Privacy

Updated November 1, 2026. This notice describes how PWA App handles information. For privacy questions or requests, email support@pwaportal.cloud.

Browsing and your library

You can browse without an account. Saved apps, blocked publishers, hidden listings and launch history are kept in your browser on this device. Clear history or restore hidden listings from Library; clearing this site’s browser data removes your entire local library. The iPhone client stores this library locally too.

Publisher information

Publisher account identifiers, profile details, app descriptions, URLs and uploaded images are stored to provide listing management. Approved published listing information and images are public. Drafts and account management require authentication. Email/password accounts store your sign-in email, a salted password hash, and a hashed recovery key. Passwords are never stored in plaintext. Verification emails confirm ownership of your address. Verified addresses can request one-use emailed password-reset links. Password resets revoke previous sessions. Hashed network and email fingerprints limit repeated sign-in attempts; old attempt records are removed during authentication requests.

Account security and recovery copies

Administrator authenticator secrets are encrypted; one-use MFA recovery codes and email-link tokens are stored as hashes. Password recovery does not disable an existing authenticator. Email links expire and are invalidated after use. Resend delivers verification and password-recovery emails and processes the recipient address and transactional message, including its one-use account link. Cloudflare hosts the application that creates and validates these links. Private automated recovery snapshots contain the database and app images, are restricted to the operator, and expire after 30 days. Deleting live data does not immediately remove it from an existing recovery snapshot.

Activity counts

The website sends listing-view and launch-click events to provide publisher analytics. A randomly generated browser identifier in the pwa_visitor cookie prevents repeat counting within 30 minutes; this cookie expires after 30 days. These events measure clicks, not confirmed app installations. The native iPhone client does not send these analytics events. Publisher analytics show the last 30 days. Older event records are removed during analytics requests; without new requests, cleanup waits until the next request.

Reports and support

We store the message you submit and your email if you provide one, so the operator can review reports and reply. A daily hash derived from your network address limits spam; raw addresses are not saved in the reports table. Reports remain until the operator removes them or a related listing is deleted. Hosting providers may process network addresses and operational logs to serve and protect the site.

Payments and providers

Cloudflare provides website hosting and the database. New publisher images are stored in a private Cloudflare R2 bucket. Stripe processes publisher subscriptions and payment details. Our database stores subscription/customer identifiers and payment status; it does not store card numbers. Linked PWAs have their own operators, privacy policies and data practices.

Your controls

Publisher accounts can export profile, listing and subscription information and delete their profile, listings, stored photos and associated analytics from the portal. Deletion cancels any connected subscription first. Stripe may retain records under its own policies and legal obligations. Moderation suspension records can remain after profile deletion to prevent repeated abuse. Deleting your publisher account also removes its email/password credentials and invalidates its sessions. Use Support for questions or requests.