Privacy Policy
Last updated: 25 August 2026
Plain-language summary of how Larko actually works. It describes the system as built, not a template.
1. Who we are
Larko is an app store optimisation tool operated by DriveCode ('we', 'us'). This policy covers larko.ai and the checker it hosts. It describes what the service actually does today — we would rather it be short and true than long and aspirational.
2. There are no accounts yet
Larko currently has no sign-up, no login and no payments. Nothing about the checker asks for a name, an email address or a card, and there is no profile for us to hold. The one exception is deliberate and optional: some features are built but not switched on, and next to each of those you can leave an email to be told when it opens. That is a list of addresses and nothing more — there is still no account behind it. When accounts do arrive, this policy will be updated before they do.
3. What we collect
(a) The app you check — the store, the app identifier and the storefront country you selected. (b) An anonymous usage key — a SHA-256 hash of your IP address and browser user-agent combined with a secret server-side salt, truncated to 16 bytes. We use it only to count requests against a daily limit for AI features. We do not store your raw IP address, and the hash cannot be reversed back into one. (c) Analytics events — only if you accept analytics cookies; see our Cookie Policy. (d) Anything you type into the search field, for the moment it takes to query the stores. (e) Your email address, only if you type it into one of the “tell me when this opens” forms, together with which feature you asked about and your interface language. We do not ask for it anywhere else and the checker never requires it.
4. Public listing data
When you check an app we fetch its public store listing — title, description, screenshots, ratings and similar — from Apple and Google, and we keep a dated snapshot of it. That data is published by the app's developer to anyone who visits the store; it is not personal data about you. We keep snapshots so that scores can be compared over time.
5. When AI is involved
The scored check is arithmetic and never leaves our servers. Two optional features — the written analysis and metadata generation — send the app's public listing text to Anthropic's Claude API for processing. Nothing about you is included: not your identifier, not your IP, not your searches. Anthropic does not train models on API inputs.
6. Cookies
One cookie is set before you choose anything: your cookie consent decision itself, so we do not ask again. A language preference cookie is set if you switch language. Analytics and marketing scripts are loaded only after you accept them, and the decision is read on the server, so declining means the scripts are never sent to your browser at all. Full detail is in our Cookie Policy.
7. Who processes data for us
Supabase — database hosting. Cloudflare — hosting, CDN and edge compute for larko.ai. Anthropic — the Claude API, for the two optional AI features described above. Google Analytics — only if you accept analytics cookies. There is no Tag Manager container and no advertising pixel of any kind on this site. We also make outbound requests to Apple and Google's public store endpoints to read the listing you asked about. We do not sell, rent or trade any data.
8. How long we keep things
Usage counters are only meaningful for 24 hours and are pruned after 30 days. Listing snapshots and audit results are kept indefinitely, because a record of how a listing changed over time is the point of keeping them — they contain no personal data. Analytics data follows Google Analytics’ own retention settings. An email you left for a feature announcement is kept until you ask us to remove it or until the feature it was about is abandoned, whichever comes first.
9. Your rights
Under GDPR you may request access to, correction of, or deletion of your personal data, object to or restrict processing, and withdraw consent at any time. In practice we hold very little that identifies you: an irreversible usage hash, an email address if you chose to leave one, and analytics identifiers if you accepted them. One line to support@larko.ai removes the address. Write to support@larko.ai and we will respond within 30 days. You may also complain to your national data protection authority.
10. Children
Larko is a tool for people who publish apps and is not directed at children. We do not knowingly collect data from anyone under 16.
11. Security
Traffic is served over TLS. Database access uses row-level security, and the service-role key is never exposed to the browser. The salt used for the anonymous usage hash is a server-side secret. No system is perfectly secure, and we would rather say so than claim otherwise.
12. Changes
If this policy changes materially we will update the date above and, where the change affects how we handle your data, say so on the site. Continuing to use Larko after a change means you accept it.
13. Contact
support@larko.ai. Data controller: DriveCode.