Privacy policy

Effective October 26, 2026

CohortLens ("we", "us") is operated by Foster Hoff, an individual. This policy explains what data the CohortLens software and website collect and how it is used. Questions: [email protected].

Who uses the software

Our clients are businesses that run paid advertising for their apps. A client connects its own advertising, attribution and revenue accounts to CohortLens by granting read-only access.

Data we access

• Advertising platform data (Meta, Apple Ads, Google Ads, TikTok and similar): campaign, ad group and ad names and IDs, budgets and bid settings, and aggregate metrics such as spend, impressions, clicks, installs, conversions and revenue, by day, country and campaign. Access is through each platform's official API with read-only permissions.
• Attribution and revenue data (for example RevenueCat, AppsFlyer, or a client's BigQuery or Snowflake warehouse): aggregate counts and totals of installs, trials, paying subscribers, revenue and refunds.
• Account information for the people at a client who use the software: name, work email, the accounts they authorize, and sign-in and session records (time, sign-in method, IP address and browser).

We do not collect or store device identifiers (IDFA, GAID), our clients' end users' emails, names or IP addresses, or subscriber-level transaction records. If an API returns row-level records, they are aggregated when received and the raw rows are not stored.

How we use data

Only to provide the service to the client that authorized access: producing reports, tracking audits, analyses and recommendations for that client. We do not sell data, use it for advertising, share it with other clients, or combine one client's data with another's. We do not make changes to a client's advertising accounts.

Narrative explanations in reports may be written with the help of a commercial AI model provider. The model receives aggregate figures only, never personal data, under terms that prohibit training on our inputs.

Google user data

CohortLens's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads API access only to read reporting data for the authorizing client.

Storage and security

Data is stored in systems we control, kept separate for each client. Access credentials are encrypted at rest and never stored in source code, and backups are encrypted before they leave our server. Access to production data is limited to the operator.

Retention and deletion

• Client data is kept while the client uses the service, plus 30 days.
• A client may revoke our access at any time from its own platform admin screens; we stop pulling data within one business day.
• On written request we delete a client's data within 10 business days and confirm in writing. Backups expire within 35 days of deletion.

Service providers

We use infrastructure providers (hosting, backups and email) and an AI model provider as described above. They process data only on our instructions.

Website

This website does not use advertising or analytics cookies. The software uses only essential cookies: a session cookie after you sign in, and a 10-minute cookie while you sign in with Google. Our hosting provider may log standard request data (such as IP address and browser type) for security.

Your rights

You may ask to access, correct or delete personal information we hold about you by emailing the address above. We will respond within 30 days.

Changes

We will post any changes to this page and update the effective date.