Privacy Policy

Last updated: 16 February 2026

Who we are

Viewpo is built by Little Bear Apps, an Australian indie software studio. We build practical, privacy-friendly developer tools.

What data we collect

Website (viewpo.io)

• Analytics: We use Plausible Analytics, a privacy-first analytics tool. It collects no personal data, uses no cookies, and is fully GDPR-compliant. We see aggregate page views, referrers, and device types — nothing that identifies you.
• Email address: If you sign up for the beta or waitlist, we collect your email address to send you launch notifications and beta access details. We don't sell, share, or use your email for anything else.
• Ad measurement: If you arrive via a paid ad (e.g. Google Ads), the ad platform appends a click identifier to the URL. We store this identifier alongside your signup so we can measure which ads lead to signups. No advertising cookies are set, no third-party tracking scripts are loaded, and the identifier is never shared beyond confirming that a signup occurred.

Viewpo app

• Authentication: We use OAuth (Sign in with Apple, GitHub, Cloudflare) for secure sign-in. We never see or store your passwords. When you authenticate, we receive your email address and a unique provider identifier to create your account. Access tokens are encrypted and stored securely. We request only read-only access to list your projects and deployment URLs — we do not request write access to your code, repositories, or hosting configuration.
• Provider access: When you link a hosting provider (Cloudflare Pages, GitHub Pages, etc.), we request only the permissions needed to list your projects and preview deployments. We don't read, modify, or delete your code or hosting configuration.
• Preview URLs: Viewpo accesses your deployment preview URLs to render them in the viewport viewer. These URLs are only visible to you and anyone you explicitly share them with.
• Usage data: We may collect anonymised usage data (features used, viewport sizes selected) to improve the app. This data is never linked to your identity.

What we don't do

• We don't sell your data to anyone
• We don't use tracking cookies
• We don't serve targeted advertising
• We don't share your data with third-party marketing platforms
• We don't access your source code or modify your deployments
• We don't act as a data broker or sell, rent, or trade your personal information to any third party for their own marketing purposes

Data storage and security

Your data is stored securely using industry-standard encryption in transit (TLS) and at rest. Our infrastructure is hosted on Cloudflare and Apple's cloud services. We follow security best practices and regularly review our data handling processes.

Data retention

• Account data: Deleted within 30 days of account termination
• Backups: Encrypted backups may retain data for up to 90 days before automatic deletion
• Analytics: Plausible analytics data is aggregate and cannot be linked to individuals. Retained indefinitely for trend analysis
• Financial records: Transaction records are held by Lemon Squeezy (Merchant of Record) in accordance with tax compliance requirements (typically 7 years) and are not stored by Viewpo
• Email addresses: Retained until you unsubscribe or request deletion

Your rights

Under GDPR, the Australian Privacy Act, and other applicable privacy laws, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent for email communications at any time
• Export your data in a portable format

To exercise any of these rights, email us at [email protected].

You can delete your account at any time through the Viewpo app. Upon deletion, your data will be removed in accordance with the data retention schedule above.

Legal basis for processing (GDPR)

If you are in the European Economic Area or the United Kingdom, we process your data based on:

• Contractual necessity — to provide the Viewpo service (account creation, fetching previews, managing provider connections)
• Legitimate interest — to improve the app via anonymised analytics, ensure security, and prevent abuse
• Consent — for marketing emails, which you can withdraw at any time via the preferences page or by contacting us

Third-party services

• Plausible Analytics — Privacy-first web analytics (no cookies, GDPR-compliant)
• Cloudflare — Website hosting and CDN
• Apple — App distribution (App Store) and Sign in with Apple
• GitHub — OAuth authentication and GitHub Pages integration
• Lemon Squeezy — Payment processing and subscription management (Merchant of Record)

Overseas data disclosure

Your personal data may be stored and processed on servers located outside Australia, primarily in the United States and globally via Cloudflare's edge network. Our third-party service providers (Cloudflare, Lemon Squeezy) maintain data protection standards consistent with Australian Privacy Principles. By using the Service, you consent to this transfer.

International data transfers

We use service providers (Cloudflare, Lemon Squeezy) that process data in the United States and globally. These transfers are protected by Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework. We take reasonable steps to ensure your data remains protected to the standards required by GDPR and the Australian Privacy Act.

Complaints

If you believe we have breached the Australian Privacy Principles, contact us at [email protected]. We will investigate and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Changes to this policy

We may update this policy from time to time. We'll notify you of significant changes by email (if you've signed up) or by posting a notice on the website.

Contact

If you have questions about this privacy policy or how we handle your data, email us at [email protected].