Privacy Policy
Last updated: 31 July 2026
Who this covers
This policy covers the AscAuto marketing site at ascauto.org, the application at app.ascauto.org, and the API at api.ascauto.org. Contact for any privacy question, including access and deletion requests: support@ascauto.org.
What we collect
1. Visiting ascauto.org
The site uses first-party, cookie-free page counting. When you load a page, the browser sends the path and referrer to our own server. We store those together with a daily visitor hash derived from the date, your IP address, your user agent and a server-side secret. The hash rotates every day and cannot be reversed to an IP address, so it lets us count visitors for a single day without identifying anyone or tracking you across days. There are no cookies, no persistent identifiers, no advertising or analytics third parties, and no cross-site tracking. Standard web-server logs are also produced by the hosting infrastructure.
2. Waitlist and contact form
If you join the waitlist we store your email address. If you send the contact form we store the name, email address and message you submit, so we can reply. Nothing here is sold, rented, or used for advertising.
3. Using the product
| Data | Why it exists |
|---|---|
| Account email and authentication data | To sign you in and scope everything you do to your account. |
| App Store Connect API key (.p8), issuer ID, key ID | To talk to Apple on your behalf: read app records, upload builds, edit listing metadata, submit for review. Stored AES-256-GCM encrypted. Revocable from Apple's side at any time. |
| GitHub installation / access token | To read the repository you connect, run builds, and open pull requests for code-level fixes. Never used to push directly to your branches. |
| App metadata, screenshots, questionnaire answers, build logs | To check a version against Apple's requirements, draft what is missing, and submit it. |
| Apple review correspondence you forward or that we fetch via the API | To classify a rejection, draft the fix, and prepare the resubmission. |
| Billing records | Subscription state and invoices, handled by Stripe. |
We do not collect your Apple ID password. There is no flow in the product that asks for it, and no field that stores it.
Who processes data for us
These are the third parties involved in running the service. They receive only what their function requires.
| Processor | What it receives |
|---|---|
| Apple (App Store Connect API) | The requests we make on your behalf using your API key. |
| GitHub | Repository access for builds and pull requests. |
| Anthropic (Claude API) | The text of Apple's review correspondence and the listing metadata being analysed, so a fix can be drafted. Sent for processing, not for training. |
| Stripe | Billing and payment details. Card numbers go to Stripe directly; we never see or store them. |
| Supabase | Authentication. |
| Our hosting provider | Runs the servers and databases; produces standard access logs. |
How long we keep things
- Account and app data: for as long as your account exists, and deleted when you ask us to delete it.
- Secrets (API keys, tokens): until you remove them or delete the account, whichever comes first. Removing a key from AscAuto does not revoke it at Apple — do that in App Store Connect as well if you want it dead everywhere.
- Page-view records: aggregate counts with the daily rotating hash described above.
- Billing records: retained as long as required for accounting and tax purposes.
Your choices
Email support@ascauto.org to get a copy of your data, correct it, or have your account and its data deleted. You can revoke AscAuto's Apple access yourself at any time by revoking the API key in App Store Connect, and its GitHub access by uninstalling the GitHub App. Depending on where you live you may have additional statutory rights (access, rectification, erasure, portability, objection); we honour those requests through the same address.
Security
Secrets are encrypted at rest with AES-256-GCM. Every query in the application is scoped to the authenticated account, so one tenant cannot read another's data. Traffic is HTTPS-only with HSTS. Database and internal services are not exposed to the public internet.
Children
AscAuto is a developer tool intended for people running an Apple Developer Program membership. It is not directed at children and we do not knowingly collect data from them.
Changes
If this policy changes materially we will update the date at the top and, for account holders, say so by email. Questions: support@ascauto.org.