Privacy Policy

Last updated October 30, 2026. ASO Engine is operated by Maicol Cabreja in the United States. This policy covers asoengine.app and the ASO Engine Mac app. Questions or privacy requests can be sent to support@asoengine.app.

What we handle

Research you choose to run. The app sends the keyword, storefront country, or public App Store app ID needed for a search or lookup. Our research service processes keyword-and-country requests and stores shared search results, public app metadata, and ranking snapshots. These records are not tied to an ASO Engine account or a device identifier. Do not put private information into search terms.

Your workspace on your Mac. Tracked apps, keywords, competitors, preferences, and app-specific ranking history are saved locally on your device. We do not upload your full workspace to our research database or sync it between devices.

Connected apps and credentials. If you use Metadata Translator or Price Parity, you provide an App Store Connect issuer ID, key ID, and private API key. If you use AI translation, you also provide an OpenAI API key. Saved credentials use Apple's Data Protection Keychain with device-only, when-unlocked access and are not configured for iCloud Keychain synchronization. Metadata Translator and Price Parity share the same saved App Store Connect connection.

Technical and support information. The website host, research host, and other network providers may process IP addresses, request times, device or browser information, and operational logs needed to deliver and secure their services. If you email support, we receive your address, message, and anything you choose to include.

How we use it

We use this information to return research results, maintain shared caches and ranking snapshots, operate and secure the website and app, answer support requests, and diagnose failures. We do not use your research terms for targeted advertising, and we do not sell personal information.

Services involved

Our website hosting provider delivers pages and may maintain security or access logs. Supabase hosts the shared research service. The Mac app also contacts Apple's public App Store services for app search, lookup, and related research; Apple receives those requests under its own policies. The Mac app checks our update feed through Sparkle by default when it opens and periodically while running; you can turn automatic checks off in Settings and still check manually. Email providers process support correspondence. We use service providers to operate ASO Engine, not to advertise to you.

App Store Connect and AI translation

The Mac app connects directly to Apple's App Store Connect API to fetch your apps, platforms, versions, localizations, products, and prices. It uses your private key locally to sign authentication tokens; it does not upload the private key to our research service. When you choose an action such as updating metadata, creating a version, or saving prices, the relevant changes are sent to Apple. These connected-app records are separate from our shared public research cache. See Apple's privacy policy.

When you request AI translation, the app sends the selected source text, source and target locales, metadata field, character limit, and translation instructions directly to OpenAI using your API key. This may include unpublished metadata. Connection testing also sends an authenticated request to OpenAI. Neither the OpenAI key nor translation requests are routed through an ASO Engine translation server.

Translation requests set store: false to disable response application-state storage. This does not guarantee zero retention: OpenAI may retain abuse-monitoring logs for up to 30 days by default, subject to its policies, exceptions, and your organization's data controls. OpenAI states that API data is not used to train its models unless you opt in. See OpenAI's API data controls. Only submit content you are authorized to share.

Mac app analytics

We use TelemetryDeck for app launches, navigation between the four workspaces, approximate foreground time, keyword-addition counts, translation outcomes, and confirmed price-save outcomes. Custom signals contain fixed event names, counts, booleans, and the product label ASO Engine. They do not contain credentials, keyword text, tracked app identities, metadata, prices, or support messages.

The SDK includes installation-derived hashed identifiers, session identifiers, and technical information such as app version, operating system, device type, and locale. We do not supply a custom user identifier. TelemetryDeck describes its additional identifier processing in its anonymization documentation. We do not use screen recordings or arbitrary interaction capture.

Analytics is enabled by default. You can disable new collection in Settings → General → Privacy; existing saved refusals remain respected. Disabling does not recall requests, erase provider-held data, or guarantee removal of already queued events. Older installed versions retain their own analytics behavior until updated.

Website cookies and analytics

We use Ahrefs Web Analytics to understand aggregated website traffic and improve ASO Engine. Ahrefs states that its standard analytics service does not use cookies or persistent identifiers. It processes page URLs, referrers, browser and device information, browser language, and city- and country-level location derived from IP addresses; it discards raw IP addresses and uses a daily rotating hash to estimate unique visitors. It also records page views, outbound link clicks, and form submissions. We do not use this analytics service for targeted advertising or to track people across websites or devices. See Ahrefs' analytics explanation.

We also use TelemetryDeck to measure website pageviews and selected download and tool-link clicks. Requests include the page path, referrer origin, browser language, and limited categories describing those clicks. TelemetryDeck derives browser, device and approximate location information from the request, and uses the IP address and browser user agent with a daily changing salt to generate a hashed visitor identifier. We do not send URL query strings, form contents, or search terms in these events. See TelemetryDeck’s web analytics documentation and privacy policy.

Our host may also use technical measures needed for delivery or security. Fonts are served from this website. If accounts or checkout are added later, this policy will be updated before those features go live.

The footer loads badge images from TryMacApps and Wired Business. Loading those images contacts their servers, which may receive technical request information such as your IP address, browser information, and a referrer according to your browser's settings. Following an external link takes you to a service governed by its own policy.

How long information stays

Local data. The app prunes local ranking snapshots older than 30 days during its normal loading and update operations. Other saved workspace data and preferences remain until removed. Saved API credentials remain in Keychain until you remove them; uninstalling the app alone may leave Keychain records and local support files behind.

Shared research. Scheduled maintenance removes server ranking snapshots older than two days, expired search-cache and public app-metadata entries more than seven days past expiry, and completed or otherwise non-running collection jobs older than one day. Research-demand records are removed after their collection window expires. These are maintenance thresholds, not guarantees of deletion at the exact instant a record reaches its limit, and do not describe separate provider logs or backups.

Providers and support. Provider logs, backups, and analytics follow the relevant provider's retention arrangements and project settings. The local 30-day history limit does not apply to TelemetryDeck or Ahrefs analytics. Analytics retention follows the relevant provider and project settings; disabling collection does not automatically delete historical data. OpenAI retention is described above. We keep support correspondence only as long as reasonably needed to address the request and related records or meet legal obligations.

Your choices and requests

You can remove tracked apps, keywords, and competitors in the app. Removing the app alone may not remove its local support files; macOS lets you manage those files. Because shared research records are not linked to an account, we may not be able to identify a particular pooled query as yours. You can email support@asoengine.app to ask about access, correction, or deletion of information we can identify, including support correspondence. We will respond as required by applicable law.

You can remove saved credentials using the app's credential and AI settings, and revoke keys with Apple or OpenAI. Avoiding connected tools prevents the corresponding requests; removing a local credential does not undo changes already saved to App Store Connect or erase records held by a provider. Do not email API keys or private-key files. Depending on your location and applicable law, you may also have rights to restrict or object to processing, request a portable copy, withdraw consent where processing relies on it, or complain to your local data-protection authority.

Payments and accounts

ASO Engine does not currently offer accounts or take payments through this website or app. Before either feature launches, we will update this policy to explain the additional data, providers, retention, and choices involved.

Security, location, and changes

We use reasonable measures to protect the information we handle, but no network service is completely secure. Our providers may process information outside your country. ASO Engine is not directed to children under 13. If our practices change materially, we will update this page and its effective date before the change applies where required.