Privacy Policy

1. Introduction

Welcome to Stornar ("we," "our," or "us"). Stornar is a unified app store metadata management platform that enables developers to manage their Apple App Store Connect and Google Play Console listings from a single dashboard.

This Privacy Policy explains how we collect, use, protect, and handle your personal information when you use our platform. We are committed to safeguarding your privacy and ensuring the security of your data.

2. Information We Collect

We collect only the information necessary to provide and improve our services:

Account Information

When you create an account, we collect your email address and display name. This information is used solely for authentication and account management.

App Store Credentials

To connect your app store accounts, you provide API keys, service account credentials, or authentication tokens. These credentials are encrypted at rest using AES-256 encryption and are only used to communicate with the respective platform APIs on your behalf.

Ad Network Credentials

When you connect Google Ads or Apple Search Ads to your dashboard, we store the OAuth access and refresh tokens required to authenticate with those networks on your behalf. These tokens are encrypted at rest using AES-256 encryption and are used solely to retrieve your own campaign performance data within Stornar.

Reporting & Analytics Data

When you enable reporting, Stornar syncs financial, acquisition, review, and analytics data from your connected Apple App Store Connect and Google Play Console accounts on a scheduled daily basis. This data is stored within your account to power historical charts and reports in your dashboard. Ad network campaign data (spend, conversions, ROAS) retrieved from Google Ads and Apple Search Ads is similarly stored for reporting purposes.

Usage Data

We collect operational usage data to improve the platform experience. Google Ads measurement on eligible pages is optional and only enabled when you grant marketing consent.

AI Provider Keys and Selected Content

If you configure the AI assistant, you may store your own provider API key with us. That key is encrypted at rest, and only the release or metadata content you explicitly select is sent through Stornar's server to the configured third-party AI provider to generate responses.

3. How We Use Your Information

Your information is used exclusively to:

Operate and maintain the Stornar platform
Authenticate your identity and secure your account
Communicate with Apple App Store Connect and Google Play Console APIs on your behalf
Sync and store your app store financial, review, and analytics data on a scheduled daily basis to power historical reports in your dashboard
Connect to your Google Ads and Apple Search Ads accounts to retrieve campaign performance data (spend, conversions, ROAS) for display in your dashboard
Improve our services based on anonymized usage data
Process AI assistant requests using your configured third-party provider when you explicitly invoke those features
Measure consented Google Ads campaign traffic on eligible pages
Send you essential service notifications and updates

🔒 We do not sell, rent, or broker your personal data. Third-party access is limited to the providers required to operate Stornar, ad network APIs you explicitly connect, and optional, consent-based Google Ads measurement on the Stornar website.

4. Data Security

We take the security of your data extremely seriously and employ industry-leading measures to protect it:

Encryption at Rest

All sensitive data, including API keys and credentials, is encrypted using AES-256 encryption.

Encryption in Transit

All data transmitted between your browser and our servers is protected with TLS 1.3 encryption.

Access Controls

Strict role-based access controls ensure that only authorized personnel can access system infrastructure.

Regular Audits

We conduct regular security audits and vulnerability assessments to maintain the highest security standards.

5. Third-Party Services

Stornar integrates with the following third-party services to provide core platform functionality and optional ads measurement:

Authentication Provider - We use a trusted authentication service to securely manage user sign-in and session management.
Apple App Store Connect API - To retrieve and manage your iOS app metadata, releases, and reviews, and to sync financial and analytics data for reporting.
Google Play Developer API - To retrieve and manage your Android app metadata, releases, and reviews, and to sync financial and analytics data for reporting.
Google Ads API (dashboard integration)- When you connect your Google Ads account, we use the Google Ads API to read your campaign performance data (spend, conversions, and ROAS) on your behalf. This connection uses OAuth and is entirely separate from the Google Ads tag used for Stornar's own website measurement described below.
Apple Search Ads API (dashboard integration) - When you connect your Apple Search Ads account, we use the Apple Search Ads API via OAuth to read your campaign performance data on your behalf.
Third-party AI providers - When you configure and use the release-manager AI assistant, selected content is sent to the provider you choose, such as OpenAI, using your stored key.
Google Ads / Google tag (website measurement)- On eligible stornar.com pages, and only when you grant marketing consent, we use Google's consent mode for ads measurement. Before consent, Google may receive denied-state cookieless consent and measurement pings on those eligible pages.

We do not sell personal data or share it with data brokers. Third-party access is limited to service providers required to operate the platform, ad network APIs you explicitly connect to your dashboard, and Google Ads website measurement that you explicitly enable through the cookie controls.

6. Google API Services User Data

Stornar’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Google user data Stornar accesses: When you connect your Google Play Console or Google Ads account, Stornar accesses data made available through the Google Play Developer API and the Google Ads API respectively. This includes app metadata, financial and acquisition reports, reviews, and campaign performance data (spend, conversions, ROAS) associated with accounts you own or control.

How Stornar uses Google user data: Google user data is used exclusively to provide and improve the features you requested within Stornar specifically, to display your app store data and campaign analytics in your dashboard and to power historical reports. Stornar does not use Google user data for any of the following purposes:

Targeted, personalized, or interest-based advertising
Selling to or sharing with data brokers or information resellers
Training artificial intelligence or machine learning models
Determining credit-worthiness or lending decisions
Any purpose unrelated to providing or improving Stornar’s core functionality

With whom Google user data is shared: Google user data is not transferred, sold, or disclosed to any third party. It is held within Stornar’s infrastructure solely on your behalf. No Google user data is shared with sub-processors beyond what is strictly necessary to operate the platform (for example, encrypted storage and authentication services), and those providers are contractually prohibited from using the data for any other purpose.

How Google user data is protected: All Google user data is encrypted at rest using AES-256 encryption and protected in transit using TLS 1.3. Access is restricted to authorised Stornar systems acting on your behalf. OAuth credentials (access and refresh tokens) used to connect to Google APIs are stored encrypted and revocable by you at any time from your dashboard.

7. Data Retention & Deletion

We retain your data only for as long as your account is active and as needed to provide you with our services. You may request deletion of your account and all associated data at any time.

Report data - financial records, download and acquisition data, subscription events, review history, and analytics data synced from Apple App Store Connect and Google Play Console - is stored for the lifetime of your account to support historical reporting. Ad network campaign data retrieved from Google Ads and Apple Search Ads is similarly retained for reporting purposes.

Ad network credentials(OAuth tokens for Google Ads and Apple Search Ads) are retained only while the integration remains connected. You may disconnect an ad network at any time from your dashboard, which revokes Stornar's access and removes the stored tokens.

Upon account deletion, we will permanently remove all personal data, app store credentials, ad network tokens, and all synced report data within 30 days. Anonymized, aggregated data that cannot be linked to you may be retained for service improvement purposes.

8. Cookies

Stornar uses essential cookies required for the platform to function properly and offers optional marketing cookies for Google Ads measurement on eligible pages. These include:

Session cookies - To maintain your authenticated session
Preference cookies - To remember your theme and display preferences
Consent preference cookie - To remember whether you accepted or rejected marketing cookies
Marketing cookies - If you accept marketing cookies, Google Ads may store advertising-related cookies on eligible pages for campaign measurement

On eligible pages, Google Consent Mode may send denied-state, cookieless consent or measurement pings before you opt in. No advertising cookies are written until you grant marketing consent, and you can revisit your choice at any time through the Manage Cookies control in the site footer.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Right to Access

Request a copy of the personal data we hold about you.

Right to Rectification

Request correction of any inaccurate or incomplete personal data.

Right to Deletion

Request the deletion of your personal data and account.

Right to Data Portability

Request your data in a structured, machine-readable format.

Right to Object

Object to the processing of your personal data in certain circumstances.

Right to Withdraw Consent

Withdraw consent at any time where we rely on consent for processing.

To exercise any of these rights, please contact us at the email address provided below. We will respond to your request within 30 days.

10. Children's Privacy

Stornar is not directed at individuals under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete such information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. For material changes, we will notify you via email or a prominent notice on the platform prior to the changes taking effect. We encourage you to review this page periodically for the latest information on our privacy practices.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: [email protected]