Privacy Policy

AppForShare (appforshare.io) lets developers upload iOS and Android builds and share them through an install link and QR code. It is operated by ZenTalk LLC, Houston, Texas, United States ("we", "us"). ZenTalk LLC is the controller of the personal data described here.

Questions about this policy or your data: [email protected].

Account details. Your name, email address, a hashed password if you set one, your country if you give it, a profile picture if your account had one on the earlier version of AppForShare, and whether your email is verified. Admin accounts also store an encrypted two step verification key.

Sign in with Google or GitHub. If you use these, we receive your name, email address and the account ID the provider gives us. Details are in section 3.

Builds you upload. The IPA or APK file and what we read from it: app name, bundle or package ID, version, icon, minimum OS, file size, and for iOS ad hoc builds the device IDs listed in the provisioning profile. Plus anything you add, such as release notes, project names and a link password (stored hashed).

Installs and page views. When someone opens an install page or installs a build we record the date, device type, OS version, device model when the device reports it, the country, and a one way hash of the IP address. We do not keep the raw IP address for these records. Build owners see these counts in their analytics.

Device IDs (UDID). If you use our UDID tool on an iPhone or iPad, the device sends its UDID, model, iOS version, device name, and where it has them its serial number, IMEI, ICCID and Wi-Fi MAC address. We show the result to you and delete it after one day unless you save the device to your account, where it stays until you remove it.

Teams and testers. Email addresses (and names, if given) of team members and testers you invite, their role, and when a tester last opened a private install page.

Client projects. If a workspace adds you as a client, we keep the email address (and name and company, if the workspace gives them), when you signed in to the client portal with the IP address and browser of each sign in link and session, the feedback you post, and an activity log of the project. Files a workspace delivers are stored with their SHA-256. A workspace can remove you at any time, and the data goes when the workspace deletes its account.

Signatures. When you sign an agreement or a sign-off in the client portal, we keep the signed text, the name (and company and job title, if asked) and the signature you drew or typed, the email address your sign in link proved, your IP address, browser and the time, and the signed PDF, which is emailed to you and to the workspace. This record stays with the workspace even if a signature is later revoked, and goes when the workspace deletes its account. Anyone who has a copy of a signed PDF can check it on our verify page; the page shows the document title, the workspace, the signer's name, the date and whether it was revoked, never the text, email address or IP address. The file you check there is not uploaded: only its SHA-256 is sent.

Free tools in your browser. The IPA inspector, the APK analyzer and the app icon generator read your file in your browser. It is not uploaded and we do not see it, unless you choose to share the build, which uploads it like any other build.

Integrations. Slack, Discord or other webhook URLs you add, stored encrypted, and a 30 day record of delivery results. API tokens you create are stored hashed.

Store connections. If you connect App Store Connect or Google Play, we keep the API key or service account key you upload, encrypted with a key held in Google Cloud KMS and never shown again, the key ID and issuer ID, the apps you chose to share, and a log of every call we make to Apple or Google with it. If you use our Google service account instead of a key, we keep its email address. We read only what the features you use need, such as app names, build and review status, and customer reviews. Disconnecting deletes the key at once.

Payments. Stripe handles card details; we never see or store your full card number. We keep your plan, subscription status, Stripe customer ID, invoice amounts and dates.

Messages and reports. What you send through the contact form or a "Report this app" form, with your email if you give it and a hash of your IP address.

Technical data. For each signed in session, the IP address and browser user agent, so you can see where you are signed in and so we can spot account abuse. Our servers also keep short lived request logs.

When you choose "Continue with Google" we ask Google only for the basic scopes openid, email and profile. We use them for one purpose: to create your AppForShare account or sign you in to it. We store your Google account ID, name and email address. We do not request access to Gmail, Drive, Contacts or any other Google data.

We do not sell Google user data, use it for advertising, use it to train AI or machine learning models, or share it with anyone except as needed to run the service (section 5) or to comply with the law. AppForShare's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

GitHub sign in works the same way: we read your GitHub user ID, name and primary verified email, and nothing from your repositories.

You can unlink either provider by deleting your account (section 9), or revoke our access at any time from your Google or GitHub account settings.

• To run the service: store and process your builds, serve install links, show analytics, run teams, testers and integrations (performance of our contract with you).
• To bill paid plans and keep tax and accounting records (contract and legal obligation).
• To send service email: email verification, password resets, receipts, usage alerts, and notices about your builds or account (contract).
• To keep AppForShare safe: rate limits, bot checks, reviewing abuse reports and removing malware or infringing apps (legitimate interest).
• To answer your messages (legitimate interest, or contract if you are a customer).

We do not sell personal data, we do not show ads, and we do not use third party advertising or tracking cookies.

People you share with. Anyone with an install link can see the app name, icon, version and release notes, unless the link is password protected or limited to invited testers. Team members see the workspace's builds and analytics.

Service providers who process data for us under contract:

• Google Cloud: servers, database and file storage.
• Cloudflare: network delivery, security and the Turnstile bot check.
• Stripe: payments and invoices.
• Twilio SendGrid: sending email.
• Google and GitHub: sign in, only if you use them.
• Google Gemini API: AI features, only when you start one (for example a fix plan). We send build details such as the app name, version and check results, never the app file. Google does not use this data to train its models.

Destinations you choose. Build events, and store release events if you pick them, go to the Slack, Discord or webhook URLs you add.

Apple and Google stores. When you connect a store, we call the App Store Connect API or the Google Play Developer API with your key, only for your account and the apps you shared. If you connected through another workspace's invite link, that workspace sees the shared apps and the activity log, and you can disconnect at any time. For shared Apple apps, App Store Connect sends review and build notifications to AppForShare. We keep the latest release status of each shared app and a history of its changes until the connection is removed. We also keep the customer reviews of shared apps (the reviewer's public nickname, rating, text, country or language, app version and device as the store gives them) and your replies, until the app is unshared or the connection is removed. When you ask for an AI reply draft, the review text and your reply notes are sent to Google Gemini.

Legal. We may disclose data if the law requires it, to answer valid legal process, or to protect our users and the service. If AppForShare is sold or merged, data moves with it under this policy.

• Account data: while your account is open. When you delete it we remove your personal details and builds; a record without personal details stays so we can keep billing history.
• Builds: until you delete them or the link expires (3 days for uploads without an account, 7 days on Free, while subscribed on paid plans). Files are then removed after a 7 day grace period.
• Install and page view analytics: 13 months.
• UDID lookups: 1 day unless you save the device.
• Sessions: 30 days after last use. Verification and password reset links: deleted 1 day after they expire.
• Webhook delivery records: 30 days.
• Payment records: as long as tax law requires.
• Contact messages and abuse reports: as long as needed to handle them and keep the service safe.

We only use cookies the service needs to work:

• A session cookie that keeps you signed in (30 days).
• A short cookie, about 10 minutes, that protects Google and GitHub sign in from forgery.
• A cookie that lets an invited tester open private install pages.

Your light or dark theme choice is saved in your browser's local storage. Cloudflare may set its own security cookies. We use no advertising or third party analytics cookies, so there is no cookie banner.

Data travels over HTTPS. Passwords, API tokens and link passwords are stored hashed; webhook URLs and admin verification keys are encrypted. Admin access requires two step verification and is logged. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

You can edit your details, delete builds, remove testers and integrations, and cancel your plan from your dashboard.

Depending on where you live (for example the EU, UK or California) you may have the right to access, correct, delete or export your data, to object to or restrict some uses, and to withdraw consent. To use any of these rights, or to delete your account, email [email protected] from the address on your account. We answer within 30 days. We do not treat you differently for using these rights. You may also complain to your local data protection authority.

We are based in the United States and our servers are in the United States. If you use AppForShare from elsewhere, your data is transferred there. Where the law requires it we rely on Standard Contractual Clauses or equivalent safeguards with our providers.

AppForShare is a tool for developers and is not meant for children. You must be at least 13 (16 in the EEA and UK) to create an account. If you believe a child has given us personal data, email [email protected] and we will delete it.

If we change this policy we will update the date above, and for significant changes we will email account holders before they take effect. Questions or requests: [email protected], or ZenTalk LLC, Houston, Texas, United States.