Privacy policy

1. Who we are

Bzzly is run by Računalniško programiranje, Alexandre Georges Michel Pierre Grisey s.p., a sole proprietorship registered in Slovenia (VAT number SI92114466). We are the data controller for the personal data described on this page.

For any question about your data, write to alexandre@pishko-tech.com.

2. When you browse the site

Visit counts for developers

When you open an app’s card in the hive, view an app page, follow a store or website link, or scan an app’s QR code, we add one to that app’s daily counters. When you open a card or view an app page, we also count, per day:

• your country, worked out from your device’s time zone setting (not from your IP address);
• your device’s language, such as French or English;
• your screen size, such as 390 × 844;
• your device type (phone, tablet or desktop), operating system and browser, or the app whose built-in browser opened the page;
• the hour of the day.

These are added to daily totals, not kept as a record of your visit. For app page views we also keep a record of each visit with:

• the time of the visit;
• the kind of source it came from (the hive, a search engine, an AI assistant, social media, another website, a campaign, or direct);
• the domain name of the referring website only, never the full address;
• a campaign label, if the link you followed had one (for example ?ref= or utm_source);
• your country, device type, operating system and browser, as above.

We don’t store your IP address, and nothing we record identifies you or links your visits together. We read your browser’s user agent to filter out bots and to tell your device type, operating system and browser, and we don’t keep it. Developers see these figures for their own apps, and hive-wide totals are shown on the home page.

Legal basis: our legitimate interest in running the service and showing developers how their listing performs (Article 6(1)(f) GDPR). Retention: individual visit records are deleted after 90 days. Daily counters are kept for as long as the app is listed.

Buzz votes

When you tap Buzz on an app, your browser creates a random identifier and keeps it on your device (see section 4). We store a one-way hash of that identifier and the app, with the date, so the same browser can’t buzz an app twice.

To prevent abuse, we also derive a keyed hash from your network address (your IPv4 address, or the first half of an IPv6 address) and the current week, and count votes against it. The raw IP address is never stored.

Legal basis: our legitimate interest in a fair leaderboard and in preventing abuse. Retention: network limits are deleted two weeks after the start of the week they belong to. Vote records hold only hashed values and are kept to prevent repeat votes.

Site analytics

To understand how the site is used and improve it, we use DataFast in its cookieless mode. It records the pages you view and actions such as opening an app, tapping Buzz, following a store link, sharing, opening or booking a sponsor spot, signing in and, for developers, adding or changing an app or developer page. Each record includes the page address (with any campaign parameters in the link), the referring website, and your browser’s language, time zone and screen size. Records about apps name the app; they never include your name or email address.

DataFast receives your IP address and browser user agent with each request. In cookieless mode it tells visits apart with a one-way hash of these, the site’s domain and a key that changes about every 24 hours, so visits on different days can’t be linked to each other. It sets no cookies.

Legal basis: our legitimate interest in understanding and improving the service (Article 6(1)(f) GDPR). You can object at any time by emailing us, or block it with a content blocker.

Live chat

The chat in the corner of each page is provided by Heyo. It loads from Heyo’s servers, which receive your IP address and browser details, and it gives your browser a random visitor ID so a conversation carries on across pages and visits (see section 4). To show us where a conversation started, Heyo also receives your browser’s language, the address of each page you view here and the website that referred you.

When you write to us, Heyo keeps your messages and our replies, including anything you choose to share in them, so we can answer. If you’re signed in as a developer, we also give Heyo your name, email address and account ID on each visit, whether or not you write to us, so we know which account we’re helping. When you sign out, the chat deletes its cookie, so the next person using your browser isn’t linked to your account.

Legal basis: our legitimate interest in answering questions and supporting developers (Article 6(1)(f) GDPR). Retention: we keep conversations while they help us support you, and delete them when you ask. The chat’s cookie expires after a year.

Technical logs

Like any website, our web server and Google Cloud keep technical logs of requests (IP address, time, requested page, browser user agent) to keep the service secure and fix problems. Legal basis: legitimate interest in security. Retention: a limited period, by default 30 days in Google Cloud.

To stop scripts from flooding the site or inflating its statistics, our server functions also count requests per network (your IPv4 address, or the first half of an IPv6 address) and per developer account. The counts are kept in memory only, under a salted hash rather than the address itself, are never written to storage, and are forgotten within an hour. Legal basis: legitimate interest in security and in keeping statistics fair.

3. When you list an app or sponsor a spot

Your account

Developer accounts use Firebase Authentication. If you sign in with Google, Google shares your name, email address, profile photo and a unique account ID with us. If you sign in with an email link, Firebase sends the link to the address you enter, and we only have that address and an account ID. They stay in Firebase Authentication, except that your name, email address and account ID also go to our live chat provider (see “Live chat”). We show them to you in your dashboard and never publish them. You must be at least 16 years old to create an account.

What you publish

The details you submit about your app (name, description, links) and the details we fetch from the App Store and Google Play (icon, rating, screenshots, category and the developer name shown in the store) are published on Bzzly, and search engines and AI assistants may index them. The bundle ID or package name you enter is not shown publicly. If you create a developer page, its name, bio and website are public, and the name appears on your app pages.

Legal basis: providing the service you signed up for (Article 6(1)(b) GDPR). Retention: for as long as your account exists. Deleting an app removes it, its page and its statistics right away. To close your account and delete everything linked to it, email us and we’ll do it within 30 days.

Sponsor spots

Sponsor spots are paid through Stripe, without a Bzzly account. Stripe collects your email address, payment details and billing address; we never see your card number. Stripe tells us the IDs of your Stripe customer and subscription, its status and its dates, and we keep them with your sponsorship. The name, logo, message and link you add to your spot are published in the hive. Your spot’s page is identified by the ID of your Stripe checkout, which is in its address: anyone with that address can manage the spot, so keep it private.

While a checkout is open, we keep a keyed hash of your network address (as for Buzz votes, never the address itself) so one network can hold only one spot at a time; it is deleted when the checkout ends. If DataFast identified your visit, its visitor and session IDs go with the payment so we can see which channel brought it (see “Site analytics”).

Legal basis: performing the contract (Article 6(1)(b) GDPR) and our legal obligation to keep accounting records (Article 6(1)(c)). Retention: your spot leaves the hive when the subscription ends; payment and invoice records are kept for as long as accounting law requires.

4. What is stored on your device

We don’t use advertising or analytics cookies. The site only stores what the features you use, its live chat and its cookieless analytics need:

• bzzly-voter (local storage): the random identifier for Buzz votes, created the first time you tap Buzz;
• bzzly-buzzed (local storage): the apps you have buzzed, so their buttons show it;
• bzzly-sign-in-email (local storage): the address you asked us to email a sign-in link to, so opening the link in the same browser signs you in without typing it again. It is deleted once you sign in or sign out;
• Firebase Authentication data (IndexedDB), which keeps developers signed in;
• _heyo_vid_… (cookie, expires after a year): the live chat’s random visitor ID and your current conversation, so the chat can pick up where you left off. Signing out of a developer account deletes it;
• datafast_visitor_id, datafast_session_id and datafast_session_start (session storage): identify your current visit for site analytics, and are deleted when you close the tab;
• datafast_event_queue (local storage): analytics events waiting to be sent, usually for a few seconds.

You can clear these at any time from your browser settings.

5. Service providers and other sites

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions). Our database is stored in the European Union (Belgium and the Netherlands). Our server functions run in the United States (Iowa). Google LLC is certified under the EU–US Data Privacy Framework, and its data processing terms include the European Commission’s standard contractual clauses.
• Our hosting provider, whose server delivering the website is outside the European Union. Transfers rely on the safeguards the GDPR provides, such as an adequacy decision or standard contractual clauses.
• DataFast, our site analytics provider, which processes the data described under “Site analytics” on our behalf.
• Heyo, our live chat provider, based in Singapore, which processes the data described under “Live chat” on our behalf and stores it on servers in the European Union. Its data processing terms include the European Commission’s standard contractual clauses for any transfer outside the European Economic Area.
• Stripe, our payment provider for sponsor spots, which handles payments under its own privacy policy.
• Google Fonts. Pages load their fonts from Google’s servers, which receive your IP address and browser details.
• App store image servers. App icons and screenshots load directly from Apple’s and Google’s servers, which receive your IP address.
• Store and website links. When you follow a link to the App Store, Google Play or a developer’s website, that site’s own privacy policy applies. Our redirect tells it the visit came from Bzzly (our domain name, and UTM parameters on websites and Google Play), never the page you came from.
• Sponsors’ links. A sponsor’s link opens their website, whose own privacy policy applies. It usually carries UTM parameters that tell the sponsor the visit came from Bzzly.
• Share buttons open X or LinkedIn only when you click them.

6. Your rights

Under the GDPR you can ask to access, correct or delete your personal data, to restrict its processing or receive it in a portable format, and you can object to processing based on our legitimate interest. Email alexandre@pishko-tech.com. We answer within one month.

You can also complain to a data protection authority: in Slovenia, the Information Commissioner (Informacijski pooblaščenec), or the authority where you live.

7. Security

All traffic is encrypted with HTTPS. Account and statistics data can only be read by its owner, and all changes go through our server functions, which check who is asking.

8. Changes to this policy

When this policy changes, we update this page and the date at the top. If a change affects how we use developers’ data, we’ll tell them before it applies.