Privacy Policy
StoreGit keeps your App Store data on your Mac. This page lists everything that leaves it, where it goes and why.
Stays on your Mac
- Metadata history, ranks and analytics
- Drafts you haven't committed
- Your API keys, in the Keychain
- Diagnostic logs, for 7 days
Goes straight to Apple
- App Store Connect requests, signed with your key
- App Store searches for your ranks
- Mac App Store purchases
Goes to our service providers
- RevenueCat: subscription status
- TelemetryDeck: anonymous usage signals
Never reaches us
- Your metadata, keywords, ranks or analytics values
- Your API keys
- Your contacts, location or advertising ID
Who we are
Sarva Labs makes StoreGit for Mac and runs storegit.com. This policy explains what information StoreGit and this website handle, where it goes and why. For information that reaches us, Sarva Labs is the controller, and the data fiduciary under India's Digital Personal Data Protection Act, 2023.
How StoreGit is built
StoreGit is local first. It has no server of its own that stores your App Store data. It keeps that data on your Mac and talks directly to Apple, so we never need to see your apps, your metadata or your keys.
What stays on your Mac
StoreGit stores the following on your Mac, inside its sandbox folder (~/Library/Containers/com.sarvalabs.storegit):
- your App Store Connect Issuer ID, Key IDs and private keys, in the macOS Keychain;
- one database per App Store Connect account, with your apps, versions, localizations, metadata text, screenshots, previews and icons (and cached copies of their images), keyword ranks, top-ranking apps, analytics reports, drafts you haven't committed, release dates you enter and the countries you track;
- your settings;
- diagnostic logs: warnings and errors from the last 7 days, plus more detail only during a 10-minute Diagnostic Logging session that you start. Logs never include your keys, app names, bundle IDs, metadata text, keywords, ranks, analytics values or web addresses.
We can't access any of this. It leaves your Mac only in the ways this policy describes.
To remove your keys, open Settings › Account in StoreGit and choose Delete All Keys. To remove everything, quit StoreGit, move it to the Trash and delete its folder in ~/Library/Containers.
What goes to Apple
- App Store Connect API. StoreGit signs requests with your key on your Mac and sends them to Apple to read your apps, versions, metadata, media and analytics reports, and to send the changes you commit.
- App Store search and lookup. To check ranks, StoreGit sends Apple's public search service the keyword, the country and app identifiers. It never sends your keys.
- Images. Icons and screenshots load from Apple's servers.
- Purchases. Apple processes StoreGit Pro payments. We never see your payment details.
Apple handles this information under its own privacy policy. As with any internet connection, Apple receives your network (IP) address.
What goes to our service providers
A few companies help us run StoreGit. Each receives only what it needs:
| Provider | What it receives | Why |
|---|---|---|
| RevenueCat | A random user ID that StoreGit creates, your App Store purchase and subscription records, the product, price, currency and country, and your app and macOS versions. | To know whether your Pro subscription is active, and to restore it on your other Macs. |
| TelemetryDeck | Anonymous usage signals, for example that StoreGit started, a tab opened, or a sync or commit succeeded or failed (with a general error category), plus the app version, macOS version, Mac model, language and region settings, and a random identifier that's hashed before it's stored. Never your apps, metadata, keywords, ranks, analytics values or keys. Demo mode sends nothing. | To see which features people use and how reliable syncing is. |
| Our email provider | Messages you send us and any attachments. | To answer you. |
| Vercel | Page views and performance data from this website, collected without cookies. | To host the website, keep it fast and see which pages help. |
| Google Analytics | On this website only: the pages you view, the page that sent you here, your browser, device type and approximate location (worked out from your IP address), and cookies that tell one visit from another. Never anything from the StoreGit app. | To count visits and see which pages help. |
Cookies on this website
Google Analytics stores cookies on storegit.com (named _ga and _ga_ followed by an ID). If you're in the EU, the EEA, the UK or Switzerland, none are stored until you allow them. The StoreGit app uses no cookies.
You can change your choice at any time, or block Google Analytics on every site with Google's opt-out browser add-on.
What we don't do
- We don't sell or rent personal information, or share it for advertising.
- We don't show ads, and we don't track you across other apps or websites.
- We don't build profiles of you, and StoreGit doesn't ask for your name, contacts or location.
- We don't receive your App Store data.
Support and diagnostics
When you email us, we receive your email address and whatever you include. If you choose to send a diagnostic export, it contains the logs described above and basic facts about your Mac and StoreGit: versions, processor type, the number of apps you track and whether Diagnostic Logging was on. We use it only to help you. Please never send your .p8 key.
Legal bases
Where the GDPR or UK GDPR applies, we rely on:
- our contract with you for subscription status and support;
- legitimate interests for anonymous usage signals, website performance and security. You can object at any time;
- your consent for Google Analytics cookies on this website. You can withdraw it at any time with Cookie settings;
- legal obligations for records the law requires us to keep.
How long we keep it
- On your Mac: until you delete it. Diagnostic logs: 7 days.
- RevenueCat: as long as your purchase history is needed to restore Pro and to meet legal and accounting rules.
- TelemetryDeck: signals are kept in aggregate and can't be traced back to you.
- Google Analytics (this website): up to 14 months.
- Support emails: as long as we need them to resolve your request and keep a record of it.
Your rights
Depending on where you live, including under the GDPR, the UK GDPR, California law and India's DPDP Act, you can ask to access, correct, delete or get a copy of personal information we hold about you, object to or restrict how we use it, withdraw consent, and nominate someone to act for you.
Most StoreGit data never reaches us, so you control it directly on your Mac. For information our providers hold, email us and we'll help. We can't link anonymous usage signals to you, so we can't find or delete yours individually. You can also complain to your local data protection authority. We'll reply to requests and grievances within 30 days, and we won't treat you differently for using these rights.
Children
StoreGit is a tool for app developers and isn't directed at children. We don't knowingly collect personal information from anyone under 18.
Security
Every StoreGit connection uses HTTPS. Your keys stay in the Keychain and your data in StoreGit's sandbox. We recommend turning on FileVault and keeping macOS up to date. No system is perfectly secure; if a breach affects information we hold, we'll notify you and the authorities as the law requires.
International transfers
Our service providers may process information in the United States, the European Union and other countries. Where the law requires it, they use safeguards such as Standard Contractual Clauses.
Changes to this policy
We'll post updates here with a new version number and effective date, list what changed at the top, and tell you in the app or on this website when a change is significant.
Contact
Questions, requests and grievances go to Sarva Labs.