Privacy Policy
Last updated: November 4, 2026
Pumf.it (pumf.it, including its MCP server at pumf.it/mcp) is operated by
Yurii Burlaka, individual entrepreneur (FOP), Ukraine ("we"). This policy explains what we collect and why. Questions: yurakaburlaka@gmail.com.
What we collect
- Visitor counting. Your IP address is stored with a timestamp, at most once an hour, only to count unique visitors, and is deleted after 30 days.
- Usage analytics. Our own first-party analytics records page views and clicks (for example, which tab or report was opened), the page path, the referrer and the device type. Visitors are identified by a hash of the IP address and browser with a salt that is replaced every day, so a visitor cannot be linked across days and the IP address cannot be recovered. No third-party analytics or advertising trackers are used.
- App Review (invite-only). If you join App Review, we keep your invite label, the apps you add (their public store IDs and names), the reports generated for them, the advice you mark as done or dismissed and your keyword decisions. A session cookie keeps you signed in.
- Uploaded images. Screenshots you upload to generate store images are processed and deleted within one hour.
- Search inputs. Keywords, app IDs and countries you look up on the site or through the MCP server are used to answer the request and may be kept in a cache of public store data.
- Emails. If you write to us, we keep the correspondence to answer you.
- Payments. Paid memberships are processed by our payment provider and merchant of record, Creem. We never see or store your card details; we receive only what we need to provide the membership (such as your email, plan and payment status).
Cookies and local storage
The only cookie is the App Review session cookie (HttpOnly), set when you sign in. Your browser's local storage keeps preferences such as the theme, the selected country and your saved keywords; they stay on your device.
How we use data
To run and improve the service, to generate the reports you ask for, to prevent abuse (rate limiting) and to answer you. We do not sell personal data and do not use it for advertising.
Who processes it
Our own server, hosted by our infrastructure provider; Creem for payments; DataForSEO and Google services to look up public search data for your queries (no personal data is sent to them). We disclose data only when the law requires it.
How long we keep it
IP addresses for visitor counting — 30 days; anonymous analytics events (no IP addresses) — as long as they are useful for statistics; App Review data — until you remove your app or ask us to delete your account; uploaded images — up to one hour.
Your rights
You can ask us to access, correct or delete your personal data, or object to its processing, by writing to yurakaburlaka@gmail.com. We answer within 30 days.
Changes
We will post any changes to this policy on this page and update the date above.