This policy describes how Rovelix handles information when you use our service at rovelix.app to build app websites and monitor app reviews, or visit a website hosted through Rovelix.

Information you provide

We store account details such as your name and email address, a password hash (for password sign-in), Google account identifiers when you connect Google, workspace membership, and the content and settings you add to app websites. We also store support messages you submit, your alert and email preferences, and billing references needed to manage subscriptions. Payment details are collected by our payment processor, Stripe; Rovelix does not store complete card numbers.

App information from Google Play

When you import an app, we retrieve its public store information through GPAPI. This can include descriptions, screenshots, ratings, release information, developer contact details and a sample of public user reviews (the number depends on your plan). Public website previews retrieve the public Google Play information for the developer or app you enter: the developer profile and up to 100 of its apps, and for each app that is opened, its listing and a sample of 20 public reviews. A preview shows this information as a Rovelix website would, without publishing it, and is kept out of search engines. We cache preview data and delete it 30 days after the preview was last viewed. Preview copy comes from the listing without AI; AI copy is available after import, and you can also write or edit the content yourself. You control whether an imported website is published and can edit or remove content through the portal.

Review monitoring

On plans with Review Intelligence, Rovelix keeps collecting the public Google Play reviews of the workspace’s online app websites and app pages, in the languages and countries the workspace chooses. A review can include the reviewer’s name as Google Play shows it, the rating, the review text, the app version and device, and the developer’s reply. We analyze reviews to sort them into topics and sentiment, detect incidents, rate releases and write short summaries of what changed. Reviews and these results are kept for the review history your plan includes, plus 30 days, and are deleted 30 days after an app stops being monitored because it went offline or its workspace’s plan no longer includes Review Intelligence.

Alerts, summaries and webhooks

Review alerts and summaries are emailed to workspace members according to their own preferences. Owners and admins receive instant alerts for high-severity incidents and a weekly summary unless they change this; other members choose to receive them. Every review email has a one-click unsubscribe link that works without signing in. On plans with review webhooks, owners and admins can send alerts to web addresses they add, such as a Slack incoming webhook. Each delivery contains the workspace and app names, the incident or release it concerns and its summary, signed with a secret, and the recipient’s provider handles it under its own terms. We keep records of sent alerts for 90 days and of webhook deliveries for 30 days.

AI processing

Rovelix can write website copy with artificial intelligence. When you or a workspace member starts a generation, we send the public listing information and the public reviews collected for that app to OpenAI, our AI provider, together with instructions that limit the output to facts found in that material. We do not send your account details, email address, payment information or private workspace data. Generated copy is stored with your app so you can edit, regenerate or restore it, and previous generations are kept as revisions. OpenAI processes this data under its API terms, which state that API data is not used to train its models. AI features may be unavailable on some plans or when the service administrator has not enabled them; websites then use your listing text.

For Review Intelligence, we send the text, rating, language and app version of each review, without the reviewer’s name, and the app’s public listing details to OpenAI to classify reviews and write summaries. When AI analysis is unavailable, reviews are classified by automated rules on our own servers instead.

Custom code on websites

Workspaces on plans with custom code can add their own header and footer code, such as analytics, ad pixels or a chat widget, to their live websites. That code runs in visitors’ browsers and may collect information for the website owner or the code’s provider, under their own policies; the website owner is responsible for it and for any notice or consent it requires. Rovelix doesn’t run custom code in previews.

How we use information

We use information to authenticate accounts, publish and synchronize websites, generate and check website copy, monitor and analyze app reviews, send alerts and summaries, deliver webhooks, process subscriptions, provide support, maintain the service, and prevent abuse. We use service providers for hosting, app-listing data, AI processing and payments. When enabled, Brevo delivers verification, account recovery and alert emails, and Google verifies Google sign-ins. Public app images may be copied to Cloudflare R2 and delivered through our CDN. We store expiring verification challenges and encrypted pending email jobs to provide these features securely.

Sessions, analytics, and logs

The portal uses a session cookie to keep you signed in. API credentials are stored as hashes. Hosted websites can record aggregate page visits and Google Play button clicks for the website owner’s analytics. Public previews are rate-limited per network address to prevent abuse; we keep the address hashes needed for those limits for a short period. We count how often each preview is viewed, without recording who viewed it. To keep free trials to one per owner, we keep keyed one-way hashes of the normalized email address and of the payment card fingerprint Stripe provides when a trial starts, and a hashed network address for trial checkout rate limits. These hashes cannot be turned back into your email address or card. Operational logs may contain request details needed for troubleshooting and security. We do not use these features to serve advertising.

Published content and support messages

Content on a published app website is publicly accessible, including review excerpts you choose to display as testimonials. Messages sent through an app website’s support form are available to its authorized workspace members. The app developer is responsible for the privacy practices of their Android app; consult the developer’s own policy for information about the app itself.

Account deletion requests

An app website can have a page where people ask the app’s developer to delete their account or some of their data. We email the address entered a link to confirm the request; requests that aren’t confirmed within 24 hours are deleted. A confirmed request, with the email address and any account name, details and note given, is shown to the workspace members who manage that website, and its owners and admins get an email about it. Emails about the request are sent in the app’s name, and replies go to the developer’s support address. When the request is completed, closed or canceled, we erase the email address and those details, and keep its reference, dates, outcome, the developer’s note, a partly hidden form of the address and a keyed one-way hash of it, so the developer can show the request was handled and repeated requests can be limited. Deleting the website deletes its requests. The developer, not Rovelix, deletes the data held in their app.

Retention and your choices

We retain information needed to provide the service, resolve disputes, meet applicable recordkeeping obligations, and protect the service. Cached preview data is deleted 30 days after the preview was last viewed. Review data is kept as described under review monitoring. Deleted information may remain in backups until those backups expire. You can edit app content, delete generations by deleting the app, change or turn off review alerts, and revoke API keys in the portal. Contact us to request access, correction, export, or deletion of account information, or to exercise rights available under the law that applies to you.

Security and transfers

We use access controls, encrypted web connections, hashed credentials, signed webhooks and database backups to protect the service. No system can guarantee absolute security. Providers and infrastructure, including our AI provider, may process information in countries different from your own.

Contact and changes

For privacy questions or requests, email support@rovelix.app. We may update this policy as the service changes and will update the date on this page.