or other payment details, and we never see your full card number. Stripe holds, and we can see, your name, email address and billing address, the type, last four digits and expiry date of your card, and the history of your subscriptions, payments and invoices.

We use them to take payments, run subscriptions and send receipts and other billing emails (contract), to keep the records that tax law requires (legal obligation), and to prevent fraud (legitimate interests). Stripe sends billing emails for us, and their links open pages that Stripe hosts. Stripe also uses some of this data for its own purposes, such as preventing fraud, as described in Stripe's privacy policy.

4. Who processes your data for us

Hetzner Online GmbH (Germany) hosts the website, its database and our analytics.
Cloudflare, Inc. carries all traffic to the website and protects it.
Google hosts our mailbox and sends the website's emails, such as email verification, password reset and the contact form's messages to us.
Amazon Web Services stores files uploaded to the website, our database backups and our logs, in London.
Mapbox, Inc. provides the maps on the pages that show one.
Stripe takes payments, runs subscriptions and issues invoices.
Google and Microsoft confirm who you are if you choose to sign in with them.

We may also disclose data when the law requires it, for example in response to a valid court order.

5. Transfers outside the UK

Cloudflare, Google, Microsoft, Mapbox and Stripe are based in the United States or process data there. When personal data goes outside the UK, it is protected by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, or by the International Data Transfer Agreement or Addendum that the law provides for.

6. How long we keep it

Server logs: 30 days. Errors and warnings are also kept in the website's database for 14 days.
Our page-view records: your full IP address for 14 days. After that we keep the record with a shortened address.
Umami analytics: 90 days.
Your account: until you ask us to delete it (section 7). The record of each sign-in session, with its IP address, stays until then.
The mailing list: until you leave it.
Messages you send us: as long as we need them to deal with your message.
Billing records: 6 years after the end of the tax year they relate to, as UK tax law requires.
Backups: deleted data remains in our database backups until they expire, at most 90 days later.

7. Your rights

Under UK data protection law you have the right to:

get a copy of the personal data we hold about you;
have inaccurate data corrected;
have your data deleted;
restrict or object to how we use it, including where we rely on legitimate interests;
receive the data you gave us in a portable form;
withdraw your consent at any time, where we rely on it.

To use any of these rights, email mail@appsoftware.com. We reply within one month. The website has no delete button for accounts, so to delete yours, email us and we will delete it within 30 days, keeping only the billing records the law requires.

8. Complaints

If you are unhappy with how we handle your data, contact us first. You can also complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

9. Children

The website is not meant for children under 16, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy when our products, the website or the law change. The date at the top shows when it last changed.