Privacy policy

1. Who we are

Bzzly is run by Računalniško programiranje, Alexandre Georges Michel Pierre Grisey s.p., a sole proprietorship registered in Slovenia (VAT number SI92114466). We are the data controller for the personal data described on this page.

For any question about your data, write to pro@alexandre-grisey.fr.

2. When you browse the site

Visit counts for developers

When you open an app’s card in the hive, view an app page, follow a store or website link, or scan an app’s QR code, we add one to that app’s daily counters. For app page views we also record, for each visit:

• the time of the visit;
• the kind of source it came from (the hive, a search engine, an AI assistant, social media, another website, a campaign, or direct);
• the domain name of the referring website only, never the full address;
• a campaign label, if the link you followed had one (for example ?ref= or utm_source);
• your device type: iPhone or iPad, Android, or desktop.

We don’t store your IP address. We read your browser’s user agent only to filter out bots and to detect your device type, and we don’t keep it. Developers see these figures for their own apps, and hive-wide totals are shown on the home page.

Legal basis: our legitimate interest in running the service and showing developers how their listing performs (Article 6(1)(f) GDPR). Retention: individual visit records are deleted after 90 days. Daily counters are kept for as long as the app is listed.

Buzz votes

When you tap Buzz on an app, your browser creates a random identifier and keeps it on your device (see section 4). We store a one-way hash of that identifier and the app, with the date, so the same browser can’t buzz an app twice.

To prevent abuse, we also derive a keyed hash from your network address (your IPv4 address, or the first half of an IPv6 address) and the current week, and count votes against it. The raw IP address is never stored.

Legal basis: our legitimate interest in a fair leaderboard and in preventing abuse. Retention: network limits are deleted two weeks after the start of the week they belong to. Vote records hold only hashed values and are kept to prevent repeat votes.

Site analytics

To understand how the site is used and improve it, we use DataFast in its cookieless mode. It records the pages you view and actions such as opening an app, tapping Buzz, following a store link, sharing, signing in and, for developers, adding or changing an app or developer page. Each record includes the page address (with any campaign parameters in the link), the referring website, and your browser’s language, time zone and screen size. Records about apps name the app; they never include your name or email address.

DataFast receives your IP address and browser user agent with each request. In cookieless mode it tells visits apart with a one-way hash of these, the site’s domain and a key that changes about every 24 hours, so visits on different days can’t be linked to each other. It sets no cookies.

Legal basis: our legitimate interest in understanding and improving the service (Article 6(1)(f) GDPR). You can object at any time by emailing us, or block it with a content blocker.

Technical logs

Like any website, our web server and Google Cloud keep technical logs of requests (IP address, time, requested page, browser user agent) to keep the service secure and fix problems. Legal basis: legitimate interest in security. Retention: a limited period, by default 30 days in Google Cloud.

3. When you list an app

Your account

Developer accounts use Google sign-in through Firebase Authentication. Google shares your name, email address, profile photo and a unique account ID with us. They stay in Firebase Authentication: we show them to you in your dashboard and never publish them. You must be at least 16 years old to create an account.

What you publish

The details you submit about your app (name, description, links) and the details we fetch from the App Store and Google Play (icon, rating, screenshots, category and the developer name shown in the store) are published on Bzzly, and search engines and AI assistants may index them. The bundle ID or package name you enter is not shown publicly. If you create a developer page, its name, bio and website are public, and the name appears on your app pages.

Legal basis: providing the service you signed up for (Article 6(1)(b) GDPR). Retention: for as long as your account exists. Deleting an app removes it, its page and its statistics right away. To close your account and delete everything linked to it, email us and we’ll do it within 30 days.

4. What is stored on your device

We don’t use advertising or analytics cookies. The site only stores what the features you use and its cookieless analytics need:

• bzzly-voter (local storage): the random identifier for Buzz votes, created the first time you tap Buzz;
• bzzly-buzzed (local storage): the apps you have buzzed, so their buttons show it;
• hive-google-sign-in-destination (session storage): where to take you back to after signing in;
• Firebase Authentication data (IndexedDB), which keeps developers signed in;
• datafast_visitor_id, datafast_session_id and datafast_session_start (session storage): identify your current visit for site analytics, and are deleted when you close the tab;
• datafast_event_queue (local storage): analytics events waiting to be sent, usually for a few seconds.

You can clear these at any time from your browser settings.

5. Service providers and other sites

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions). Our database is stored in the European Union (Belgium and the Netherlands). Our server functions run in the United States (Iowa). Google LLC is certified under the EU–US Data Privacy Framework, and its data processing terms include the European Commission’s standard contractual clauses.
• Our hosting provider, whose server delivering the website is outside the European Union. Transfers rely on the safeguards the GDPR provides, such as an adequacy decision or standard contractual clauses.
• DataFast, our site analytics provider, which processes the data described under “Site analytics” on our behalf.
• Google Fonts. Pages load their fonts from Google’s servers, which receive your IP address and browser details.
• App store image servers. App icons and screenshots load directly from Apple’s and Google’s servers, which receive your IP address.
• Store and website links. When you follow a link to the App Store, Google Play or a developer’s website, that site’s own privacy policy applies. Our redirect doesn’t pass on the page you came from.
• Share buttons open X or LinkedIn only when you click them.

6. Your rights

Under the GDPR you can ask to access, correct or delete your personal data, to restrict its processing or receive it in a portable format, and you can object to processing based on our legitimate interest. Email pro@alexandre-grisey.fr. We answer within one month.

You can also complain to a data protection authority: in Slovenia, the Information Commissioner (Informacijski pooblaščenec), or the authority where you live.

7. Security

All traffic is encrypted with HTTPS. Account and statistics data can only be read by its owner, and all changes go through our server functions, which check who is asking.

8. Changes to this policy

When this policy changes, we update this page and the date at the top. If a change affects how we use developers’ data, we’ll tell them before it applies.