Privacy Policy

Effective date: 29 Sep 2026

Your privacy matters to us. This policy explains what personal information Paywalls collects when you use paywalls.app, why we collect it, who we share it with, and the choices and rights you have. We handle personal information in line with the laws that apply to us, including the GDPR in the European Union and the KVKK in Türkiye.

Personal information is any information that can identify you, on its own or combined with other information. That includes obvious details such as your email address, and less obvious ones such as your IP address or the way you use a website.

This policy covers paywalls.app only. The library shows screens from other companies' apps and links to other websites. Those companies and websites have their own privacy policies, and this one stops applying once you leave our site.

1.Information We Collect

The information we collect falls into two groups.

Information you give us: Your email address when you sign in or join the waitlist, and anything you write to us.

Information from AI agents you connect: If you connect an AI agent to Paywalls through the MCP, a record of each request it makes that uses a credit, described under AI Agents and the MCP below.

Information collected automatically: Technical details your browser sends when you visit the site, described under Log Data and Device Data below.

2.Log Data

When you visit the site, the servers of our hosting provider record standard request information: your IP address, your browser type and version, the page you requested, and the date and time. Our sign-in provider keeps a similar record of sign-in requests. These logs are kept for short periods under the providers' own retention settings and are used only to run and secure the site.

When you ask for a sign-in code, use one, or join the waitlist, we record your IP address for 24 hours, so that no one can use the site to send large numbers of emails to other people.

If something fails on our servers while handling your request, an error report is sent to our error monitoring provider. It contains technical details of the error and the address of the page without its query string. It does not include your IP address, your cookies, or anything else that identifies you.

3.Device Data

To understand how the site is used, we count page views. For each view we record the page, the type of device, the operating system, the browser, and the country the visit came from, which is worked out from the IP address without keeping it.

This counting uses no cookies and no device identifiers. Each visitor is represented by a code that changes every 24 hours, so visits cannot be linked from one day to the next. We do not collect precise location.

4.Personal Information

The personal information we hold about an account is limited to:

Your email address, which is how you sign in and how we reach you.
Your name and Google account identifier, if you choose to sign in with Google.
Your plan and billing cycle.
A record of the requests made by AI agents you connect through the MCP, and which agents you have connected.
What you write to us when you contact us by email.

We do not ask for or store passwords, and we do not hold card details.

5.User-Generated Content

Your collections, the names you give them, your saved items and the apps you follow are stored in your account. They are private. We do not publish them, show them to other users, or use them for anything other than showing them back to you.

6.AI Agents and the MCP

On Pro you can connect an AI agent, such as Claude, Cursor, Codex or ChatGPT, to Paywalls through the MCP. You approve each one on our site, signed in to your account, and it then reads the library on your behalf.

For each request an agent makes that uses a credit, we record against your account: which tool it used, what it searched for and the filters it applied, where it said the results were going (for example code, a design tool or a document) and the product it named, a short description of the task written by the agent, the name of the agent's app, how many results came back, and the time. The agent is asked to describe the task without quoting you and without personal information, so treat what you ask it to look up the way you would treat a search on the site.

We use these records to count your monthly credits, to limit how quickly one account can make requests, and to understand how the library is used so that we can improve it. We do not use them for advertising and we do not sell them.

Your account page shows how many credits you have used and every agent you have connected, and lets you disconnect any of them. The records are included when you download your data, and they are deleted with your account.

7.Legitimate Reasons for Processing Your Personal Information

We only collect and use personal information when we have a lawful reason to, and only as much as we need to provide and improve the site. The legal bases we rely on are set out in the KVKK and GDPR sections below.

8.Collection and Use of Information

We may collect personal information when you:

Create an account or sign in.
Join the waitlist.
Browse the site.
Connect an AI agent through the MCP.
Contact us by email.

We use it for the following purposes, and not in ways that are incompatible with them:

To provide the site and your account, including sign-in and the collections and saved items you create.
To provide the MCP to the agents you connect, including counting your credits.
To send you emails about your account, such as sign-in codes.
To send one email when the library opens, if you joined the waitlist.
To keep the site secure and prevent abuse.
To find and fix errors.
To understand which pages are used, so we can improve the site.
To comply with our legal obligations and resolve disputes.

We do not use your personal information for advertising, we do not send marketing email, and we do not use it to train machine learning models.

9.Security of Your Personal Information

We protect personal information with measures appropriate to what we hold. Data is encrypted in transit, the database only lets each account read its own data, and administrative access is restricted.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will tell you, and the relevant authorities where the law requires it.

Because you sign in with a code sent to your email rather than a password, the security of your account depends on the security of your email account. Please keep it protected.

10.How Long We Keep Your Personal Information

We keep personal information only for as long as we need it:

Your account and everything in it, until you delete your account. Deletion is immediate.
Database backups, which can contain deleted data, for up to 90 days, after which they expire automatically.
IP addresses recorded to prevent abuse, for 24 hours.
Records of requests made through the MCP, for 13 months, or until you delete your account if that is sooner.
Server logs and error reports, for the short periods set by our hosting, sign-in and error monitoring providers.
Your waitlist email address, until we have sent the launch email or you ask us to remove it.

We may keep information for longer where the law requires it.

11.Children's Privacy

The site is not directed at children. Accounts are for people aged 16 and over, and we do not knowingly collect personal information from anyone younger. If we learn that we have, we delete it.

12.Disclosure of Personal Information to Third Parties

We do not sell your personal information. We may disclose it only to:

Service providers who host the site, store data, send email, handle sign-in, monitor errors, count page views and keep backups, only so that they can provide those services to us.
A payment processor, once paid plans are available, to take payments.
Professional advisers, such as lawyers and accountants, where needed.
Courts, regulators and law enforcement, where the law requires it or to establish, exercise or defend our legal rights.
A buyer or successor, if the business is sold or transferred, as described under Business Transfers.

13.Third Parties We Currently Use

These are the service providers that process personal information for us today:

Supabase, for the database and sign-in.
Resend, for email delivery and the waitlist.
Vercel, for hosting and page view counts.
Sentry, for error reports.
Google, for sign-in, only if you choose to sign in with Google.
GitHub, for storing the nightly database backup.

We will update this list when it changes.

14.International Transfers of Personal Information

Our service providers store and process personal information mainly in the United States and the European Union, which may be outside the country where you live and where data protection laws may differ.

When we transfer personal information, we rely on the safeguards our providers offer, such as the European Commission's standard contractual clauses, and we protect it as this policy describes.

15.Your Rights and Controlling Your Personal Information

Your choice: You do not have to give us personal information, but you need an email address to have an account.

Access and portability: Download your data, on the account page, gives you a copy of everything we hold about your account in a machine-readable file.

Correction: If something we hold about you is wrong, write to us and we will correct it.

Deletion: Delete account, on the account page, removes your account and everything in it immediately. Copies in backups expire within 90 days.

Withdrawing consent: You can leave the waitlist at any time by replying to its email or writing to us.

Non-discrimination: Exercising your rights will never change the service you receive or the price you pay.

Complaints: If you believe we have mishandled your personal information, write to us with the details. We will investigate and reply in writing. You can also complain to your data protection authority.

We respond to requests within 30 days, and we may ask you to confirm your identity, usually by writing from the email address on your account. Requests go to hello@paywalls.app.

16.Use of Cookies

We use one cookie, and only while you are signed in: the session cookie, which keeps you signed in as you move between pages. It is set by paywalls.app, sent only over encrypted connections, and removed when you sign out.

Your browser's local storage keeps three things for this site, and none of them leaves your device: your Light or Dark choice, if you make one; anything you save before you have an account, which moves into your account when you sign in; and, while you are signed in, your plan and your initials, so a page can show them before it has heard back from our servers. The last is removed when you sign out.

We do not use analytics, advertising or third-party cookies, which is why there is no cookie banner. You can block cookies in your browser settings, but you will not be able to stay signed in.

17.Business Transfers

If Paywalls, or substantially all of its assets, is sold, merged or otherwise transferred, personal information may be among the assets transferred. The new owner would have to keep protecting it as this policy describes, and we would notify account holders before any change to how it is used.

18.Limits of Our Policy

The site links to websites we do not operate, including those of the apps shown in the library. We are not responsible for their content or their privacy practices.

19.Changes to This Policy

We may update this policy to reflect changes to the site, to our practices or to the law. The effective date at the top shows when it last changed.

If a change is significant, we will email account holders before it takes effect. Where the law requires it, we will ask for your consent before using your personal information in a new way.

20.Turkish Personal Data Protection Law (KVKK)

Data controller: Paywalls is the data controller (veri sorumlusu) for the personal information described in this policy.

Legal bases: We process personal information because it is necessary to perform our contract with you (article 5(2)(c)), because it is necessary for our legitimate interests (article 5(2)(f)), or, for the waitlist, with your explicit consent (article 5(1)).

Your rights: Under article 11 you may ask whether we process your personal information and request information about it; learn why we process it and whether it is used for that purpose; know the third parties it is transferred to in Türkiye or abroad; ask for incomplete or inaccurate data to be corrected; ask for it to be deleted or destroyed; ask that corrections and deletions be passed on to those third parties; object to a result produced solely by automated analysis; and claim compensation for damage caused by unlawful processing.

How to apply: Send your request to hello@paywalls.app from the email address on your account. We will respond free of charge within 30 days. If you are not satisfied with our response, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Transfers abroad: Your personal information is transferred abroad to the service providers listed under Third Parties We Currently Use, for the purposes described in this policy.

22.California Privacy Notice (US)

If you live in California, the California Consumer Privacy Act gives you the following additional information and rights.

Categories we collect: Identifiers, such as your email address, your name if you sign in with Google, your account ID and your IP address; internet activity, such as the pages you view, counted without identifying you; and approximate location, meaning the country derived from your IP address. We collect them from you and from your use of the site, for the purposes described under Collection and Use of Information.

No sale or sharing: We do not sell or share personal information, as those terms are defined in California law, and we do not use it for cross-context behavioral advertising.

Right to know and delete: You can ask what personal information we have collected about you and how we use it, and ask us to delete it. Use Download your data and Delete account on the account page, or write to us.

Non-discrimination: We will not treat you differently for exercising these rights.

Do Not Track: We do not track you across other websites, so there is nothing for a Do Not Track signal to turn off.

23.Contact Us

For any questions about this policy or your personal information, email hello@paywalls.app. Paywalls is not yet operated through a registered company and has no postal address. When it is, this policy will give both.