Privacy Policy

Last updated: 2026-05-23

LemonOps ("the app") is built and maintained by Said Nadeem ("we", "us"). This policy explains what data the app handles and how.

TL;DR

We do not run a database. We do not collect analytics. The only thing we "store" about you is your Expo push token — and only while you have notifications turned on.

What the app handles on your device

Lemon Squeezy API key: stored encrypted in the Android Keystore via expo-secure-store. Never transmitted to our infrastructure. Only sent to api.lemonsqueezy.com over HTTPS to fetch your store data.
Cached store data: orders, customers, subscriptions, products that you've fetched are cached locally so the app works offline. Cleared on logout or uninstall.
Preferences: dark/light mode, default store, biometric-lock toggle, refund/cancellation mutation toggles. Stored in MMKV on-device.

What our backend handles

The push notification relay (a stateless Cloudflare Worker) stores:

Your Expo push token keyed against a per-store webhook signing secret, in a Cloudflare KV namespace. This is the minimum required to deliver "you just made a sale" notifications. The token is removed when you disable notifications or uninstall.
Lemon Squeezy webhook payloads are forwarded, not persisted.

We do not store:

Your Lemon Squeezy API key.
Order, customer, subscription, or product data.
Any identifier that could link you to a person (no email, no IP logs).

Third parties

Expo Push Service (operated by Expo / 650 Industries): receives your push token and the notification payload (e.g., "New order: $29.00") in order to deliver the notification through Apple/Google push gateways. See https://expo.dev/privacy
Google Play Billing (if you subscribe to LemonOps Pro): handles payment. We receive a purchase receipt and the entitlement state only.

Permissions the app requests

POST_NOTIFICATIONS (Android 13+): to display sale alerts. Optional.

Children

LemonOps is not directed at children under 13 and is not designed for their use.

Data deletion / rights

To remove your data from our relay, disable notifications in app Settings or uninstall the app. To request manual deletion, email said81nadeem@gmail.com and we will purge any associated token within 7 days.

Changes

We will update the "Last updated" date when this policy changes. Material changes will be announced in-app.

Contact

Said Nadeem — said81nadeem@gmail.com