Privacy policy
This policy explains what personal data gora8 processes, why, and what rights you have. It covers this website and the gora8 service, which builds, releases and grows mobile apps for its customers.
1. Who is responsible
Pablo Guillen
Gürtelstraße 35, 10247 Berlin, Germany
Phone: +49 157 82276056
Email: hello@gora8.com
For privacy questions, write to the same address.
2. This website
This website sets no cookies, uses no analytics and loads no content from third parties. Fonts are served from this site.
The site is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technical data such as your IP address, the time of the request and your browser's user agent, to deliver the page and protect it against attacks (legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure, working website). Cloudflare keeps these logs only briefly. Cloudflare is certified under the EU-US Data Privacy Framework.
If you email us, we use your address and message only to answer you (Art. 6(1)(b) or (f) GDPR) and delete them when the conversation is finished, unless we have to keep them by law.
3. The gora8 service
Your account
To use gora8 you sign in with GitHub, Google or a one-time email link. We store your name, email address and the workspace you belong to, so you can sign in and work with your team (Art. 6(1)(b) GDPR).
Your apps and connected accounts
You connect the services gora8 needs to work on your app, for example your code repository (GitHub), Expo, Apple App Store Connect, Google Play, Meta and TikTok. Keys and tokens are stored encrypted and are never shown again. gora8 uses them only to do what you asked for: change your code, build and release your app, read store and ad numbers, and run the campaigns you approve.
Google user data
When you click "Sign in with Google" on the Connect your stores page, gora8 asks for access to manage Google Cloud resources and your Google Play Console. It uses this access only to set up your own Google Cloud project for your app: create a service account and its key, turn on the Android Publisher, Play Developer Reporting, Pub/Sub and Firebase APIs, set up Google Play purchase notifications, and give the service account access to your Play Console. gora8 keeps the Google sign-in for at most one hour and revokes it when the setup is finished. It does not read your email, files or other Google data, does not use Google data for advertising, and does not sell or share it.
gora8's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data about your app's users
If you add gora8's library to your app, it records how the app is used (screens, taps, crashes, purchases) so gora8 can find bugs and test improvements. Users are identified only by a random id or a hashed id, never by name or email. For this data you are the controller and gora8 processes it on your behalf (Art. 28 GDPR); we provide a data processing agreement. You are responsible for telling your users about it in your app's privacy notice; gora8 suggests the text.
Learning across apps
gora8 learns which kinds of changes work, for example "a shorter onboarding raised day-7 retention by 4%". It shares such results across customers only in an abstract form: the app's category and platform, the kind of change, the metric and the size of the effect. It never shares app names, texts, amounts, user counts or any ids, and shows a result only when at least three apps from three different accounts are behind it. You can turn this off in your account settings; turning it off also removes your existing contributions.
AI processing
gora8 uses AI models from Anthropic PBC (USA) to write code, plans and texts. Your code and the context needed for a task are sent to Anthropic for that task. Anthropic does not use this data to train its models.
4. Service providers
We use these providers to run gora8. Each processes data only on our instructions.
- Cloudflare, Inc. (USA): website, network and message buffering
- Anthropic PBC (USA): AI models
- GitHub, Inc. (USA): code repositories, when you connect yours
- Supabase, Inc. (USA; data stored in the EU, Frankfurt): backends that gora8 hosts for apps
- Expo (650 Industries, Inc., USA): app builds and over-the-air updates
Transfers to the USA are based on the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses.
5. How long we keep data
We keep account data while your account exists, and delete it within 30 days after you close it, except where tax or commercial law requires us to keep records (up to 10 years for invoices). Connected keys and tokens are deleted when you disconnect a service or close your account.
6. Your rights
You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a portable format (Art. 15–21 GDPR). Where processing is based on your consent, you can withdraw it at any time. Write to hello@gora8.com.
You can also complain to a data protection authority, for example the one in your state or the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
7. Changes
We update this policy when gora8 changes. The date at the top shows the latest version.