Privacy policy

1.Accounts and sign-in#

OpenApps is operated by The Open Apps, Inc. You can browse the public catalog without an account. When you create an account, we store your name, email address, verification status and account identifier to provide sign-in and manage access to developer keys and connected apps.

Password accounts store a password hash. We send verification and password-reset emails through Cloudflare. Browser sessions use an authentication cookie; session records can include your IP address and browser information for security. To limit abuse, we count sign-in and account requests per IP address; each counter holds the address, the request path, a count and the time of the last request. Checking whether you are signed in does not write these counters.

When Google sign-in is available and you choose it, Google supplies your account identifier, name, email address, verification status and profile image. We store the linked identity and authentication credentials needed for sign-in. We request basic identity permissions, rather than access to Gmail, Drive or Calendar. Google's own privacy policy applies to its services.

2.Developer keys and connected apps#

We store developer-key names, prefixes, hashes and expiration information. The complete key is shown only when it is created. OAuth connections record the client, permissions and authorization information needed to issue and revoke access. You can revoke keys and connected apps from your account page. A completed password reset revokes them and signs out every browser session.

API and MCP usage produces diagnostic and usage records, such as tool names, request outcomes, durations and error details. Authenticated activity can be associated with your OpenApps account identifier. Connected clients are responsible for their own handling of data you share with them.

3.Payments#

Pro is sold through Link, Stripe's checkout service. Link (Stripe's affiliate Sold Through Link, LLC) is the reseller and merchant of record and handles the payment, sales tax or VAT, receipts and payment support; Link's privacy policy applies to the purchase. When you start checkout, we send Stripe your name, email address and OpenApps account identifier. You enter your billing details and payment method on Stripe's checkout page; we never receive your full card number and do not store payment details in our database.

Our database stores your Stripe customer identifier and, for each subscription, its Stripe identifier, plan, status, billing interval, current period dates and whether it is set to cancel. Stripe shares order details with us, such as billing address and tax information, which we can view in Stripe. Stripe uses this information to process payments, calculate and remit tax, prevent fraud and provide payment support, under its own privacy policy.

4.Analytics and error tracking#

We use PostHog's US-hosted service for web and product analytics, performance measurements, error tracking and Cloudflare Worker logs. Events include page paths, selected catalog filters, navigation, account actions, device and browser information, and diagnostic details. Signed-in activity is associated with an opaque OpenApps account identifier; we do not add your account name or email to the analytics profile.

Your browser sends analytics to PostHog through our own domain. We forward the event data and your browser's user agent, but not your IP address, cookies or the page you came from. We turn off PostHog's IP-based location lookup (GeoIP) on every browser, MCP and server event, so our analytics hold no location derived from your IP address. MCP and API usage events record the operation called, the client, and the country and network that Cloudflare reports for the connection; API events never record the query. Anonymous MCP and API callers are counted with a salted hash of their IP address that changes daily, never the address itself.

The browser stores an analytics identifier in local storage. Our browser analytics respects the browser's Do Not Track setting. Session replay and copied-text capture are disabled. Autocapture is limited to navigation links and masks element text and attributes.

We apply redaction to telemetry for passwords, API keys, authorization tokens, cookies, email addresses and other sensitive fields. URL queries and fragments are removed from captured URLs; search events record query length rather than the search text. Security processing and server diagnostics continue independently of browser analytics settings.

5.Service providers and processing#

Cloudflare hosts the website, database, media, authentication email and OAuth infrastructure. PostHog processes analytics and diagnostic data. Google processes Google sign-in when you use that option. Stripe and its affiliates process Pro payments, tax and payment support. When you contact our team, we use your message to respond to your request. These providers may process data outside your country.

We use this information to operate the service, authenticate users, manage authorized access, prevent abuse, diagnose failures and understand how the product is used.

6.Your choices and data requests#

You can browse without signing in, sign out of browser sessions, revoke developer keys and OAuth connections, and enable Do Not Track to prevent our browser analytics from capturing activity. Clearing this site's local storage removes its stored analytics identifier; later visits may create a new identifier if analytics is enabled.

Account information is retained while needed to operate your account. Authentication records have expiration times; telemetry retention is managed in our service providers' settings. Revoking access stops use of the credential but does not erase historical diagnostic records.

Contact us to request access, correction or deletion of your account information. We may need to verify account ownership before processing a request. Please do not send passwords, developer keys or reset links in email.

7.Changes to this policy#

We update this page when our handling of account or usage information changes. The date above identifies the latest version.

8.Contact us#

For account help, email support@theopenapps.com. For privacy and data requests, email privacy@theopenapps.com.

Support and privacy mailboxes are being configured. Email delivery has not yet been verified.

Service-provider privacy policies: Cloudflare, PostHog, Google and Stripe, including Link.