Sign-in is a link sent to your email. No password, no profile, no phone number.
Your email, your answers, nothing else.
What we collect, why we have it, who touches it and how to make it go away. Short, because we collect very little.
Worksheets, ideas, scores and progress are stored against your account and shown only to you.
We never sell your data and never hand your worksheets to advertisers or tool partners.
Email legal@appshift.xyz and your account and every answer are erased. No retention games.
1. Who is responsible for your data
Appshift is operated by Aleksandr Borisov (CUIT 27-96484697-4, Monotributo — Régimen Simplificado para Pequeños Contribuyentes, Categoría A), Laprida 1283, Piso 2, Dpto C, C1425 Ciudad Autónoma de Buenos Aires, Argentina. For the purposes of Argentine Law 25.326 and, where it applies, the EU General Data Protection Regulation, that person is the data controller — the one who decides why and how your data is processed.
Questions, requests and complaints: legal@appshift.xyz. A human reads that inbox.
2. What we collect, and why
Only what the product needs to work. There is no tracking pixel, no advertising profile and no data broker in this list.
| Data | Why we have it | Legal basis (GDPR) |
|---|---|---|
| Email address | To send your sign-in link and to identify your account. Also to reply if you write to us. | Performance of a contract (Art. 6(1)(b)) |
| Worksheet answers, ideas, scores, completed steps | This is the product: your work, saved so you can come back to it on any device. | Performance of a contract (Art. 6(1)(b)) |
| Session cookie and authentication tokens | To keep you signed in between pages without asking for the link again. | Performance of a contract (Art. 6(1)(b)) |
| Server and security logs (IP address, request time, user agent), kept by our hosting and database providers | To keep the service up, to debug failures and to stop abuse of the sign-in form. | Legitimate interests (Art. 6(1)(f)) — running a secure service |
| Theme preference and, in local preview mode, your draft answers | Stored in your own browser so the site looks right and the preview works offline. Never sent to us. | Strictly necessary / appearance — no consent required |
We do not ask for your name, your address, your phone number or any payment details. The playbook is free and there is no checkout.
3. Your worksheets are yours
Everything you type into a worksheet — your audience notes, app ideas, pricing thoughts — is private to your account. Row-level security in the database means a query made with your session can only ever return your own rows.
- We do not read your worksheets to build features, and we do not use them to train any AI model.
- We do not publish, sell, rent or share them with tool partners.
- Support access to your data happens only if you ask us to look at something, and only for as long as that takes.
4. Who processes data on our behalf
We use a small number of service providers. They act on our instructions under a data processing agreement, and none of them may use your data for their own purposes.
| Provider | What it handles | Where |
|---|---|---|
| Supabase | Database, authentication and delivery of the sign-in email. | United States (project region), with EU Standard Contractual Clauses for transfers. |
| Vercel | Hosting and content delivery for the website. Sees request metadata, not your worksheet contents in any readable form beyond serving them to you. | Global edge network. |
If we add a provider — for example a product-analytics tool — this table is updated before it starts running, and this page is dated at the top so you can see when.
5. Analytics
No analytics or advertising service runs on this site today. When we add one, it will be configured so that it measures pages and steps in aggregate, not people: no advertising cookies, no cross-site tracking, no selling of behavioural data.
If a future analytics setup ever needs a cookie that is not strictly necessary, you will be asked for consent first, and you will be able to refuse it and keep using the playbook exactly as before.
6. Links to tools, and affiliate links
The playbook recommends third-party tools. Some of those links are affiliate links: if you buy after following one, we may earn a commission at no extra cost to you. Recommendations are not sold — a tool is in the playbook because it fits the step, and affiliate links are disclosed wherever they appear.
When you follow a link you leave this site. What the destination collects is covered by its own privacy policy, not this one. We do not pass your email or your worksheet contents to any of them.
7. How long we keep things
- Account and worksheet data: for as long as your account exists. Delete the account and it goes with it.
- Sign-in links: they expire shortly after being sent and cannot be reused.
- Security and server logs: kept for a short period by our providers for debugging and abuse prevention, then rotated out.
- Data in your own browser (theme, local preview): until you clear your browser storage. We cannot reach it and cannot delete it for you.
8. Your rights
Write to legal@appshift.xyz from the address on your account and we will act on any of the following.
- Access — a copy of everything stored about you.
- Rectification — correct anything wrong. Most of it you can edit yourself inside the playbook.
- Erasure — delete your account and all your answers.
- Portability — your worksheet data in a machine-readable file.
- Objection and restriction — tell us to stop or limit a particular use.
- Withdraw consent — where we ever rely on consent, withdrawing it is as easy as giving it.
Under Argentine Law 25.326 we answer an access request within 10 calendar days, and a rectification or deletion request within 5 business days. Under the GDPR we answer within one month. We apply whichever deadline is shorter for you. Access requests are free.
If you think we have handled your data badly, you can complain to the Agencia de Acceso a la Información Pública in Argentina, or — if you are in the EU, the EEA or the UK — to your local data protection authority.
9. Security
- All traffic is served over HTTPS.
- Authentication is passwordless: there is no password for us to lose or for you to reuse.
- Row-level security is enforced in the database itself, not only in application code.
- Session tokens are held in cookies and are refreshed and revoked by the authentication service.
No system is perfect. If a breach ever affects your data, we will tell you and the relevant authority as the law requires, without hiding behind vague language.
10. Age
The playbook is meant for adults building a business. You must be at least 16 to create an account, or older where your country requires it. We do not knowingly collect data from children; if you believe a child has an account, write to us and we will remove it.
11. Changes to this policy
If this policy changes in a way that affects you — a new processor, a new purpose, analytics going live — we update the date at the top and, for material changes, email the address on your account before the change takes effect.
Contact
Aleksandr Borisov · CUIT 27-96484697-4
Laprida 1283, Piso 2, Dpto C, C1425 Ciudad Autónoma de Buenos Aires, Argentina
legal@appshift.xyz