Privacy

Last updated 21 October 2026

Who we are

ASO Growth OS (aso.byalif.app) is run by Saroar Khandoker, trading as byAlif. For everything on this page we are the data controller, except where we handle data for you (the App Store reviews of your apps, below). Questions, requests and complaints: support@byalif.app.

The free report

Anyone can open a report about an App Store app without signing in. A report is built from public Apple data: the app's store listing (including the developer's name as the App Store shows it), search results, Apple's search suggestions and Apple's published search popularity. Each report is saved and can be opened by anyone, and recent reports are listed in our index. If you publish an app and want its report taken down, write to us.

To keep reports free, each network can start only a few new reports a day. For that we use your network address (for IPv6, only the network part of it): it counts for 24 hours, is held only in the server's memory (cleared as it fills up and whenever the server restarts), and is never written to a database or a log. The images on a report (app icons and screenshots) load straight from Apple's servers, so your browser also contacts Apple when you view one.

Visiting the site sets no cookies and runs no analytics or advertising scripts. Our server counts how often each report is opened: one number per app and day, with nothing about who opened it (no cookie, no account). So that one network cannot inflate the count, it adds at most three opens an hour to one report and sixty in all; for that the network address (for IPv6, only the network part) is held only in the server's memory, until it fills up or restarts, and never written to a database or a log.

Your account

To create an account we ask for your email address and, if you like, a name. You sign in with a one-time code: our sign-in service emails it to you and checks it; new accounts never set a password (a few accounts made before sign-in codes still have one). We also keep your plan, your account's status and dates, and, if you signed up from a report, that app's App Store ID. When you create an account, your email address is written to the server log.

After you sign in, a cookie keeps you signed in for up to 30 days. We store only a fingerprint (hash) of it, with when that sign-in started and ends; these records stay with your account. Requests for a sign-in code and code checks are limited per email address and network address over windows of up to an hour, held only in the server's memory.

We use your email address to sign you in and to reach you about your account. If you take part in Peer Tests, we also email you when something there needs you: your test was taken, feedback arrived, your deadline is near, or a decision was made about your feedback. You can switch these emails off on the Peer Tests page. We do not send marketing emails. Legal basis: the contract between us (running the service you signed up for).

Paying for a plan

Paid plans are sold through Paddle.com, our reseller and the Merchant of Record: you buy from Paddle, on Paddle's checkout. Paddle collects what it needs to take the payment and charge VAT, such as your name, email address, country and payment details, and handles them under its own privacy policy. We never see your card or bank details or your address.

When you start a checkout we tell Paddle your account's ID, so the payment reaches the right account. From Paddle we receive and keep: your Paddle customer and subscription IDs, the plan and price you bought, the subscription's status, its renewal or end date and any change you planned, and for each notice Paddle sends us about it, its ID, type and time. Legal basis: the contract between us.

Your apps' App Store data

When you add an App Store Connect API key, we keep the key's ID and issuer ID, and the private key itself encrypted. The key is never shown back to anyone, you included. We use it to read your apps' data from Apple, to ask Apple to prepare its analytics reports for your apps, to ask Apple to notify us when a version's state changes (Apple receives our address for those notifications and a secret to sign them; we keep the secret encrypted, the notification set-up and when notifications arrive), and to publish to your store listing as described in the next section.

With it we collect and keep, for each app you connect:

• the store listing in every language: name, subtitle, keywords, description, promotional text, release notes and links;
• daily figures by country: impressions, product page views, downloads, sessions, active devices and crashes;
• version states and product page tests;
• App Store reviews: rating, title, text, country, date and the reviewer's public App Store nickname;
• keyword rankings and competitors we look up from public Apple data.

We also keep what the service makes and records for your apps: the drafts we write and why, their AI review scores, what was approved, rejected and published and by whom, growth reports, and anything you enter, such as custom product page details, notes and scores.

None of this is sales or payment data. The figures come from Apple already totalled; they do not identify the people who use your app. App Store reviews do contain other people's nicknames and words: for those we act on your behalf, use them only to show and analyse your own reviews, and never publish them.

Legal basis: the contract between us. Removing your key ends our access to App Store Connect; version notifications Apple was set to send may still arrive, and public App Store lookups for your apps (such as keyword rankings) continue while the apps are in your account. What was collected stays until you ask us to delete it.

You choose which apps to import. An app you switch off gets no updates, drafts or publishing until you switch it on again; its data stays. An app you remove leaves your list and is never imported again; its data stays with your account (and in your data export) until your account is deleted.

What we publish for you

• Promotional text(the line above your description, which Apple lets apps change at any time): each week our automated review checks the promotional text drafts. A draft that passes is published to your live listing without a further click only for an app where you switch on automatic promotional text (on the app's page) or autopilot; otherwise it waits for your Push.
• Title, subtitle and keywords are published only when you press Push, or on the weekly run for an app you have put on autopilot yourself.

AI drafts and reviews

To write and check drafts, and to explain how your apps are doing, parts of your data are sent to AI models:

• Anthropic (Claude): your store listing, tracked keywords and their ranks, search suggestions, the drafts themselves, and your apps' performance figures and history (downloads, impressions, product page views, conversion, ratings and review counts, downloads by country, releases, listing changes, and whether an app is on autopilot or frozen);
• OpenAI: the current and proposed text of a listing field, its language and the app's name, when drafts go through our automated review.

For your apps, the calls to Anthropic go through its paid API under its business terms. The OpenAI review runs on OpenAI's Codex through our own ChatGPT subscription, so OpenAI's terms and privacy policy for that subscription apply to that text. For each paid API call we record the model, the number of tokens and the cost, never the text, to keep every account within a monthly AI budget; these records are kept with your account and deleted with it.

Three features would send more: sorting App Store reviews into themes and drafting replies to 1- and 2-star reviews (both would send review titles and text), and ideas for custom product pages (the app's category and short labels for its review themes). All three are switched off; if we switch one on, this page will say so first. Nothing from Peer Tests is ever sent to an AI model.

Product statistics

To see which parts of the service help people and which do not, we record a few moments of using your account. Each record holds what happened, when, your account's ID, the app it concerns (if any), whether you, we (the owner of the service) or our automation did it, for a draft or a published change the ID of that draft run or change (so a repeated request is not counted twice), and only these details:

• you signed up: whether with an email code or a password;
• you connected an App Store Connect key: whether it was your first, and how many apps it shows;
• you imported apps: how many you chose and how many were added, already here, over your plan's limit or registered to another account, and whether from the import list or the sign-up step;
• a draft was requested: by a click or by an import;
• you approved drafts: how many, and whether one or several at once;
• a change was published to the App Store: which field (for example the subtitle), and whether automatically;
• your plan changed: from which plan to which, and whether through Paddle or by us.

These records never hold anything you wrote (drafts, notes, names, feedback), your email address, your keys, payment details or network addresses. Only we see them, on our own admin page. They are kept for 12 months and deleted with your account. Legal basis: our legitimate interest in improving the service; you can object at any time by writing to support@byalif.app.

Peer Tests

Peer Tests lets developers test each other's apps and write private feedback. When you join, we keep the devices, iOS version and languages you can test in, that you confirmed you are 18 or older and accepted the rules, and a team identifier derived from your App Store Connect issuer ID (so a team counts as one member). When you set a test, we keep what you write for it, including any demo access you give. When you test an app, we keep your first impression, your feedback and any screenshots you add.

• The developer of an app you test sees your display name, your first impression, your feedback (including your device, versions, minutes spent, whether you had used the app before and whether you sent it late) and your screenshots. Members who take your test see its task, including any demo access you give. Other members see a test only as its app's name, category and what it needs. Your email address is never shown to another member.
• We also keep the running record Peer Tests needs: your turns, the tests you took and their deadlines, notes you send when you cannot get in, the developer's decision on your feedback with its reason and note, marks on wording held for a person to read, and the founder's reason when something held is removed instead of released.
• The founder reads feedback, notes and screenshots only to handle something held for review, a report or an appeal.
• Screenshots are cleaned when you add them: identifying data inside the image, such as location, camera details and embedded text, is removed; only what is needed to draw it (and a photo's rotation) is kept. They stop being shown 90 days after you add them and are deleted in the next nightly clean-up; screenshots of a test that ended without your feedback, or of feedback the founder removed, are deleted in that clean-up too.

Legal basis: the contract between us (the Peer Tests rules you accept when you join).

Who else receives data

We do not sell or rent data, and we do not share it for advertising. These services handle it for us:

• netcup GmbH (Germany): the server and database that run ASO Growth OS.
• Hetzner Online GmbH (Germany; servers in Finland): our sign-in service, which keeps your email address, and backups of the database.
• Mailgun (Sinch) (USA): sends the email with your sign-in code.
• Google(Google Workspace; data may be processed in the USA): sends Peer Tests emails from our mailbox, so it handles your email address and the email's text; a copy stays in that mailbox's sent mail.
• Anthropic and OpenAI (USA): the AI features above.
• Paddle (Paddle.com Market Ltd, England, or the Paddle company named on your receipt): sells paid plans, as described above.
• Apple: we read your apps' data from App Store Connect with your key, publish as described above, and look up public App Store data and search popularity.
• Telegram: the operator's own Telegram chat gets messages so that problems are seen quickly: a daily summary of the downloads and keyword ranks of the operator's own apps (with the keywords), the weekly AI-written analysis of those apps, and error details when a job fails. Alerts such as rating drops and version changes go there only for the operator's own apps; your apps' numbers, analysis and alerts stay in your dashboard. When a member asks for a plan change or for their account to be deleted, or a payment needs the operator's attention, a fixed note says so, with no name, address or message. They do not contain your email address.

Mailgun, Anthropic and OpenAI are in the USA, Google may process data there, and Telegram is outside the European Union, so what we send them leaves the European Economic Area. Paddle is in the United Kingdom, Ireland or the USA, depending on where you buy; what goes to its UK or US company leaves the European Economic Area too.

How long we keep it

• Your account and your apps' data, including apps you switched off or removed: for as long as your account exists, and deleted when you ask us to.
• Product statistics: 12 months, and deleted with your account.
• Report open counts (one number per app and day, nothing about the visitor): kept.
• Peer Tests screenshots: 90 days, or less as described above.
• Peer Tests emails: our copy of each (to whom, what it said, when it was sent) for 30 days; the sending mailbox's sent mail keeps its own copy.
• Saved public reports: kept publicly until the app's developer asks us to remove one.
• Network addresses and email addresses used to limit reports, report-open counts and sign-ins: in the server's memory only, until it fills up or restarts.
• Server logs: overwritten as the server's log space runs out (today that means days to weeks). Our automated review also writes its own log files and temporary files, with parts of draft copy and the models' comments; these are not yet deleted automatically.
• Payment records (the IDs, plan, status and dates above, and Paddle's notices): for as long as your account exists. Paddle keeps its own records of your purchases, as tax law requires.
• Database backups: up to 15 days.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, or to receive it in a machine-readable form, and you can object to our use of it. Write to support@byalif.app from the address on your account. We answer within one month.

For now these requests are handled by hand. Deleting your account cancels a paid subscription first, then removes your account and sign-in, your key, your payment records, and every record in our database linked to your apps and to your Peer Tests activity; backups age out within 15 days after that. Records of our automated runs and our log files can mention an app's name; they are not linked to your account. A Peer Tests draft kept in your own browser is yours to clear.

If you think we have not handled your data properly, you can complain to the data protection authority where you live or work. In Portugal that is the CNPD (cnpd.pt).

Cookies and browser storage

• aso_session: keeps you signed in, for up to 30 days. It is set only when you sign in, cannot be read by scripts on the page, and is sent only over a secure connection.
• theme(in your browser's storage): remembers Day or Night if you pick one, or that the site should follow your device's setting.
• The text of Peer Tests feedback you are writing is kept in your browser until you press Send, so a closed tab does not lose it. Screenshots are sent when you add them, and your first impression when you save it.

The payment window is Paddle's own page, loaded from paddle.com only when you open it to pay; Paddle's cookies and privacy policy apply there. Apart from that, there are no advertising, analytics or third-party cookies, so there is no cookie banner.

Security

Everything between your browser and our server is encrypted. App Store Connect private keys are stored encrypted, and sign-in cookies are stored only as a fingerprint. If a breach of personal data ever puts you at risk, we will tell you and the authority as the law requires.

Changes and contact

When what we collect or who receives it changes, this page changes first and the date at the top moves. Questions about this page or your data: support@byalif.app.