You can connect an App Store Connect API key or Google Play access to AppForShare. When you do, AppForShare acts as your service provider and uses that access only on your behalf, only for the apps you choose, and only for the actions you or people you authorize start in AppForShare. We keep the key confidential, encrypted, and never share it, and we hold ourselves to terms at least as protective of Apple and Google as your own agreements with them. You stay responsible for your developer accounts and for what is done with them, including by people you invite.
While an app is shared, AppForShare checks its release status on a schedule. For Apple apps it also adds a webhook named "AppForShare release status" to that app in App Store Connect, so Apple can tell us about review and build changes, and removes it when you stop sharing the app or disconnect. These checks only read; they do not change your listings or releases.
AppForShare also collects the customer reviews of shared apps. A reply is posted to the store only when a person in your workspace presses Post reply, never by AI on its own, and it appears publicly under the review. You are responsible for what your replies say and for following Apple's and Google's rules for review responses.
If you link a tester group to a TestFlight group, AppForShare adds the group's members to that TestFlight group with their email address and name, and takes out the ones it added when they leave your group, until you stop syncing. Testers someone added in App Store Connect are not removed. A build is given to the group, or submitted for TestFlight beta review, only when a person in your workspace presses the button, or when an Admin asked for it on that build's Send to TestFlight (then it is done once Apple has processed the build). You are responsible for having your testers' permission to share their email address with Apple.
A device is registered on your Apple developer account, and an ad hoc or development profile is made again, only when a person in your workspace presses the button. Apple limits how many devices each account can register per membership year and does not give a slot back when a device is disabled; that use cannot be undone by AppForShare. Remaking a profile replaces the old one in your account.
AppForShare does not re-sign the .apk files you upload, and never re-signs a build for the App Store. On Pro and Team, an iOS build you uploaded is re-signed with a provisioning profile only when a person in your workspace asks for it, or, on Team, when an Admin turned on Hands free for that project and it has no GitHub build. The re-signed build is saved as a new build; the build you uploaded is not changed. Re-signing uses the signing certificate and password an Owner or Admin of your workspace adds. You confirm you may use that certificate and the profiles you choose. AppForShare uses the certificate only to re-sign your own workspace's builds, never shares it, and deletes it at once when it is removed.
An .aab you upload is turned into one APK for testers with Google's bundletool and signed by AppForShare: with a test key AppForShare makes for your workspace, or, on Pro and Team, with the upload keystore an Admin of your workspace adds. You confirm you may use that keystore. An APK signed with the test key cannot update the app installed from Google Play. AppForShare uses your keystore only to sign APKs made from your own .aab uploads, never shares it, and deletes it at once when it is removed.
App Store listing text and screenshots are changed, a language is added or a new version is started only when a person in your workspace saves or presses the button. Changes to a version being prepared reach the App Store after Apple's review; a new promotional text on the live version shows at once. AI translations are suggestions: you are responsible for what your listing says, in every language, and for following Apple's rules for it.
An App Store version is sent for review, taken out of review, released or has its phased release changed only when an Admin of your workspace presses the button, with your own App Store Connect key and in the name of your Apple developer account; we keep who did it. AppForShare never sends a version on its own and does not submit apps on your behalf. You answer Apple's questions (export compliance, App Review contact and sign in details) and you are responsible for the answers, for the app and for following the App Store Review Guidelines and your agreements with Apple. Apple decides on every review.
Google Play listing text and graphics are changed, or a language is added or removed, only when an Admin of your workspace saves or presses the button. Google Play has no draft version, so each change is committed to your Google Play account at once, goes to Google's review and then shows on Google Play. AppForShare does not cancel changes that are already in review. You are responsible for what your listing says and shows, in every language, and for following Google Play's policies for it.
On the Google Play releases page, release notes, promotions between tracks, rollout percentages, halting, resuming and completing a rollout, and the testers of a track change only when an Admin of your workspace confirms the change. Each one is committed to your Google Play account at once with your connection. AppForShare never rolls out, halts or completes a release on its own and does not watch your app's quality data. You decide how and when your app reaches users, and the results of a release are yours.
GitHub builds run only in repositories where your workspace installed the AppForShare Builds app, on that repository's own GitHub Actions minutes, under your GitHub account's terms and billing. When an Admin of your workspace sets up a repository, the App Store Connect key they pick and an upload token are stored as encrypted Actions secrets in that repository; anyone who can change its workflows can use them, so set it up only in repositories you trust. AppForShare proposes the workflow in a pull request and never pushes to your branches or merges; it starts a build only when a person presses the button, and removes the secrets and revokes the token when the setup is removed. With signing by your own certificate, AppForShare reads the provisioning profile of the app from Apple before each build with your key, makes one when none exists, and stores it as an Actions secret. For Android, only an upload token is stored in the repository; your upload keystore stays in secrets you add yourself, and AppForShare does not receive it. When an Android build goes to Google Play, the run uploads the app bundle straight to Google Play into an edit AppForShare opens with your workspace's Google Play connection, and AppForShare releases it on the track you picked; a production release is always left as a draft for you to roll out. Setups made before 1 November 2026 send the bundle through AppForShare, which does not keep it after it is handed to Google Play. You are responsible for your code, the workflow and what it builds.
Create keys with the least access you need, never with the Admin role. If you connect your account to someone else's workspace through an invite link, they can use it for the apps you shared until you disconnect. Disconnecting deletes the key from AppForShare at once; revoking the key itself is done in App Store Connect or Play Console. Apple and Google can change or limit their APIs at any time, and we are not responsible for what their services do or refuse.