Privacy Policy

The App does not transmit, relay, or store any authentication credentials or fetched analytics metrics on developer-operated backend servers.

Network communications are initiated directly from your device to Apple's official App Store Connect API and Apple Analytics report delivery endpoints. To obtain analytics data, the App may automatically or upon your request generate recurring or one-time report requests on App Store Connect.

API keys, private keys (.p8), and metric payloads (download numbers, sales proceeds, conversion rates) never touch, pass through, or get stored on developer-managed servers or cloud databases.

To enable the App's analytical features, the user inputs and registers the following information directly on their device:

• Issuer ID: Organization identifier from App Store Connect
• Key ID: Unique alphanumeric identifier for your API key
• Vendor Number: Official vendor identifier for Sales & Trends reports (an 8-digit number)
• Private Key (.p8 file or text): Cryptographic private key used solely for local ES256 JSON Web Token (JWT) request signing
• Initiative Tracking Records: User-entered initiative records (initiative titles, launch dates, categories, notes) created when using the supporter benefit feature. All initiative data is saved strictly in the local sandbox and is never transmitted to external servers.
• In-App Preferences: Display currency selections (USD, EUR, JPY, etc.) and date interval filter options

Using the user's registered credentials, the App retrieves the following data directly from Apple's servers and associated report delivery endpoints:

• List of applications managed by the user (App ID, application name, bundle ID, SKU)
• Sales & Trends report data (first-time downloads, redownloads, updates, proceeds, refund amounts, purchase territories, device models)
• Analytics report data (generated report files containing impressions, product page views, conversion rates, and retention rates)
• Customer review information (star ratings, submission timestamps, review text)
• Public application metadata and high-resolution icon artwork via Apple's iTunes Lookup and RSS APIs

Sensitive credentials registered in the App—including the private key (.p8), Key ID, Issuer ID, and Vendor Number—are stored exclusively in iOS Keychain Services, Apple's hardware-backed, encrypted security enclave.

• Protected by the kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly accessibility attribute: items can only be decrypted after the device has been unlocked by the user, and data never transfers to other devices.
• Private keys are automatically excluded from unencrypted iTunes backups and iCloud backups.
• Retrieved analytics cache files are kept strictly within the application's sandboxed container on your device and cannot be accessed by other iOS applications.

⚠️ Important Notice (Device Sale, Transfer, or Repair): Due to iOS architectural behavior, data saved in the iOS Keychain may persist on the device even after an app is deleted. Before selling, trading in, giving away, or submitting your iPhone for service, you must open AppTrack and select Settings > Delete API Key to completely purge credentials from the Keychain.

The information entered and retrieved is utilized solely for the following technical purposes:

• Local generation of dynamic JWT signatures (Apple CryptoKit ES256) and direct HTTPS communication with App Store Connect API / Analytics delivery endpoints.
• Rendering performance metrics, charts, graphs, country/device breakdowns, and customer reviews across in-app dashboards.
• Logging initiatives and calculating pre/post metric changes (downloads, proceeds, CVR) across 7/14/28-day periods as part of the supporter benefit features.
• Populating iOS Home Screen and Lock Screen widgets with up-to-date metrics.
• Processing voluntary Tip Jar transactions via StoreKit 2 and tracking benefit duration locally on the device.
• Maintaining local troubleshooting network logs inside the device sandbox. Logs record only HTTP response status codes and API error messages; credentials, private keys, and sensitive tokens are never recorded or transmitted.

The App establishes no connections to developer-managed servers. External network traffic generated by the App is strictly limited to the following destinations:

• api.appstoreconnect.apple.com & Apple Analytics Report Endpoints: Official Apple App Store Connect API servers for authenticated data requests, report generation, and report downloads.
• itunes.apple.com / apps.apple.com / Apple Icon CDN: Public Apple endpoints for fetching application icons, display titles, and App Store customer reviews.
• cdn.jsdelivr.net / currency-api: Public open exchange rate feeds for multi-currency conversion (no credentials or identifier data are ever sent).
• apple.com (App Store Payment Servers): StoreKit 2 communications with Apple's transaction infrastructure when purchasing in-app tips. Payments are handled entirely by Apple; the Developer receives zero payment card information.

The App contains zero third-party tracking or analytics SDKs (such as Google Analytics, Firebase, Mixpanel, AppsFlyer, or Facebook SDK), and contains zero advertising SDKs.

The App will never trigger Apple's App Tracking Transparency (IDFA) authorization prompt because user activity is never tracked across other apps or websites.

When biometric authentication (Face ID / Touch ID) is enabled, fingerprint or facial biometric data is processed entirely within the hardware Secure Enclave of your iPhone. The Developer has no access to biometric information. Authentication is verified locally by the operating system via the Local Authentication Framework.

The Developer does not sell, rent, trade, license, or disclose user personal data, credentials, or application metrics to any third parties.

Direct, encrypted communications take place between your device and Apple Inc. as part of ordinary application functionality. In addition, when you choose to use our support contact form, information is submitted and managed through Google LLC's infrastructure (Google Forms).

If required by lawful subpoena, court order, or governmental demand, the Developer may respond in accordance with legal procedures (note that because no user data is stored on developer infrastructure, the Developer possesses no user metrics or credentials to disclose).

Users can immediately and permanently purge their private key, all credentials, and local cached report data from the device at any time by navigating to Settings > Delete API Key within the App. We strongly urge performing this action before transferring or selling your device.

Local report caches, saved initiative records, and non-Keychain files stored in the sandbox will be deleted when the App is uninstalled from the device.

⚠️ Crucial Reminder: Under iOS system rules, items saved in the Keychain may survive app uninstallation. To ensure complete eradication of credentials, execute Settings > Delete API Key before deleting the App. A full factory reset ("Erase All Content and Settings") of the device will also wipe all Keychain data.

The App is a professional utility created for individual and enterprise iOS developers who hold an Apple Developer account with App Store Connect access. The App is not directed to children under 13 years of age, and we do not knowingly collect information from children under 13.

Minors (under 18 years of age) may only use the App with the express consent of a parent or legal guardian.

This Privacy Policy may be amended to reflect feature updates, technical improvements, or changes in legal regulations. In the event of material modifications, reasonable notice regarding the revision and effective date will be communicated via the official website or within the App.

If you have questions, comments, or concerns regarding this Privacy Policy or data practices in AppTrack, please reach out via our contact form below.

Information submitted through the contact form (Google Forms)—such as your email address, name/handle, and message contents—will be used strictly to investigate, resolve, and respond to your inquiry.

Inquiry data is hosted securely on Google LLC's infrastructure and will not be shared with external third parties except as compelled by law.

Open Contact Form