Privacy

This notice describes the data the inapp.pro website processes. The website is run by Iaroslav Saverin, the developer of inApp. Questions about your data: saverinkz@yandex.ru.

The inApp iOS app has its own privacy policy.

You can read the website without an account. Your bookmarks and notes then stay only in this browser (localStorage) and are not sent to our server. No name, e-mail or phone number is needed.

You can sign in with Apple, Google or Telegram — on the website and in the inApp iOS app. In your account we keep:

• Apple — your Sign in with Apple ID, your e-mail address and name if you choose to share them (the address may be an Apple private relay address) and, if you signed in in the iOS app, an encrypted Apple token that lets us revoke the sign-in when the account is deleted;
• Telegram — your user ID, username and first name;
• Google — your Google account ID, e-mail address and name;
• e-mail — until October 19, 2026 you could also sign in with a link sent by e-mail (the e-mail went out through Yandex Cloud Postbox). This option is switched off, but accounts created this way keep their e-mail address as their identifier;
• when the account was created and your Plus access status.

You stay signed in through the ia_session cookie (30 days). We do not store passwords.

In the inApp app you can sign in to the same account: with Apple or through this website (Telegram, Google). In the second case the website hands the app a one-time code that is valid for 5 minutes and works once.

After you sign in, the app keeps a session key in the iPhone Keychain. On our server we keep only a hash of that key, when you signed in and when the app last used it; the account also records when you first signed in to the app. The key works until you sign out in the app or delete the account.

Once you sign in, your bookmarks and notes are kept in your account on our server so they are on all your devices; the entries from this browser are merged into the account once. Only you can see them. Removing a bookmark does not delete the note.

If you sign in to the same account in the inApp app (version 1.1 or later), bookmarks and notes sync between the app and the website: when you sign in, the app’s entries are merged into the account once, and after that changes go both ways.

The website’s server and database — accounts, bookmarks and notes, payment records — have run in Kazakhstan, in Yandex Cloud (Kazakhstan region), since October 13, 2026. Before that, they ran in Russia, in Yandex Cloud (ru-central1 region); we are shutting that infrastructure down.

Payments on the website are processed by YooKassa (NKO YooMoney LLC): card or SBP details are entered on YooKassa’s page and are not available to us. We keep which account paid, the amount, the payment method, the status and YooKassa’s payment number — to grant access and to answer questions about the payment.

Purchases in the iOS app are handled by Apple, and the subscription is checked through the RevenueCat service. If you are signed in to the app, the app gives RevenueCat your account ID, and our server uses that ID to ask RevenueCat whether your inApp Plus subscription is active. We keep the answer in your account (active or not, until when, lifetime or not, when it was checked) so Plus works for your account on the website too. Apple and RevenueCat do not share card details with us.

To understand which materials people read, we use Yandex Metrica (with Webvisor and the click map, which record actions on the page), Google Analytics and DataFast. They receive the addresses of the pages you open, clicks, browser and device data and an approximate location, and they set their own cookies.

We mark the note field and the text of your notes so that Webvisor does not record their content or keystrokes. The sign-in pages that the iOS app opens do not load these services.

For signed-in users the server also records which pages were opened in the account (page address and title). There are no ads on the website, and we do not sell data.

• ia_session — signing in, 30 days;
• locale and ia_theme — language and appearance, 1 year;
• ia_app_banner — the hidden “Open in the app” banner, 180 days;
• g_oauth_state, g_oauth_return — Google sign-in, a_oauth_state, a_oauth_nonce, a_oauth_return — Apple sign-in, 10 minutes each; ia_app_pkce — signing in to the iOS app through the website, 30 minutes;
• localStorage ia2:saved.ideas, ia2:saved.research, ia2:notes — bookmarks and notes; sessionStorage ia2:tabs — the last page of each tab, ia2:pulse.feed — the cards loaded in “Pulse” and the place in the list for Back, 30 minutes;
• Yandex Metrica and Google Analytics cookies.

Without an account, bookmarks and notes are deleted together with the site data in your browser settings.

You can delete your account in the website’s Settings (“Delete account”) or in the inApp app’s settings. Its bookmarks, notes, page history, payment records and all app sign-ins are deleted with it. If you signed in with Apple, we revoke the Apple token on deletion where this is technically possible; you can also stop using your Apple ID with inApp yourself in your Apple ID settings on iPhone, under “Sign in with Apple”.

The account is removed from the live database right away and for good. Database backups, which we make to recover from failures, are rotated: the newest few are kept, and older ones are deleted as new ones are made. Until a backup made before the deletion is deleted, the deleted account’s data can remain in it.

If deleting doesn’t work, e-mail saverinkz@yandex.ru and tell us how you sign in (Apple, Telegram, Google or e-mail). YooKassa, Apple and RevenueCat keep payment records under their own rules.