Privacy policy

RepriceCat (“we”) is a web service that updates App Store Connect prices for your apps, in-app purchases and subscriptions. It is operated by an independent developer and is not affiliated with or endorsed by Apple Inc. Questions about this policy: use the contact details on your invoice or the account email you signed up with to reach us.

Only what the product needs to work:

• Account: your email address and, if you sign in with Google, Apple or GitHub, the identifier and name that provider shares. Optional two-factor authentication secrets (TOTP) are stored by our authentication provider.
• App Store Connect API key: the Issuer ID, Key ID and .p8 private key you paste. The private key is encrypted with AES-256-GCM before it reaches the database and is never returned to the browser. It is used only to mint short-lived tokens for requests to Apple on your behalf.
• Your pricing configuration: regional tiers, territory assignments, per-territory overrides, base territory and scheduled changes.
• Price-change history: for every job, the product, territory, previous price, new price, date and outcome. Completed job records are pruned after 180 days; transient job state is pruned within hours.
• Billing: a Stripe customer and subscription identifier and the number of apps billed. Card details are entered on Stripe’s pages and never touch our servers.

• Your Apple ID password, or any Apple credential other than the API key you give us.
• Your customers’ data. Pricing endpoints return prices and catalogue metadata, not purchaser information.
• Payment card numbers — Stripe holds those.
• Analytics profiles, advertising identifiers or tracking cookies. The only cookies are the session cookies that keep you signed in and the one that remembers the cookie notice — see the cookie policy.

Only strictly necessary cookies: your sign-in session and a record of the cookie notice. No third-party scripts, analytics or advertising run in your browser, and fonts are served from our own host. Settings you make in the product (tiers, presets, display preferences) are kept in your browser’s local storage and never sent anywhere except your own account. Every cookie and storage key, with its purpose and lifetime, is listed in the cookie policy. Should we ever add optional cookies, nothing will load before you opt in.

With your key we read your apps, in-app purchases, subscriptions, territories and price points from the App Store Connect API, and write the price schedules you confirm. App names and icons are cached briefly to render the Apps page. We read nothing beyond what the pricing screens need, and we do not keep copies of your catalogue beyond the cache and the history above.

Three sub-processors, each handling only what it must:

• Supabase — authentication and the Postgres database where everything above lives, scoped to your user ID by row-level security.
• Stripe — billing. Stripe receives your email and the amount; you enter payment details on Stripe’s pages.
• Cloudflare — hosting and the network edge the application runs on. Request logs are kept for operations and security.

We do not sell data, share it with advertisers, or use it to train models.

• Performance of a contract (GDPR art. 6(1)(b)) — your account, App Store Connect key, pricing configuration, job history and billing: all of it exists to carry out the price changes you ask for.
• Legal obligation (art. 6(1)(c)) — invoices and billing records kept for tax and accounting law.
• Legitimate interest (art. 6(1)(f)) — server-side request logs used to keep the service secure and running.
• Consent (art. 6(1)(a)) — only for optional cookies, of which there are currently none.
• Our sub-processors may store data outside the EU / UK; each of them does so under the EU Standard Contractual Clauses or an adequacy decision. You may lodge a complaint with your local data protection authority at any time.

• The App Store Connect private key is sealed with AES-256-GCM at rest using a server-side key that is not stored in the database.
• Every account uses only its own key. There is no shared Apple key and no way to reach another account’s apps.
• Tiers, jobs and history sit behind row-level security tied to your user ID.
• Nothing is written to App Store Connect without an explicit confirmation in the review step.
• Revoke the key in App Store Connect at any time and RepriceCat can do nothing further with it.

• Replace or remove your App Store Connect key from the Credentials page at any time.
• Export your tiers and price-change history as a spreadsheet from Import / export.
• Cancel billing from Settings; your configuration and history remain until you delete them.
• Ask us to delete your account and everything tied to it. Where the law gives you rights of access, rectification, erasure, portability or objection (for example under the GDPR or UK GDPR), you can exercise them by contacting us; we respond within the statutory period.

Account data and pricing configuration are kept while your account exists. Price-change history is pruned after 180 days. Transient job records are removed within hours of completing. Billing records are retained as long as tax and accounting law requires.

When this policy changes we update the date above. Material changes are announced in the product. See also the terms of service.