Your data, in plain words.
On asoon.app your data lives in ASOon's hosted database, with any Apple or API credentials encrypted at rest. Your keyword data is yours to export, and your ASOon account data is yours to delete. This page lists exactly what's stored and what each connection sends — nothing more. Prefer full control? You can also self-host and keep everything in your own infrastructure.
Where your data lives
Everything ASOon tracks — your apps, keywords, rank history, ratings, chart positions, downloads, alerts, action plans, and experiments — is stored in ASOon's hosted database, tied to your account. It's yours: export a keyword CSV snapshot or delete your ASOon account data (below), anytime.
Any API credentials you add in Settings are encrypted at rest (AES-256-GCM), scoped to your account, and never shown back to the browser beyond their last 4 characters. Passwords are scrypt-hashed, never stored in plain text.
Rather run it yourself? ASOon is local-first by design — self-host it (your own Vercel + Turso, or a local asoon.db SQLite file) and every byte lives in your infrastructure, never ours.
What each connection sends
Ranks, reviews, metadata, and charts come from Apple's public, no-login endpoints. The connections below are optional and off until you turn them on.
Apple public endpoints (App Store search, iTunes Lookup, reviews, top charts)
The keyword terms and app ids you track — the same requests a browser makes on apps.apple.com. No account, no credentials.
Always — this is how ranks, metadata, reviews, and charts are measured.
Google Gemini (AI features)
Your app's name, listing text, review excerpts, or screenshots — only for the AI feature you invoke (briefings, metadata drafts, reply drafts, creative diagnosis). Never your account, password, or billing details.
Included — sent only when you click an AI action. (Self-host: point it at any provider, or local Ollama, so nothing leaves your machine.)
App Store Connect
Your ASC API credentials (stored encrypted) → Apple, to pull your own daily download reports.
Only if you connect your Apple account in Settings (Pro).
Apple Search Ads
Your tracked keyword terms + your ASA credentials → Apple, for official popularity numbers.
Only if you connect your Apple account in Settings (Pro).
Stripe
Your email and payment details (entered on Stripe's own pages — ASOon never sees your card number).
Only if you subscribe to Pro.
Cookies & account
ASOon itself sets a single httpOnly session cookie (a signed token) to keep you logged in.
To understand how the marketing site is used we run Simple Analytics — a privacy-first, cookieless service that stores no personal data — and Google Analytics (via Google Tag Manager), which sets cookies. Google Analytics stays off until you accept in the cookie banner (Consent Mode v2), and you can change your choice any time via . Your ASOon account and tracked App Store data are separate and are never sent to these tools.
Passwords are hashed with scrypt and never stored in plain text. Password-reset tokens are single-use, expire after an hour, and only their hash is stored.
Export & deletion — honestly
Export today: your keyword data — per app or all apps — as a CSV snapshot (rank, change, popularity, difficulty, tags). Rank history time-series, reviews, and downloads are not exportable yet, and we won't pretend otherwise.
Deletion: deleting an app removes it and its keywords/history immediately. To erase your whole account, open Profile → Request account deletion — it permanently removes your apps, keywords, history, alerts, and settings in one step, no email required. If you subscribed to Pro, cancel in the Stripe billing portal before deletion so billing stops too. Prefer a hand? Write kirylapps@gmail.com and it's handled within one business day. (Self-hosting? Dropping asoon.db deletes everything.)
Questions about a data flow? The full security model is documented in the repo's SECURITY.md.
