Privacy Policy.

This Privacy Policy explains how personal data is processed on the King of Apps website at https://www.best-apps-for.me (the "Website"), in line with Regulation (EU) 2016/679 (the "GDPR").

The controller of your personal data is Jędrzej Meder (the "Operator"). You can contact the Operator about anything in this Privacy Policy by email at bestappsforme@proton.me.

Capitalised terms not defined here have the meaning given in the Terms of Service at https://www.best-apps-for.me/terms.

The Website has no user accounts, no sign-up and no newsletter.

The Website does not set cookies, does not use analytics, advertising or tracking tools, and does not build profiles of Visitors or Customers.

Fonts are served from the Website itself, not loaded from a third party.

When you open the Website, the hosting provider receives the technical data your browser sends with every request: IP address, date and time, requested address, browser and device type (user agent) and referring page. This data is used to deliver the Website, keep it secure and investigate errors and abuse. The legal basis is the Operator's legitimate interest in running a secure website (Article 6(1)(f) GDPR).

To show the icon of each listed app, your browser loads it directly from the app's own website or, if it has none, from Google's favicon service (www.google.com/s2/favicons). These hosts receive your IP address and user agent, but no referring page, as the Website asks your browser not to send it. The Operator does not control what those hosts do with this data.

When you click a Listing or a Sponsor Slot, the Website counts the click once per hour per Visitor. To do this, it computes a one-way hash of your IP address and user agent combined with a secret value, and stores only that hash, linked to the clicked domain, for 1 hour. The Website never stores your IP address for this purpose and cannot reverse the hash. The legal basis is the Operator's legitimate interest in click counts that cannot be inflated by repeated clicks (Article 6(1)(f) GDPR).

The Website also keeps a public list of recent clicks and bids showing the domain, icon and time. This list contains no data about the Visitor.

Payments are made on the hosted checkout page of Stripe Payments Europe, Ltd. ("Stripe"). Stripe collects your email address, your payment details and, depending on the payment method, your name and billing country. Card details are never sent to the Operator.

Stripe shares with the Operator your email address, name, billing country, the amount, the date, the payment status and the last digits and type of your card, together with the Domain, Listing Content and the version of the Terms you accepted.

The Operator uses this data to conclude and perform the Contract, send a confirmation, handle complaints, withdrawals and refunds (Article 6(1)(b) GDPR), to keep accounting and tax records (Article 6(1)(c) GDPR) and to establish, exercise or defend legal claims, including evidence that you accepted the Terms and waived your right of withdrawal (Article 6(1)(f) GDPR).

Stripe also processes payment data as an independent controller, for example to prevent fraud and meet its own legal obligations. This is described in Stripe's privacy policy at https://stripe.com/privacy.

A Listing shows the Domain, URL, title, description, icon and category, either entered by the Customer or fetched from the website at the Domain. The Board is public and its content is also published in machine-readable form for search engines and AI assistants. A Listing usually contains no personal data. If it does, for example a person's name in the title, the legal basis is the Contract (Article 6(1)(b) GDPR) and, for the data of other people, the Operator's legitimate interest in publishing the Board (Article 6(1)(f) GDPR).

If you email the Operator, including a complaint, a notice of illegal content under the DSA or an appeal, the Operator processes your email address, name and the content of your message to answer it and keep a record of it. The legal basis is the Contract where the message concerns one (Article 6(1)(b) GDPR), the Operator's obligations under the DSA and consumer law (Article 6(1)(c) GDPR) and otherwise the Operator's legitimate interest in answering messages (Article 6(1)(f) GDPR).

Browsing the Website does not require you to provide any data.

To pay, you have to provide the data the checkout page asks for. Without it, the Operator cannot conclude the Contract.

The Operator uses the following service providers, who process personal data on the Operator's behalf and under its instructions:

• 1)Vercel Inc. (USA) – hosting of the Website,
• 2)Upstash, Inc. (USA) – the database that stores the Board and the hashed click records,
• 3)Proton AG (Switzerland) – the Operator's email.

Stripe receives payment data as described in § 3(5)–(8).

Data may also be disclosed to public authorities, courts or professional advisers (such as an accountant or lawyer) where the law requires it or it is needed to establish, exercise or defend legal claims.

Vercel, Upstash and Stripe may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework, where the recipient is certified under it, or on the standard contractual clauses adopted by the European Commission.

Switzerland, where Proton AG is based, is covered by a European Commission adequacy decision.

You can ask the Operator for a copy of the safeguards that apply, at the email address in § 1(2).

Hashed click records: 1 hour.

Unfinished checkouts: the Website keeps no copy; Stripe keeps its record of the checkout under its own retention rules.

Payment and accounting records: 5 years from the end of the calendar year in which the tax obligation arose, as required by Polish tax law.

Evidence of a Contract, accepted Terms and consents: until claims under the Contract become time-barred.

Listings: for as long as the Listing is on the Board, and up to 12 months after it is removed in screenshots and posts promoting the Website.

Emails: for as long as needed to handle the matter, and then until related claims become time-barred.

Server request logs: for the short period set by the hosting provider.

You have the right to:

• 1)access your personal data and receive a copy of it,
• 2)have inaccurate data corrected,
• 3)have your data erased,
• 4)restrict processing,
• 5)receive the data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller, where processing is based on a contract and carried out by automated means,
• 6)object, on grounds relating to your particular situation, to processing based on the Operator's legitimate interest.

To exercise these rights, email the Operator at the address in § 1(2). The Operator answers within one month, which may be extended by two further months for complex requests. As the Website has no accounts, the Operator may ask for information that shows the data is yours, such as the email address used at checkout.

Some rights are limited by law. In particular, the Operator cannot erase payment records it must keep under tax law.

You have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl. You may also complain to the authority in the EU country where you live or work.

The Operator updates this Privacy Policy when the way it processes data changes. The current version is always published on the Website.

This version is in force from 2 November 2026.