Privacy Policy

RevyLens (“we”, “us”) is a review-analysis service for mobile app teams, available at revylens.com. It is currently in public beta and is run by its founder as an individual operator; no separate company has been formed yet. We decide why and how your account data is processed, which makes us the controller of that data for data-protection purposes.

When a workspace owner connects an app and imports its reviews, we process those reviews on the workspace’s behalf to provide the service. The workspace owner decides which apps are connected and who can see the results.

Contact for anything privacy-related: s.mohsunlu.dev@gmail.com.

We do not collect payment card details: paid billing is not active during the beta. We do not use advertising trackers or third-party analytics.

We do not sell personal data, and we do not share it for advertising.

RevyLens uses AI models, reached through OpenRouter, to read, translate, cluster and search reviews, to name and check issue and request clusters, to explain releases, and to answer Ask RevyLens questions. What we send depends on the feature:

• Review analysis: the review title and text, star rating, app version, platform, review date and detected language. Reviewer display names are not included in these requests.
• Translation and search embeddings: the review text and title. Embeddings are numeric representations stored in our database.
• Ask RevyLens: your question and a size-limited set of review excerpts and statistics relevant to it.
• Cluster naming, validation and release explanations: short excerpts and counts drawn from your reviews.

Every one of these requests goes through OpenRouter (OpenRouter, Inc., United States), an API gateway that forwards the request to the company that runs the model, currently OpenAI. OpenRouter and that model provider therefore both receive the data listed above. We set OpenAI’s store option to off on each request. OpenRouter states in its privacy policy that it does not use inputs or outputs for model training; how long OpenRouter and the model provider keep request data, and whether the provider trains on it, is governed by their own policies, which can change. Where OpenAI serves a request, its published data-controls documentation says data sent to its API is not used for training unless an organization opts in, and that it keeps API abuse-monitoring logs for up to 30 days unless the law requires longer. See OpenRouter’s privacy policy and OpenAI’s privacy policy.

AI output can be wrong. Nothing in RevyLens makes a decision about you that has legal or similarly significant effects; the results describe reviews, not people.

These service providers process data for us, only as needed to run RevyLens:

Stripe is built into the product for future paid plans but is not active, so no data is sent to it today. If that changes we will update this policy first. Within a workspace, other members can see the workspace’s reviews, notes and shared items according to their role. Shared links you create can be opened by anyone with the link until they expire or you revoke them.

We may disclose data if the law or a valid legal process requires it, or to protect the service and its users from harm.

Our servers are in Germany. Some providers, notably OpenRouter and OpenAI, may process data outside the European Economic Area, including in the United States. Where personal data from the EEA or UK is transferred, the transfer relies on the mechanisms our providers make available for it, such as standard contractual clauses. You can ask us for details at s.mohsunlu.dev@gmail.com.

Delete your account. Open Settings in the workspace and use the account deletion control. Your account is disabled and you are signed out immediately. After a 7-day grace period, during which you can cancel it by emailing s.mohsunlu.dev@gmail.com from the account's address (we then restore the account exactly as it was), a background job removes your sign-in methods, replaces your name and email address with placeholders, and deletes any workspace you solely own together with everything in it. If you own a workspace that has other members, you must first transfer ownership; the workspace then stays in place and you are removed as a member. Notes or other items you added to a shared workspace may remain there without your name.

Delete an app or a workspace. The product currently offers account deletion in Settings. To have a connected app or a whole workspace deleted, a workspace owner can email us and we will submit the deletion request, which follows the same 7-day grace period.

Backups. Deleted data is not removed from existing backups immediately. It disappears as those backups expire (section 7), and we do not restore deleted accounts from backup except to recover from a failure.

Your rights. Depending on where you live, including under the GDPR, the UK GDPR and the California Consumer Privacy Act, you may have the right to access your data, correct it, delete it, receive a portable copy, restrict or object to some processing, and withdraw consent where we rely on it. You can export workspace data as CSV from the product. For anything else, or to use a right we cannot offer in the product, email s.mohsunlu.dev@gmail.com. We reply within one month and may need to confirm your identity first. We do not discriminate against anyone for using these rights. You can also complain to your local data-protection authority.

Traffic to revylens.com uses HTTPS. Passwords are stored only as salted hashes. Store and integration credentials are encrypted with AES-256-GCM using versioned keys held outside the database, and are never kept in your browser. Access to a workspace is limited by role, and each workspace’s data is isolated from every other workspace’s. Sign-in and other sensitive endpoints are rate limited, and we set strict browser security headers.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

We use only the cookies and browser storage the service needs to work. We use no advertising or analytics cookies, and our security policy blocks third-party scripts, so no outside tracker can run on our pages.

Because these are essential, we do not show a cookie banner.

RevyLens is built for professionals and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

We will update this policy as the product changes, for example before we enable paid billing or add a provider. The effective date at the top shows the current version. For significant changes we will notify account holders by email or in the product.

Questions, requests or complaints about privacy: s.mohsunlu.dev@gmail.com.