Skip to content
Log inStart 7-Day Free TrialStart Free

How we protect your data

Last updated: 16 Oct 2026

To show your real downloads and let you reply to reviews, StoRank asks for an App Store Connect API key or a Google Play service account. That is sensitive. Here is, in plain words, what we do with it and what we never do.

1. Your store keys are stored encrypted

Your App Store Connect .p8 key, Google Play service account JSON and Apple Ads private key are encrypted before they are written to our database (Fernet: AES encryption with an integrity check). The decryption key is kept apart from the database, so a copy of the database alone cannot open them.

A key is decrypted only in memory, at the moment we call Apple or Google with it. Once uploaded, it is never shown again: not in the dashboard, not in the API, not in emails. Settings only shows the connection’s name, Key ID and status.

Your store keys are never sent to AI providers. Our error monitoring is set up so it never receives request bodies, cookies or any text that looks like a key.

2. Least privilege is enough

You don’t need to give StoRank an Admin key. Create a separate key just for StoRank and give it only these permissions:

  • App Store Connect: an API key with the Sales role is enough to connect and to see daily downloads, revenue, and the country and device breakdown. Sending review replies from StoRank needs the Customer Support or App Manager role. Turning on Apple’s analytics reports (store conversion and crash counts) for the first time may need Admin; you only do that if you want to.
  • Google Play: the service account needs no role in Google Cloud. In Play Console, View app information and download bulk reports is enough; add Reply to reviews if you want to reply from StoRank.
  • Apple Ads: the API Account Read Only role is enough.

Step by step: App Store Connect API key and Google Play service account.

3. We only read

We use your keys only to read your own reports: downloads, revenue, reviews, store conversion, crashes and ad performance.

Only two things ever change something in your store account, and you start both by pressing a button: sending a review reply, and (App Store only) turning on Apple’s analytics reports. We never touch your listing text, prices, builds or any other setting.

4. Disconnecting deletes the key

When you delete a connection in Settings → Connections, the encrypted key and the data fetched with it are deleted from our database right away.

You can also revoke access at the source at any time: Revoke the key in App Store Connect, delete the service account’s key in Google Cloud, or remove the service account’s permissions in Play Console. StoRank’s access ends the moment you do.

5. Your card details never reach us

Payments are taken by Paddle.com, our Merchant of Record. You enter your card in Paddle’s own checkout window, and those details never reach our servers. We only see the subscription status, your country and the limited information needed for invoicing.

6. Sign-in and sessions

  • Your password is one-way hashed with scrypt; it is never stored in readable form and we cannot read it. Passwords are at least 10 characters.
  • Cloudflare Turnstile filters out bots on the email sign-in and sign-up forms. Failed password attempts are limited.
  • A session starts with a random key, and our database keeps only its hash. The cookie is HttpOnly (scripts on the page cannot read it) and travels only over HTTPS.
  • When someone signs in from a new device, a warning goes to your own email address; if it wasn’t you, change your password right away. Changing your password signs out every open session.

7. Claude, ChatGPT and API access

When you connect StoRank to Claude or ChatGPT (MCP) or create an API key, the access is read-only and sees only your own account’s data. It cannot change anything.

You can remove connections and API keys in Settings at any time. Access tokens and API keys are stored on our side only as hashes. Changing your password also disconnects AI apps. Details are on the Developers page.

8. Servers and network

  • All traffic is encrypted with HTTPS, and browsers are told to use only HTTPS for a year (HSTS).
  • The server accepts web traffic only through Cloudflare; connections that try to reach it directly are dropped.
  • Our pages are served with a strict Content Security Policy: only our own scripts, carrying a key that changes on every request, can run, and our pages cannot be embedded in other sites.
  • Accounts are kept apart: any request for another account’s app, keyword or connection gets a “not found” answer.

9. Backups

A backup is taken every night and encrypted with age before it leaves the server. The key that opens it is not on the server, so the backups stay unreadable even if the server were compromised.

The encrypted copy is kept off the server, in Cloudflare R2, for 30 days and then deleted. That is why data we delete also disappears from backups within 30 days at the latest.

10. Retention and deletion

If your trial or plan ends and you don’t pick a plan, your data is kept for 30 more days and then deleted; we email you 7 days before. To delete your account right away, use Settings → Delete My Account in the dashboard (you re-enter your password).

Deletion removes your apps, keywords, rank history, competitors, suggestions, store connections and keys, AI connections, API keys and sessions. Invoice records that the law requires us to keep remain.

11. What we don’t have yet

To be honest: there is no two-factor sign-in (2FA) yet, and we have no third-party certification such as SOC 2. When that changes, it will say so here.

12. Found a vulnerability?

Please write to [email protected] with what you found and how to reproduce it. We read every report and reply as quickly as we can. Give us reasonable time to fix it, and please don’t access other people’s data, delete data or run load tests that slow the service down.

Machine-readable contact details: /.well-known/security.txt.

← Home