Privacy and data handling

Account and browser information

GitHub sign-in uses your login and numeric account ID. Google sign-in uses a separate Google-issued identifier. Signed session cookies expire after seven days. We do not link accounts by email or name or retain Google sign-in tokens.

Your browser stores interface preferences. Repair continuation stores request inputs in the current tab for up to 24 hours; the server rechecks ownership and source state before using them.

Source and preparation records

Import reads app configuration at the selected commit and stores workspace ownership, repository and commit details, configuration paths and hashes, and release records. Import does not retain raw source file bodies, credentials.json or GitHub access tokens.

Declarations, reviewer answers and other preparation records you save are retained with the release. Optional artifact uploads are stored separately; they are different from the read-only import. Store and build-service credentials you connect are encrypted and stored separately.

Payments and notifications

Payment records include your account, workspace, app and version identifiers, selected offer, amount, currency, payment state, timestamps and Stripe identifiers. Order, account, workspace, app and version identifiers are sent to Stripe as payment metadata. Card details are entered directly with Stripe.

Completion notifications use the email address you verify and enable for that purpose. We record delivery state for enabled notifications. Signing in does not by itself subscribe you to completion emails.

When you send a free expert request, we store your question, the reply address you enter, your account, the release it concerns and its delivery state, and email them through Resend to our support inbox so an expert can reply. To delete a request, email jin@project82.kr; we delete the stored request and our copy of the email.

AppIsComing Chrome extension (pilot)

The extension works only in the store tab where you click its icon, and only for a help session you start from AppIsComing. On App Store Connect or Google Play Console it reads the app identifier shown on the page, the state of supported listing fields and a one-way hash of their current text, and, when you ask, whether a saved service account appears in Users and permissions, checked with a one-time keyed hash of the service-account addresses listed there; other addresses on that page are neither kept nor sent. It enters your reviewed draft only when you ask, and it never presses save, submit or publish.

It does not read passwords, verification codes, cookies, keys, tax, bank or payment details, screenshots or whole pages. Draft text reaches the extension only for an entry you ask for and is not stored by it. The help session token is kept in the browser’s session storage until the panel sees the session end or the browser closes. Once a session is stopped or expires, the server gives it no new work. A step already handed out may still report its result until 5 minutes after the session’s scheduled end (30 minutes after it started), so the record stays complete.

About 24 hours after a session ends, a scheduled cleanup removes its tab details and the draft text sent for entries. Task records (field names, states, hashes and times) and the first time each help step was reached are kept with your release records. “Check with Apple” reads your saved App Store listing through your connected key and keeps only whether each field matched. Extension data is not used for advertising or shared beyond the service providers below.

While we compare, browser help is offered by the week an account first sees it, every other week, to learn whether it helps; the group is recorded with the sign-in and does not change. On request we erase a workspace’s browser-help records (sessions, task records and help marks, and the group once no other workspace of the account remains). We keep an erasure record: the workspace identifier, when it was requested and done, who did it, and how many records of each kind were erased.

Service providers

GitHub provides sign-in and authorized repository access; Google provides optional sign-in; Stripe processes payments. Vercel hosts the service and counts page views with Vercel Web Analytics (cookieless, aggregate only, no IP address or identifier stored), Neon provides database storage, Cloudflare stores uploaded artifacts, and Resend delivers enabled email notifications and the expert requests you send to our support inbox. These providers process information needed for their respective functions. The browser also requests fonts from Google Fonts, which receives network request information such as the IP address.

Stored records and deletion requests

Signing out, removing a GitHub App or letting a paid package expire does not delete stored release records. There is no self-service deletion of an entire workspace. To request access, correction or deletion, email jin@project82.kr from the account you use and identify the workspace.

Payment records may need to be retained for accounting, refund and dispute handling. Deleting a stored provider credential does not revoke that credential at its provider or immediately remove historical backups. Do not send passwords, tokens or private source files in a support email.