Privacy Policy
- Operator
- Apploko inc., Av. Las Magnolias & Blvr. Sergio Viera De Mello, San Salvador, El Salvador
- Contact for requests
- contact@apploko.com
- Server location
- Sweden (Amazon Web Services, Stockholm region); app files are served from Amazon S3 storage in the same region
- Effective date
- November 4, 2026
In brief
- We do not require registrationThere is one form on the site — a review on an app page.
- IP addressOnly its hash is written to the statistics, downloads and reviews database. The full IP address is recorded in the web server log, which is kept for 90 days. Third-party services: see section 2.
- We do not sell dataAnd do not pass it to data brokers.
- Your rightsTo have your data deleted, write to contact@apploko.com. We respond within 30 days.
1. What we collect
We do not require registration: the service has no accounts, passwords or profiles. There is one form on the site — a review on an app page; what is stored in that case is described below. All other requests are accepted by email.
When you visit the site:
| Data | Purpose | Retention period |
|---|---|---|
| Pages viewed, type of referral source (search engine, social network, direct visit, etc.), whether this is the first page of the visit, country code, browser user-agent string, hash of the IP address (the site’s own counter) | To understand which apps people look for and where visitors come from | 12 months |
| Web server log: full IP address, time, requested URL, referring page URL, user-agent string | Protection against abuse, investigation of failures | 90 days |
Language setting (cookie apploko_lang; duplicated in localStorage) | To show the site in the selected language | 1 year |
Theme (theme) and favourite apps (apploko:favorites) in localStorage | To remember your settings on this device; not sent to the server | until you delete them |
Random browser identifier apploko_sid (in localStorage) | To match clicks on partner links with downloads; contains no personal data and is erased together with the site data in the browser | until you delete it |
Referral source tags utm_* from the page URL, the referring site URL and the first page opened in the visit (sessionStorage) | To understand where the visitor came from | until the tab is closed |
apploko_visit_ts (sessionStorage) | To tell a new visit from a page reload, so the referral source is counted correctly | 30 minutes of inactivity or until the tab is closed |
apploko_search_id:* (sessionStorage) | To link a click on a result to the search it came from | 10 minutes or until the tab is closed |
| Country determined from the IP address | Regional restrictions on downloading certain apps | in the database — only the country code; the “IP → country” mapping is kept in a cache for no longer than 24 hours |
| If you leave a review: rating, text, name (optional), language, date; hash of the IP address and hash of the browser user-agent string | To publish the review after moderation. The hashes are used to limit repeat reviews and manipulation | a published review — until you ask us to delete it; hashes — 35 days; a rejected review — 90 days, after which the name and text are erased |
We determine the country ourselves, using a local address database; the IP address is not passed to third-party geolocation services.
A review is public: all visitors see the name and text. Do not include your contact details or other personal data in a review. We determine the country from the IP address when the review is sent, to apply country restrictions, and do not store it.
When you download an app or click a download button, the following is also recorded:
| Data | Purpose | Retention period |
|---|---|---|
| Hash of the IP address (not the address itself) | Protection against abuse and artificial inflation of counts | 12 months |
| Browser/device user-agent string | Compatibility and statistics | 12 months |
| Country code and whether the download was blocked by region | Compliance with regional restrictions | 12 months |
| App, version, time, site language, requested URL and referring page URL | Download statistics | 12 months |
Browser identifier apploko_sid, utm_* tags, referring site URL and the first page of the visit | Matching partner referrals with downloads | 12 months |
| The fact that the file was received from storage (amount of data, time, hash of the IP address, user-agent string, referring page URL) | To distinguish started downloads from completed ones | 12 months |
| File storage access log: full IP address, time, file, user-agent string, referring page URL | The row above is derived from it; the log itself is not transferred to the statistics | 30 days |
Records older than this period are deleted automatically, once a day. The total download counter of an app card is kept: it is not calculated from the log.
We do not collect: phone number, email address, payment data, precise geolocation, contents of correspondence. We store a name and text only if you leave a review yourself. The site does not collect the list of installed apps. It can be sent only by the AppLoko Play app and only with your consent — see section 4.
2. Third-party services
In addition to our own statistics, external services operate on the site. Data is sent to their servers, and their own policies apply there.
| Service | What it does | Policy |
|---|---|---|
| Yandex Metrica (counter 112378242) | Counts visits; Webvisor is enabled — recording of actions on the page: mouse movements, clicks, scrolling, as well as a click map and tracking of link clicks. Sets the cookies _ym_uid, _ym_d, _ym_isad, _ym_visorc | yandex.ru/legal/confidential |
| Google Analytics 4 (property G-J7J3JSSRZ3) | Counts visits and navigation between pages. Google Signals and ad personalisation are disabled. Sets the cookies _ga, _ga_J7J3JSSRZ3 | policies.google.com/privacy |
| Ahrefs Analytics | Counts visits and referral sources; does not set cookies | ahrefs.com/privacy |
| Amazon Web Services (hosting and Amazon S3 storage, Stockholm region, Sweden) | Hosts the site and serves app files: the downloaded file comes directly from Amazon S3 storage (domain apploko-apks.s3.eu-north-1.amazonaws.com), which sees your IP address, user-agent string and referring page URL | aws.amazon.com/privacy |
| Cloudflare Turnstile | “I am not a robot” check, only on the partner application form (the /partners page). Receives the IP address and technical browser data | cloudflare.com/privacypolicy |
Webvisor is not an ordinary visit counter: it records how you behave on the page, and the recording can be viewed. You can block this collection with an ad blocker or Yandex’s opt-out extension, or with the “Do Not Track” setting — Metrica respects it.
We check app files with VirusTotal: the file itself and its checksum are sent there; visitor data is not.
2a. Partner apps and advertising
Some catalog cards are marked “Advertisement”: these are partner apps, and their download button leads not to our file but to the partner’s website or to Google Play. When you follow such a link:
- the partner receives your IP address, user-agent string and referring page URL, as with any link click, and from then on the partner’s privacy policy applies;
- we add a random download event identifier (it contains no personal data) to the link URL so that the partner can confirm the installation — we use it to reconcile statistics with the partner. For some partner systems the link URL is passed unchanged, exactly as provided by the partner;
- we do not pass your name, email address, phone number or your browser identifier
apploko_sidto partners.
We do not sell data and do not pass it to data brokers; we use our own statistics only in aggregated form.
3. IP address
The full IP address is used at the moment a request is processed — to determine the country and apply regional restrictions — and is recorded in the web server log, which is kept for 90 days, and, when a file is downloaded, in the storage access log, which is kept for 30 days. Only its hash is written to the statistics, downloads and reviews database.
We do not claim that this hash is irreversible. It is computed with a fixed key, and the number of possible IPv4 addresses is finite, so in theory the original address can be recovered by trying all values. The hash hides the address from a casual look and in case an export leaks, but it does not make the data fully anonymous. We treat it as personal data and keep it for a limited period (see section 1).
4. Android app (AppLoko Play)
Permissions. The app requests the permission to install apps — without it the store cannot install what you have downloaded. Each installation starts with your action and is confirmed in a system dialog. Apart from internet access and package installation, the app has no other permissions. It does not read contacts, files, messages or location.
Which apps are installed. AppLoko Play sees the apps that have an icon on the phone screen. This is needed to show whether an app from the catalog is installed. Without your consent this list stays on the phone and is not sent anywhere.
The “Privacy” screen. On first launch the app asks two separate questions. Neither answer is pre-selected. Until you tap “Allow”, the app sends nothing listed in the table below. You can change your answer at any time: menu → “Privacy”.
| What is sent | When | Purpose | Retention period |
|---|---|---|---|
“App statistics”. Package names of the apps that have an icon on the screen (for example, org.telegram.messenger) and a “system app” flag. Together with them: a random installation number, the AppLoko Play version, the app language and the country code determined from the IP address (the address itself is not recorded) | Only after “Allow”. Immediately after consent, then no more than once every 7 days or when the set of apps has changed | To understand which apps people need and to expand the catalog | 365 days from the last submission, then deleted automatically |
| “Install report”. Whether the installation of an app downloaded through AppLoko Play succeeded, the error code, whether it is an update or a new installation, the download event number | Only after “Allow”. After each installation through AppLoko Play | To find files that fail to install and fix them | 12 months, like download statistics (section 1) |
What the app does not send: versions and installation sources of other apps, data inside them, contacts, files, location, advertising ID, IMEI or other device identifiers. The installation number is a random number. The app creates it at the moment you give consent; it is not linked to your name, phone number or device. It is needed only so that a new list replaces the previous one.
Legal basis and place of storage. The legal basis is your consent. The data is stored on our servers in Sweden (EU); see the beginning of this policy. If the IP address indicates Russia, the list of apps is not stored.
Who can see it. The list of an individual device can be seen only by AppLoko administrators. Catalog staff see only a summary — which apps occur most often — without linking it to any device. We do not transfer or sell this data to third parties.
How to withdraw consent. Menu → “Privacy” → “Don’t allow”. The app stops sending data and asks the server to delete the list sent earlier; the installation number is erased from the phone. If there is no network connection, the request is repeated at the next launch. Withdrawal does not affect the lawfulness of processing carried out before it. If you uninstall AppLoko Play without withdrawing consent, sending stops, and the previously sent list is deleted after 365 days. To delete it immediately, first withdraw consent, then uninstall the app.
On the phone the app stores the image cache, the selected language, your answers on the “Privacy” screen, the installation number (only if you gave consent) and install reports that have not yet been sent.
5. Third-party apps
The catalog contains apps by third-party developers. Once installed, such an app operates under its own rules and its own privacy policy — we do not control what data it collects. Check the permissions when you install it.
6. Age restrictions
Certain apps in the catalog are intended for adults only — including betting and gambling apps. Before you go to such an app, the site shows an “18+” warning. The site is intended for persons over 18; downloading betting and gambling apps is unavailable in countries where it is prohibited by law.
7. Your rights
You can request information about data relating to you, its deletion or the restriction of its processing — write to contact@apploko.com. We respond within 30 days. Because we do not keep accounts and store hashes instead of addresses, we will need additional details (for example, the time and the app) to find the records.
Consent given in the AppLoko Play app is withdrawn in the app itself: menu → “Privacy” → “Don’t allow”. The list of apps sent earlier is deleted from the server (section 4).
To delete your review, write to contact@apploko.com and include the link to the app, the name in the review and the date. We remove the review from the site and erase the name and text.
8. Changes
We announce changes to this policy on this page by updating the effective date. We do not send any other notifications.