Privacy Policy

Last updated October 10, 2026

This policy explains what ASO Studio ("ASO Studio", "we", "us") collects when you use the ASO Studio Mac application, the ASO Studio Connect iPhone app ("ASO Connect"), and this website, why we collect it, and the choices you have. Both apps keep your work on your device, one account covers both and keeps them in step, and the account we keep is intentionally small. A weekly report email is in development; it is described below in advance, and it will be off until you turn it on.

Overview

We collect what is needed to sell you a license, verify that license inside the app, and support your account. We do not sell your personal information.

Information we collect

The information tied to your account is limited to the following:

Account identity. When you sign in with Apple or Google, we receive a stable account identifier and, if you allow it, a relay or real email address. We use this to recognize your account across the website, the Mac app and the iPhone app.
Billing identifiers. When you purchase on this website, our payment processor creates a customer record and returns identifiers such as a customer ID, purchase status, and update eligibility. When you subscribe in the iPhone app, the App Store handles payment and RevenueCat tells us the plan, its status and its dates. We store these to confirm your entitlement, and we keep the date you first subscribed on iPhone so we can offer iPhone subscribers ASO Studio for Mac on better terms.
Entitlement records. Whether your annual plan is active and when its current billing period ends.
Download link requests. If you ask us to email you the download link while browsing on a phone, we store that address, which surface you asked from, and when. We send you the link and nothing else: there is no list behind it and no follow-up sequence. Ask us on the support page and we will delete it.
Setup answers and feedback. The answers you give while setting up ASO Connect, such as your role, your goals and how you heard about us, the names of any analytics providers you ask us to support, and any feedback you send from the app with the app version and your device model. We use these to shape the product and to reply to you.
Product analytics.How this website is used, including pages viewed, clicks, and session recordings with form inputs masked. Both apps also send anonymous usage events, such as a screen opened or a feature used, under a random identifier made on your device that is not linked to your account. The iPhone app adds a daily summary of how it runs, from Apple's own reports: crash types, hangs, launch time and memory, in rough bands. None of it includes app names, keywords, notes, listings, keys or your own numbers, and you can turn it off in either app's Settings.
Operational data. Standard server logs (such as IP address, timestamp, and request path) generated when your browser or the app contacts our service, used for security and reliability.

We do not receive or store complete payment card numbers. Card details are entered directly with our payment processor.

Your research data

Tracked apps, keywords, rankings, notes, tags, history, and every metric ASO Studio computes are stored on your Mac, and that copy stays yours whether or not you keep the subscription. Your notes and tags are never sent to us at all.

When you are signed in, your account also keeps a few things so your Mac and iPhone show the same work. The first is the keywords you track for your own apps, each with its app and storefront. The second is the daily figures the apps read from your App Store Connect reports for your apps, such as impressions, downloads, earnings, subscriptions and usage, with the splits Apple gives by source, storefront and device. Only the apps you mark as yours share keywords. Keyword sharing can run both ways, from the Mac only, or not at all, set in the Mac app's Settings, and turned off in the iPhone app's Settings. These figures are used only to show them back to you on your devices. Your account also keeps the list of apps your Mac tracks, as App Store ids only, so the free App Rating checker keeps their scores current.

If you connect optional services such as an Apple Search Ads account, or an Anthropic or OpenAI key for the Mac app's AI features, those credentials are stored in the macOS Keychain on your device and are used only to make requests you initiate. They are never transmitted to us. You can remove them at any time.

The Mac app's AI runs on your Mac with Apple's on-device model unless you choose a provider and add your own key. When you use the assistant with that key, what it reads to answer you, which can include your App Store Connect figures, goes from your Mac to the provider you chose, under that provider's terms. It never passes through us.

Connecting an AI agent works in one of two ways, and they differ in exactly one respect. On your Mac, it is a socket readable only by your account, and nothing in that exchange passes through our servers. From anywhere else, your Mac holds an outbound connection to our edge and we pass messages along it.

On that second path we are a relay and not a destination. Messages are forwarded between your agent and your Mac and are not stored, logged or read; your workspace stays on your Mac, and every App Store request is still made from your machine rather than ours. It is off unless you switch it on, it needs you to sign in and approve the connection, and turning it off ends it immediately.

ASO Studio Connect on iPhone

Your metrics, reviews, listings and version history are read from App Store Connect directly by the app, with your own key. Reviews and listings stay on your device. The daily report figures and the keywords you track are also kept in your account, as described under Your research data. Widgets read a copy the app keeps on your iPhone.

If you connect PostHog, Amplitude or Mixpanel, the app reads them directly from your iPhone. Their keys are kept in your iPhone's Keychain, and neither the keys nor the figures are sent to us.

If you import your App Review history on the Mac, your account keeps each version's review steps and the guideline behind any rejection, so your iPhone shows the same history. The full App Review messages are kept only if you choose to include them. The app also records each milestone your apps reach, such as a download count, an earnings mark or a top ranking for a keyword, so each one is celebrated once across your devices.

To alert you the moment App Review moves, the app registers an App Store Connect webhook for each app you follow. For that we keep the app's identifier and name, the review status changes Apple sends for it, your devices' push notification tokens, the tokens of any Live Activity you start, and which alerts you have turned off. Status changes are kept for 90 days. The app also registers a key made on your device, used only to sign the readings it shares.

The review times the app shows are pooled from those status changes across everyone who uses it, and only ever shown as counts and medians, never an app, a developer or an account.

Shared App Store readings

Both apps share the public App Store readings they take, such as search rankings for a keyword, chart positions, listings and ratings, into a common cache, so the next person to ask gets the answer at once. These are public App Store data, not your notes, tags or keys.

The Mac app also contributes two anonymous figures that sharpen its estimates for everyone: a month's installs set beside the month's written reviews, and how a release plan performed, each with only the genre, storefront and bands it belongs to. Neither carries an app, a keyword or an account.

The weekly report email (not yet available)

This feature does not exist yet and no data is collected for it today. We are describing it here in advance so the change is not a surprise, and we will update this policy and its date before it starts collecting anything.

The plan is an email at the end of each week covering the apps you track: which terms moved, the rank each moved from, and what we suggest doing next. Producing that email would mean holding a copy of what it reports on, specifically your tracked apps and their rank readings and associated metrics, so the report can compare this week against earlier ones. It would not include your notes, your tags, or any key you have connected.

It will be off until you switch it on, it will be usable only to build and send your own report, and it will carry an unsubscribe control that stops the email and deletes what it was holding. We will not sell that data, share it with other customers, or use it to advertise to you.

How we use information

To create and authenticate your account.
To process subscription payments and manage your license entitlement.
To deliver eligible application updates through the authenticated update feed.
To send the review alerts you choose and keep your Live Activities current.
To understand how this website and the apps are used so we can improve them.
To provide customer support and respond to your requests.
To secure the service, prevent abuse, and meet legal obligations.

Where you arrived from one of our ads, we measure whether that visit ended in a subscription. We do not sell your information or build profiles of you to share with anyone else.

Legal bases for processing

Where the GDPR or similar laws apply, we process your information to perform our contract with you (providing the app and your license), to pursue our legitimate interests in operating and securing the service, and to comply with legal obligations such as tax and accounting requirements.

Your App Store Connect key and vendor number

The App Store Connect key you connect is stored in the Keychain on your iPhone, iPad or Mac and used only to make requests to Apple from that device. It stays there unless you turn on "Keep my key in my ASO Studio account".

If you turn it on, we keep a copy of the key in your account so your other devices have it when you sign in. It is encrypted with Google Cloud Key Management Service, whose encryption keys never leave Google's hardware, and it is bound to your account so it cannot be read under any other. We decrypt it only to return it to you, signed in, on one of your devices. We never use it to make requests to Apple ourselves. Turning the setting off, removing the key in either app, or deleting your account removes our copy.

You can revoke the key in App Store Connect at any time, and every app using it loses access at once.

Your vendor number, which App Store Connect shows you and your sales reports need, is saved to your account so each app can read your earnings without asking for it again. It is not a password, and you can change or clear it in either app's Settings.

Service providers

We rely on a small set of providers who process limited data on our behalf:

Apple, for Sign in with Apple, App Store payments, and push notifications.
Google, for Sign in with Google.
Google Cloud, for encrypting an App Store Connect key you choose to keep in your account.
Stripe, for payment processing and billing management on this website.
RevenueCat, for managing App Store subscriptions in the iPhone app.
SendGrid, for delivering support email and download links.
Cal.com, for booking a launch package call, on the page shown after that purchase.
PostHog, for product analytics on this website and anonymous usage in the apps.
Google, for measuring which of our ads lead to a subscription.
Our hosting, database and storage providers, for running the website, storing entitlement records and keeping what your devices share.

Each provider processes information under its own terms and privacy commitments.

Data retention

We keep account and entitlement records for as long as your account exists and as needed to honor your license. A download link request is kept until you ask us to remove it. Billing records may be retained longer where required for tax, accounting, or legal reasons. When you delete your account, we remove the associated entitlement record and revoke stored authentication tokens, subject to the retention periods above, along with everything ASO Connect keeps for it: webhook registrations, push and Live Activity tokens, alert settings, subscription records, an App Store Connect key you chose to keep in your account, your vendor number, the keywords, report figures and tracked app list kept for your devices, your App Review history and milestones, and your setup answers and feedback. Status changes already in the review times pool stay there without any link to you and expire within 90 days.

Security

We use encryption in transit, restricted access, and provider-managed infrastructure to protect account data. Secret keys used by the service are never exposed to your browser. No method of transmission or storage is perfectly secure, but we work to protect your information and to limit what we hold in the first place.

International transfers

Our providers may process information in countries other than yours. Where required, transfers rely on appropriate safeguards such as standard contractual clauses offered by those providers.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. To request account deletion and token revocation, or to exercise any of these rights, contact us using the details on the support page. Active billing may need to be resolved before an account can be deleted. We will not discriminate against you for exercising your rights.

Children's privacy

ASO Studio is intended for developers and is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will remove it.

Cookies and analytics

The website uses essential cookies to keep you signed in and to complete secure checkout, and product analytics cookies set by PostHog to measure how the site is used. That analytics measurement covers pages viewed, clicks, and session recordings in which form inputs are masked.

Google Ads sets an advertising cookie so we can see which of our ads lead to a subscription. None of this data is sold. You can block these cookies in your browser's settings, and the site works normally with them blocked.

Changes to this policy

We may update this policy as the product evolves. When we make material changes, we will revise the date above and, where appropriate, provide additional notice. Continued use after an update means you accept the revised policy.

Contact us

Questions about this policy or your data can be sent to the address listed on the support page. Please do not include private API keys or Apple Search Ads private-key material in any message.