Privacy Policy

Last updated: August 15, 2026

ShipZen ("the App") is a macOS application for managing App Store Connect. It is developed and operated by Sardorbek Rakhimov, an independent software developer ("we", "us"). This policy describes how the App and this website (shipzen.app) handle your data. We built ShipZen local-first on purpose: the less of your data we ever touch, the less can go wrong.

Summary

No ShipZen account. No sign-up. We do not operate servers that receive your App Store Connect data, credentials, or AI conversations.
Your credentials are stored in the macOS Keychain on your device and are used only to connect directly to Apple and to the AI provider you configure.
Purchases are processed by Apple and validated through RevenueCat under a random identifier that is not linked to your identity. We never see your name, email, Apple ID, or payment details.
The App always sends content-free crash, hang, and error reports, not linked to you, to help diagnose and fix failures. Usage analytics are separate and off unless you turn them on: a small set of content-free usage events so we can tell which features work — never your content.
The website is a static page. If you join the waitlist, we store your email address solely to tell you when ShipZen launches.

Data Stored on Your Mac

The App keeps its data on your device:

Secrets in the macOS Keychain — your App Store Connect .p8 private key, AI provider API keys (OpenAI, Anthropic), ChatGPT sign-in tokens, and the local MCP bearer token. Keychain entries are created device-only: they are not synced to iCloud Keychain.
Non-secret account identifiers — Issuer ID, Key ID, team name, and optional Vendor Number are stored in the Keychain or, when you use multiple account profiles, in a local configuration file in the App's Application Support folder. Your .p8 private key is never written to that file.
ChatGPT account details — if you sign in with a ChatGPT account, the App stores the resulting tokens and the email address associated with your OpenAI account locally in the Keychain, solely so the App can authenticate and show which account is signed in. This information is never sent to us.
Local caches — copies of your own App Store Connect data (metadata, reviews, sales and analytics reports, price points) cached in local files so the App is fast and stays within Apple's rate limits.
Preferences — stored via macOS UserDefaults. No secrets are kept there.
Optional local log — a diagnostic log you can enable for troubleshooting. It is off by default, redacts credentials it detects, stays on your device, and is only ever shared if you choose to send it to us yourself.

You can delete all of this at any time by removing the App, its data container (via macOS storage management or ~/Library/Containers), and its Keychain items.

Network Connections the App Makes

The App connects only to the following services. Most connections happen only when you use a feature that requires them; crash and error reporting — and usage analytics, if you have turned them on — connect starting at launch, as described below:

Apple App Store Connect API (api.appstoreconnect.apple.com), plus the Apple-operated addresses that API hands back for specific operations — uploading screenshots, downloading reports, and loading your apps' icons and screenshots. The App uses these to read and write your app metadata, builds, TestFlight data, reviews, reports, and pricing. Your .p8 private key never leaves your Mac; the App uses it locally to sign short-lived tokens that authenticate you to Apple.
Your AI provider (api.openai.com, api.anthropic.com, or chatgpt.com with auth.openai.com for sign-in) — only if you configure AI features. Requests go directly from your device to the provider under your own key or account; there is no ShipZen proxy in between. The content you choose to process — which can include your app metadata, customer reviews, or analytics summaries — is sent to that provider under its own terms and privacy policy.
RevenueCat (api.revenuecat.com) — only for validating App Store purchases of ShipZen Pro. See "Purchases" below.
Exchange-rate API (open.er-api.com) — a plain request for currency rates used by pricing recommendations. It carries no credentials, identifiers, metadata, or personal data.
Your own app's web addresses — when you run the pre-submission validator, the App sends a plain request (no credentials, no identifiers) to the support, marketing, and privacy-policy URLs you entered, purely to check they respond.
Crash and error reports (Sentry, *.ingest.de.sentry.io) — content-free crash, hang, error, and session-health reports, always sent. See "Crash, Hang, and Error Reports" below.
Usage analytics (PostHog, eu.i.posthog.com) — content-free usage events, only if you have turned usage analytics on. See "Usage Analytics" below.
Apple web pages (appstoreconnect.apple.com, developer.apple.com) — open in your browser only when you click a link to a web-only Apple workflow.

The optional MCP server listens on localhost only and is protected by a per-install token. If you connect an external tool (for example an AI client on your Mac) to it, that tool processes your App Store Connect data under its own configuration and policies — review what you connect.

Purchases

ShipZen Pro is sold through the Mac App Store. Payment is handled entirely by Apple against your Apple ID: we never receive your name, email address, Apple ID, payment card, or billing details.

To unlock Pro features and prevent fraud, the App uses RevenueCat, a subscription infrastructure service, as our processor. RevenueCat receives a randomly generated identifier, App Store purchase receipt and transaction data, and basic app and device information (such as app version and platform). We do not attach your identity to this identifier, and nothing we send RevenueCat identifies you. RevenueCat processes this data to validate purchases and give us aggregate sales statistics, under the RevenueCat Privacy Policy.

Diagnostics and Usage Events

The App reports two separate things: crash, hang, and error reports, which are always sent, and usage analytics, which are off unless you turn them on. Neither ever carries the content of your work. The App tells you about both on first launch, and tells you again before it starts collecting something materially different.

Crash, Hang, and Error Reports (always on)

To help diagnose and fix crashes, freezes, and significant internal errors rather than silently endure them, the App reports them to Sentry, a crash-reporting service acting as our processor, in the European Union. These reports are sent whether or not usage analytics are enabled.

A report can include: the stack trace and error type of the crash, hang, or handled error, the App version and build, your macOS version, Mac model, and basic hardware details such as memory, the names of the App's own recent internal operations (a fixed, published list of labels such as "fetch.fullMetadata" — never their arguments or results), and app-session health, which is a count of sessions that ended normally versus in a crash. A handled-error report describes the error with fixed labels only — the area of the App, a normalized category, an HTTP status code, and the error's type name — never its message text.

A report never includes your identity, and we never attach one: no name, email, Apple ID, App Store Connect account, or device serial. The app-session health signal is counted per installation rather than per report, so it is keyed to a random identifier that the crash-reporting library generates and stores on your Mac. It is the same kind of identifier as the usage-analytics install ID described below: random, derived from nothing about you, your Apple ID, or your hardware, not linkable to a person, and gone when you remove the App's data.

Sentry's project setting to discard IP addresses is enabled, so your IP address is not stored. Before a report is sent, the App keeps only a short list of technical details it needs in order to diagnose the crash — the App and macOS versions, your Mac model, and basic hardware — and discards everything else the crash-reporting library would otherwise attach, including your Mac's language, region, and time-zone settings. Any free text the crash handler collects is scrubbed as well: credentials are redacted, web addresses are reduced to their host name, and long digit sequences are masked. Because crash reports are detailed by nature, we describe them as content-free and not linked to you rather than fully anonymized: they contain no content and nothing that identifies you, but they are technical records of a moment in the App.

Usage Analytics (opt-in)

Usage analytics are off unless you turn them on — at the first-launch notice or later in the App's settings — and nothing is sent, or even stored, before that notice appears. If you opt in, the App reports a small set of events to PostHog, an analytics service acting as our processor, in the European Union, to understand whether the App's core features get used. These events are deliberately content-free and limited to:

Activation milestones — the first time you connect an account, complete a scan, start a chat, or complete a write, with only the broad in-app category (for example, scan type, chat mode, or write surface).
Onboarding progress — that setup started, that credentials were submitted, whether verification succeeded or failed and at which step, which AI option was chosen, and whether setup finished.
Feature usage — that a named App feature (for example, "validator run" or "screenshots upload") was used during a session, drawn from a fixed list of the App's own features. We do not count how many times you used it.
AI request measurements — coarse, bucketed measurements of requests to the AI provider you configured: which broad provider and model family, a size band, a duration band, and, when a request fails, a normalized failure category such as "rate limit" or "timeout". Sizes and timings are only ever reported as bands, never as exact numbers, and the provider's own error text never leaves your Mac.

Events also carry the App version, build number, distribution channel, and how analytics were enabled. They are tied to a random install identifier that is not derived from you, your device serial, or your Apple ID, and they are not stitched together into a session trace.

Crash reports and usage events never include:

your prompts, chat messages, or AI responses;
your App Store metadata, app names, bundle IDs, the locales you edit, or customer reviews;
API keys, tokens, credentials, or account identifiers;
anything typed into the App.

You can turn usage analytics off again at any time in the App's settings; that withdraws your consent going forward. Disabling stops all analytics reporting, discards anything queued, and resets the install identifier — opting in again creates a new random one. Neither analytics nor crash reporting is ever required for any feature to work. Builds without these capabilities send nothing.

The optional local diagnostic log described above is separate from both, and is never uploaded.

This Website

shipzen.app is a static site hosted on Cloudflare Pages. Cloudflare, as our hosting provider, processes visitor IP addresses transiently as part of operating and securing its network. The site sets no tracking cookies and uses no advertising or social trackers. If analytics are enabled, we use Cloudflare Web Analytics, which is cookieless and does not fingerprint or identify visitors.

If you join the launch waitlist, we store your email address, the signup time, and which page section you signed up from, solely to tell you when ShipZen is available. Your IP address is stored separately for up to one hour to rate-limit abuse and is never joined to your email. When you sign up, a notification containing your email address is delivered to us through Resend, our email delivery processor. We keep waitlist emails until you ask us to remove you or until we stop sending launch announcements, and we do not use them for anything else or share them with anyone beyond the processors that deliver these emails.

What We Never Do

We do not sell or rent personal information — to anyone, ever.
We do not run advertising or cross-site/cross-app tracking.
We do not collect the content of your work: metadata, prompts, chats, reviews, and reports stay between your Mac, Apple, and the AI provider you chose.

Legal Bases, Transfers, and Retention

Where the GDPR or similar laws apply, we rely on: performance of a contract (providing the App and processing purchases), legitimate interests (fraud prevention, security, stability, and crash and error diagnostics under random identifiers), and consent (usage analytics and the waitlist). Our processors — RevenueCat, Sentry (Functional Software, Inc., with crash data stored in the European Union), PostHog (usage analytics stored in the European Union), Cloudflare, and Resend — may process data in the United States and other countries. Each does so under the European Commission's Standard Contractual Clauses or an equivalent approved safeguard, set out in the data processing terms it publishes on its own site.

How long we keep things: crash, hang, and error reports are retained by Sentry for up to 30 days. Usage analytics events are retained by PostHog for up to 12 months. Purchase records are kept by RevenueCat while we use its service — when that ends, we can ask RevenueCat to delete or return them under its data-processing terms. Waitlist emails are kept until you ask us to remove you or until we stop sending launch announcements. Everything else stays on your Mac, where you control it.

Your Rights

Most data the App handles is under your direct control on your own device, and you can delete it yourself. For the little we are responsible for — a waitlist email, or purchase and diagnostic records held under random identifiers — you can contact us at [email protected] to ask for access, correction, deletion, a copy in portable form, or restriction of processing, or to object to the processing we base on our legitimate interests, which includes crash and error diagnostics. We will respond within the time the law allows. For usage analytics, you can withdraw your consent at any time with the toggle in the App's settings; for the waitlist, email us — neither affects anything done before you withdrew. Note that purchase and diagnostic records are held under random identifiers we cannot link to you, so in some cases we cannot locate data about you precisely because we never had your identity. You may also lodge a complaint with your local data protection authority.

Children's Privacy

ShipZen is a professional developer tool that requires an Apple Developer account. It is not directed at children, and we do not knowingly collect information from children.

Changes to This Policy

If we change this policy, we will publish the revised version here with a new date, and note material changes in the App's release notes. Continued use of the App or website after an update constitutes acceptance of the revised policy.

Contact

Data controller: Sardorbek Rakhimov (ShipZen) — [email protected].