Privacy policy
This is a courtesy translation. Only the German version is legally binding.
This policy applies to the website twinstats.com and the application app.twinstats.com. Both are deliberately lean: no advertising cookies, no ad networks, no tracking across websites. We measure reach anonymously with a self-hosted Umami instance (section 4).
1. Controller
Gerhard Kanzler, RZ-Solutions, c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany
Email: kontakt@rz-solutions.dev
2. Hosting and server log files
The website and application run on our own server at Hetzner Online GmbH in Germany. When you visit, the upstream web server (reverse proxy) processes technically necessary data that your browser transmits automatically: IP address, date and time, requested page, status code, amount of data transferred, referrer URL and browser identification (user agent). These access logs are used solely for delivery, troubleshooting and defending against attacks.
The logs are not analysed, not combined with other data and are deleted automatically after 14 days at the latest. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation).
3. Cookies and fonts
The website twinstats.com does not set any cookies. Fonts are loaded from our own server; there is no connection to Google Fonts or other third parties. The only other connection is to our own Umami instance (section 4). The language of the website is determined solely by the address (/en for English). If you close the hint about the English version, your browser remembers this until you close the tab (sessionStorage); nothing is transmitted to us.
4. Reach measurement with Umami
To understand which pages are used, we use Umami, an open-source analytics software that we operate ourselves on our own server at Hetzner Online GmbH in Germany (umami.now-altimeter.com). No data is transmitted to third parties.
Umami sets no cookies and stores nothing on your device. It records the page visited, referrer, browser, operating system, device type, screen size and the country derived from the IP address. The IP address itself is not stored; to count unique visits, Umami creates an anonymous value from the IP address and browser identification that changes daily. This makes it impossible to identify a person, and no profiles across several days or websites are created.
In the application app.twinstats.com we count page views without query parameters (so that, for example, invitation codes are not recorded). For some sessions in the signed-in area we also create heatmaps: Umami records click positions, scroll depth and page layout for this. All texts – i.e. numbers, app names and email addresses – as well as all input fields are masked in the browser before anything is transmitted. Session recordings for playback are disabled.
The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in improving the website and application). You can object to the measurement at any time by emailing kontakt@rz-solutions.dev or prevent it with a content blocker; the pages keep working.
5. Waitlist
When you join the waitlist, we store your email address, your voluntary details (number of apps, stores, interest in the ASO module), the language of the page, the time and version of your consent and a shortened hash of your IP address to prevent abuse.
So that nobody can sign up with someone else's address, we send you an email with a confirmation link after you sign up (double opt-in). You are on the waitlist only after clicking it. If you do not confirm within 7 days, the entry is deleted automatically. We store the time of confirmation as proof.
To send this email and the later invitation we use the service Resend (Resend, Inc., USA). Your email address and the content of the email are transmitted to Resend. We have a data processing agreement with Resend; the transfer to the USA is based on the EU Commission's standard contractual clauses and the EU-US Data Privacy Framework.
We use this data solely to invite you to the Twinstats beta and to order the invitations sensibly. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time by emailing kontakt@rz-solutions.dev; your entry will then be deleted. No later than six months after the launch of the public version we delete all entries that have not turned into an account.
6. The application app.twinstats.com
Account
For an account we store your name, email address, your password as a bcrypt hash (never in plain text) and – if you use passkeys – their public keys. We also store your chosen language and your email settings. The legal basis is Art. 6 (1) (b) GDPR (provision of the service). We send account emails (invitation, activation, notice of failed store fetches and – which you can unsubscribe from under Settings → Profile – weekly report and ASO events) via Resend (see section 5).
Session cookies
The application sets two technically necessary cookies to keep you signed in: a short-lived access token (15 minutes) and a refresh token (up to 30 days). Both are httpOnly, are only transmitted over HTTPS and serve no other purpose (§ 25 (2) no. 2 TDDDG). For each session we store the browser identification and a shortened hash of the IP address so that you can recognise and end your active sessions. If you choose a language, we also store it in the cookie ts_lang (one year) so that pages load in that language right away; it contains only the language code.
Web app and offline cache
The application can be installed as a web app on phone or desktop. For this, a service worker stores program files, fonts and icons in your browser's storage so that they load faster and during connection problems. Statistics, reviews and other content of your account are not cached. The legal basis is § 25 (2) no. 2 TDDDG; you can clear this storage in your browser at any time.
Teams
If you invite others to your workspace, they see the same apps, statistics and reviews as well as changes to the workspace (e.g. connected stores, exports, team changes) with the name of the person acting. Your sign-ins and account settings stay private. For the invitation we store the email address of the invited person until they accept it or it expires after 7 days.
Activity log
To protect your account we log security-relevant events: sign-ins and failed sign-in attempts, changes to password, passkeys and store connections, and exports. We store the time, type of event, the browser identification and a shortened hash of the IP address. You can see your log under Settings → Activity. Entries are deleted automatically after 12 months, immediately when the account is deleted. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the security of the service).
Store connections and statistics
When you connect App Store Connect or Google Play, we store your API keys encrypted with AES-256-GCM only. With them, our server retrieves the statistics, revenue, payouts, ratings and reviews of your apps via the official Apple and Google APIs and stores them in your workspace. Only your workspace sees this data; it is not shared and not used for other purposes. For the conversion to euros we load the public reference rates of the European Central Bank without transmitting any personal data.
Apple Ads (optional)
If you also connect an Apple Ads account, Twinstats creates its own key pair for it and stores the private key encrypted only; you add the public key at Apple yourself. Through it we query Apple – read-only – for the search popularity of the search terms you track in the ASO area, as well as keyword suggestions for your apps. Only these search terms, countries and the IDs of your apps are sent to Apple, no personal data. Twinstats does not change campaigns, bids or budgets. Only your workspace sees the values; when you disconnect, we delete the key and the values.
AI insights (optional)
Owners and admins of a workspace can turn on AI insights. The language model Claude by Anthropic, PBC (USA) then classifies reviews (sentiment, topic, urgency, translation), suggests replies on click, answers questions about the workspace's numbers and writes a weekly report from the key figures calculated by Twinstats. For this we transmit to Anthropic the texts, stars, countries and app versions of the reviews – without the authors' names – as well as aggregated key figures and app names of the workspace. In the ASO area, on your click, the store texts of your app, tracked search terms, public data and reviews (without author names) of competitors, and the public icons and screenshots from the stores are also sent to Anthropic. Store keys, email addresses and account data are never transmitted.
Anthropic processes the data as a processor on the basis of a data processing agreement and does not use it to train its models; the transfer to the USA is based on the EU Commission's standard contractual clauses and the EU-US Data Privacy Framework. The legal basis is Art. 6 (1) (b) GDPR (function chosen by the workspace) and, for the review texts, Art. 6 (1) (f) GDPR. We store the results in the workspace; they are deleted when AI insights are turned off. Anyone can unsubscribe from the weekly report email under Settings → Profile. Replies to reviews are only published via the Apple or Google APIs after explicit confirmation.
App icons
In the application, the icons of your apps are loaded directly from the servers of Apple (mzstatic.com) and Google (googleusercontent.com). For technical reasons the respective provider receives your IP address. The legal basis is Art. 6 (1) (b) GDPR; the website twinstats.com does not load such content.
Retention
We store account and statistics data as long as your account exists. If you remove a store connection, we delete the key and the related statistics. You can delete your account including all data yourself at any time (Settings → Profile → Delete account) or request deletion by email.
7. Recipients
We do not sell data and do not share it for advertising purposes. Technical service providers are the hosting provider Hetzner Online GmbH (data centres in Germany), Resend, Inc. for sending emails (see section 5) and – only when AI insights are turned on – Anthropic, PBC (see section 6).
8. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future. You can also lodge a complaint with a data protection supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA).
Last updated: October 2026