Privacy Policy
The short version. We collect only what we need to run AppStoreToolkit. Your App Store Connect key stays on your Mac. We never sell your data, never use it for advertising, and never post to your social accounts without you. You can ask us to delete everything at any time.
1. Who we are
AppStoreToolkit is an App Store optimization tool for app developers, operated by AppStoreToolkit ("we", "us"), based in South Africa. We are the controller of the personal data described in this policy. Contact us at privacy@appstoretoolkit.com.
2. Data we collect
| Category | What | Why |
|---|---|---|
| Account | Email address, and your name if you sign in with Apple or Google. Sign-in uses one-time email codes or Apple/Google sign-in; we don't store passwords. | To create and secure your account. |
| Your workspace | Apps you track, keywords, competitors, metadata drafts, notes, settings, and AI proposals you approve or reject. | To provide the service and sync it across your Macs. |
| Subscription | Plan, trial dates, and a Stripe customer/subscription ID. Card details are handled by Stripe and never reach us. | Billing and access to paid features. |
| Website | If you join the waitlist: your email and, optionally, an App Store link. | To send your invite and launch news. |
| Technical logs | IP address, browser/app version and request times in our server logs. | Security, abuse prevention and debugging. |
We also process public App Store data — app names, rankings, ratings, reviews and listing text that Apple publishes — to power keyword and competitor features. Review authors' public nicknames may appear in that data; we show them as Apple publishes them and don't use them for anything else.
We do not use advertising cookies, tracking pixels or third-party analytics on our website or in the app.
3. App Store Connect & Apple data
Connecting an App Store Connect API key is optional. If you add one, it is stored only in your Mac's Keychain. It is never sent to our servers. The app uses it on your Mac to read your apps' analytics, sales and reviews, and to publish metadata, screenshots or review replies only when you choose to. Analytics and sales reports downloaded this way are cached on your Mac, except for summaries you explicitly sync to your workspace, for example to share with Claude.
Keyword popularity comes from an Apple Ads account operated by us. Your searches for popularity scores are cached by keyword and country, not tied to your identity.
4. Social integrations (TikTok, Instagram)
These optional integrations let you plan, publish and measure promotional content for your apps. They are only active if you connect an account, and you can disconnect at any time.
What we access
- TikTok (via TikTok Login Kit and the Content Posting API): your basic profile (display name, avatar, open ID), permission to upload and publish videos you create in AppStoreToolkit, and the list and statistics of your own videos (views, likes, comments, shares).
- Instagram (via Facebook Login and the Instagram Graph API, for professional accounts): your account's username and ID, permission to publish photos, videos and reels you create in AppStoreToolkit, and insights for your own media (reach, impressions, engagement).
How we use it
- To publish content to your account only when you press publish in AppStoreToolkit. We never post, comment, follow or message on your behalf automatically.
- To show the performance of your own posts next to your App Store metrics.
- We do not access other users' private data, sell or rent this data, use it for advertising, or share it with anyone other than the service providers listed below.
Storage & revocation
- Access tokens are encrypted at rest and used only to make the requests above. Post statistics are kept while your account is connected.
- Disconnecting in AppStoreToolkit, or removing our app in TikTok or Instagram/Facebook settings, revokes access. We then delete the stored tokens and social data within 30 days. See Data deletion.
- Our use of TikTok and Meta data follows the TikTok Developer Terms and the Meta Platform Terms.
5. AI features (Claude)
AppStoreToolkit can work with Claude, an AI assistant by Anthropic, through a Model Context Protocol (MCP) server. Claude runs under your own Claude account and only sees the AppStoreToolkit data its tools return, such as your keywords, listing text and analytics summaries. Anthropic processes that data under its own terms and privacy policy. We don't send your data to AI providers on our own. Anything Claude proposes is shown to you first; nothing is published without your approval.
6. How we use data
- Provide, maintain and secure the service (contract).
- Process payments and manage subscriptions (contract, legal obligation).
- Send service emails, such as sign-in codes, billing notices and important changes (contract). Waitlist and launch emails are sent only with your consent, and you can unsubscribe any time.
- Prevent abuse and fix bugs (legitimate interests).
We don't make decisions with legal or similarly significant effects about you based solely on automated processing.
7. Who we share data with
We share data only with service providers that help us run AppStoreToolkit, under contracts that require them to protect it:
- Hosting: our virtual private server provider, which runs our backend (Appwrite) and website.
- Payments: Stripe.
- Email delivery: our transactional email provider, for sign-in codes and notices.
- Platforms you connect: Apple (App Store Connect, Apple Ads), TikTok and Meta, only to perform the actions you request.
We may disclose data if required by law, or to protect our rights and users' safety. If AppStoreToolkit is sold or merged, data would transfer under this policy and we'll tell you first. We never sell personal data.
International transfers: our providers may process data outside your country. Where required, we rely on safeguards such as standard contractual clauses.
8. Retention & deletion
- Account and workspace data: kept while your account is active, and deleted within 30 days after you ask us to delete your account.
- Social tokens and post data: deleted within 30 days of disconnecting.
- Billing records: kept as required by tax law, typically 5–7 years.
- Server logs: up to 30 days.
- Waitlist emails: until you unsubscribe or receive your invite, plus 12 months.
How to delete your data: see appstoretoolkit.com/data-deletion.
9. Security
We use encryption in transit (HTTPS/TLS), per-user access rules on every record, least-privilege API keys on our servers, and the macOS Keychain for your App Store Connect key. No system is perfectly secure. If a breach affects your data, we'll notify you and the relevant authorities as the law requires.
10. Your rights
Depending on where you live (including under the GDPR, the UK GDPR, South Africa's POPIA and California's CCPA/CPRA), you can:
- Access your data and get a copy of it.
- Correct it.
- Delete it.
- Restrict or object to processing.
- Ask us to transfer it to another service.
- Withdraw consent at any time.
We don't sell or "share" personal data for cross-context advertising. Email privacy@appstoretoolkit.com and we'll respond within 30 days. You may also complain to your local data protection authority; in South Africa, that's the Information Regulator.
11. Children
AppStoreToolkit is a professional tool for developers and is not directed to children under 16. We don't knowingly collect their data. If you believe a child has given us data, contact us and we'll delete it.
12. Changes & contact
We'll post updates here and change the effective date. For material changes, we'll also notify you in the app or by email before they take effect.
Questions or requests: privacy@appstoretoolkit.com · AppStoreToolkit, South Africa.