Privacy Policy
Last updated October 15, 2026
This policy explains what personal data StoreReady collects, why, who helps us process it, and the rights you have. It applies to storeready.app, the StoreReady command line tool and MCP server.
The short version
- We collect what we need to build and publish your apps, and nothing for advertising.
- We don’t sell your personal data or share it for advertising, and we use no tracking cookies.
- Your data is stored on Amazon Web Services (AWS) servers in the United States.
- You can ask us for a copy of your data, correct it or delete it at any time.
1. Who is responsible
The controller of your personal data is StoreReady. For anything about your data, including requests to use your rights, write to help@storeready.app.
StoreReady is built on the Estage Genesis platform. Our website, database, file storage, server functions and build servers run on Amazon Web Services (AWS) servers in the United States, and that is where your data is stored.
2. What we collect and why
We get this data from you and from the services you connect to StoreReady (GitHub, Apple, Google and Polar). You don’t have to give it to us, but without an email address we can’t create your account, and without your project and store keys we can’t build or publish your app.
| Data | Why we use it | Legal basis (EU and UK) | How long we keep it |
|---|---|---|---|
| Account. Your email address, your name if you add one, short-lived sign-in codes, your plan and settings | Create and run your account, sign you in, write to you about your account and your apps | Contract | While your account exists, deleted within 30 days after you delete it |
| Projects. Code you upload or the GitHub repository you choose, app name, icon, App ID, store listing text, screenshots, your answers to the stores’ privacy questions | Build and publish your apps, write listing text when you ask for it | Contract | Until you delete the app or your account |
| Builds. Build status and logs, built app files, fixes made by the build assistant | Run your builds, show their progress, reuse fixes in your next builds, find and fix problems in StoreReady | Contract, and our legitimate interest in improving StoreReady | Logs until you delete the app. A short record of each build (when it ran, for which store and whether it counted) until you delete your account. Built app files 30 days. Saved fixes up to 12 months |
| Store keys. Google Play service account key, App Store Connect API key, the Android upload key we create for your app | Sign and upload your apps | Contract | Encrypted, until you remove them or delete the app or your account |
| GitHub. Your GitHub username, which accounts and repositories you let StoreReady read | Show and build your repositories, start builds when you push | Contract | Until you disconnect GitHub or delete your account |
| Payments. Your plan, subscription status, order and customer numbers from Polar, amounts paid. Card details go to Polar and Stripe and never reach us | Charge for and manage your plan, keep accounting records | Contract, and legal obligations | As long as tax and accounting law requires, usually 5 years |
| Device sign-in. Name and IP address of a computer asking to sign in through the command line tool or an AI tool | Show you which device is asking, so you can allow or refuse it, and prevent abuse | Legitimate interest in security | Deleted within a day after the request expires |
| Messages. What you write to us and our replies | Answer you and help you | Contract, or legitimate interest | Up to 3 years after the conversation |
| Technical data. IP address, browser type, times of requests and error details in our providers’ logs | Keep the Service secure and working, investigate problems | Legitimate interest in security | Usually up to 90 days |
“Contract” means we need the data to provide the Service you signed up for. “Legitimate interest” means we use it for a reasonable purpose of ours that does not override your interests, and you can object to it at any time.
3. AI processing
When a build fails, our build assistant sends the build log and the parts of your project needed to fix it to Anthropic, the company that provides the AI. When you ask StoreReady to write store listing text, the description of your app goes to Anthropic too. Anthropic processes this data for us and, under its commercial terms, doesn’t use it to train its models. We keep a record of the problems the build assistant solved for your app, what failed and what it changed, to improve StoreReady, until you delete the app. You can object to that by writing to us. AI is never used to make decisions about you that have legal or similarly significant effects.
4. Who we share data with
These companies process personal data for us, under contracts that only allow them to use it to provide their services to us:
| Company | What it does for us | Where |
|---|---|---|
| Estage (Genesis platform) | Builds and hosts StoreReady: the website, database, file storage, server functions and build servers | USA, on AWS |
| Supabase, Inc. | Database, sign-in, file storage and server functions | USA, on AWS (us-east-1) |
| Amazon Web Services, Inc. | Website hosting, build servers, storage of built app files, delivery of sign-in emails | USA (us-east-1, us-east-2) |
| Anthropic, PBC | AI that fixes failed builds and writes store listing text | USA |
| Polar Software, Inc. | Sells our paid plans as reseller and merchant of record, charges taxes, issues receipts | USA |
| Stripe, Inc. | Card payments, on behalf of Polar | USA |
| GitHub, Inc. | Reading the repositories you connect, only if you connect GitHub | USA |
We also share data when you ask us to, or when the law requires it:
- Google and Apple receive your app, its listing and the details needed to publish it, through the developer accounts you connect.
- Authorities, when a valid legal request requires it. We check such requests and push back on ones that are too broad.
- A buyer of StoreReady, if the business is sold or merged. We will tell you before your data becomes subject to a different privacy policy.
We don’t sell personal data, and we don’t share it for advertising.
5. Transfers outside your country
Your data is stored on Amazon Web Services (AWS) servers in the United States, and the providers listed above are in the United States too. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use safeguards that data protection law recognizes, such as the European Commission’s Standard Contractual Clauses included in our providers’ data processing terms. For people in Russia, Kazakhstan and other CIS countries, the transfer is needed to provide the Service you signed up for, and you agree to it when you create your account.
6. How long we keep data
The table in section 2 shows how long we keep each kind of data. When you delete an app, its uploads, icon, screenshots, listing and build logs are deleted right away. A short record of each of its builds stays with your account (when it ran, for which store and whether it counted), because builds you already used this month still count toward your plan. Copies on our build storage expire automatically: built app files within 30 days and saved fixes within 12 months. Ask us and we will delete them sooner. When you ask us to delete your account, we delete your data within 30 days, except records we must keep by law.
7. Security
- All traffic to StoreReady is encrypted.
- Store keys and signing keys are encrypted at rest and only used for your builds.
- Each build runs in a fresh, isolated environment that is destroyed when the build ends.
- Access to data inside StoreReady is limited to what each part of the system needs.
No system is perfectly secure. If a breach puts your data at risk, we will tell you and, where the law requires it, the authorities.
8. Your rights
Wherever you live, you can ask us for a copy of your data, to correct it, or to delete it, by writing to help@storeready.app from the email address of your account. We answer within 30 days and may ask you to confirm it is you. You can also delete apps yourself in their Settings.
European Economic Area, United Kingdom and Switzerland
You have the right to access your data, to correct it, to have it erased, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest. Where we rely on your consent, you can withdraw it at any time. You can also complain to the data protection authority where you live or work.
United States
- In the last 12 months we collected identifiers (such as your email and IP address), commercial information (your plan and purchases), account credentials you give us (your store keys) and internet activity (logs), for the purposes in section 2.
- We don’t sell or share personal information for cross-context behavioral advertising, and we use your store keys only to provide the Service.
- Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws can ask to know, correct and delete their personal information. We won’t treat you differently for using these rights. You can use an authorized agent. If we refuse a request, you can appeal by replying to our answer.
- We don’t track you across other websites, so Do Not Track and Global Privacy Control signals don’t change anything here.
Russia, Kazakhstan and other CIS countries
We process your data to perform our agreement with you and with your consent. By pressing the button on the sign-in page after reading this policy, you consent to the processing of your personal data on the terms set out here, including its transfer to and storage in the United States. Your consent lasts until you delete your account or withdraw it.
- We collect, record, organize, accumulate, store, update and change, retrieve, use, transfer (provide and give access to), anonymize, block, delete and destroy personal data.
- Processing is automated.
- You can get information about how your data is processed, ask us to update, block or destroy it if it is incomplete, out of date, inaccurate or no longer needed for its purpose, and withdraw your consent, by writing to help@storeready.app.
- Without your consent the Service can’t work, so if you withdraw it we close your account and delete your data within 30 days, except data we must keep by law.
- You can complain to the authority that protects personal data in your country, or go to court.
9. Children
StoreReady is for adults who build apps. We don’t knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.
10. Cookies
We use only the cookies needed to keep you signed in and the site working, and none for advertising or analytics. Details are in the Cookie Notice.
11. Changes
If we change this policy in a way that matters, we will email you at least 14 days before the change takes effect. The date at the top shows the latest version.
Questions? Write to help@storeready.app