XToGo

Privacy

Last updated 7 September 2026 — covers App CI, App Reviews and App Finances

One policy for the three XToGo apps, because they work the same way. None of them has anything to sign up for and none of them has analytics. Each is a client that talks to Apple's App Store Connect API on your behalf, using a key you provide, from your device. What syncs between your devices goes through your own iCloud account and Apple's infrastructure.

There is one exception, and it is the only reason any of these apps has a server at all: App CI's build notifications. An app cannot watch a build while it is closed, so if you switch notifications on, a copy of your App Store Connect key is sent to that server so it can watch on your behalf. Switch them off and the copy is deleted. Everything below says exactly what that means; if you never turn notifications on, no key and no data about your apps ever leaves your device except to Apple.

Where a section applies to only one of the three, it says so. Everything else is true of all of them.

What the apps store, and where

Your App Store Connect API key

To reach App Store Connect, these apps need an App Store Connect API key: an issuer ID, a key ID, and an ES256 private key (the .p8 file Apple gives you). When you add an account, the private key is written to the Keychain and read back only to sign a request. It is never sent to Apple's API — only the short-lived tokens signed with it leave the device. Unless you switch on App CI's build notifications, it is never sent anywhere else either; see Build notifications.

The three apps deliberately share one key and one account list. They store them in a place all three can read, so that a team added in any one of them is signed in to the others without you typing anything twice. That sharing happens on your device, between apps you installed yourself; nothing about it involves a server of ours.

The key is stored as a synchronising Keychain item. If you use iCloud Keychain, that means it reaches your other Apple devices the same way your saved passwords do — end-to-end encrypted by Apple, who cannot read it — and it is included in your encrypted device backups. If iCloud Keychain is off, the key stays on the device you added it to.

The non-secret half of an account — the name you gave it, the issuer ID and the key ID — is kept in shared app storage so the list survives a relaunch, and written to iCloud's key-value store so your other devices see the same accounts. App Finances also keeps each team's vendor number and your chosen display currency there, since it would otherwise ask for them again on every device. That store holds no private keys. It is part of your iCloud account and is governed by Apple's terms for it.

Removing an account deletes its key from the Keychain and takes it out of the synced account list, on that device and the others — and therefore out of all three apps at once.

What each app fetches about your apps

App CI fetches products, workflows, build runs, issues, test results and commit details when a screen needs them and holds them in memory for as long as that screen is on screen. It keeps no database, writes no cache of them to disk, and syncs none of them to iCloud.

App Reviews and App Finances do keep a cache on the device, and for the same reason: reviews are fetched a page at a time up to a thousand per app, and a day's sales report never changes once Apple has published it, so re-downloading them on every launch would be slow and would hammer your account's rate limit for nothing. That cache holds reviews and sales figures for the teams you added, is written to the app's own storage, is never synced to iCloud and never sent anywhere. Deleting the app removes it. Removing an account removes its part of it.

What you type

App Reviews keeps your saved replies and the list of reviews you chose to ignore in the app's own storage on the device. A reply you send is a different matter, and is covered under Replies you post.

Artifacts you download

In App CI, log bundles and other artifacts you choose to download are written to the system temporary directory so the app can unzip them and hand them to a share sheet. The system clears that directory on its own schedule, and deleting the app removes them immediately.

Replies you post — App Reviews

A reply you write in App Reviews is sent to Apple and, once Apple has reviewed it, published publicly on the App Store under your developer name, beside the review it answers. That is what a developer response is, and it is the same reply you would have written in App Store Connect. Editing it replaces the published one; deleting it removes it. Nothing about the reply is kept by us, and it does not pass through any server of ours.

Translation — App Reviews

When you translate a review, the app hands its text to the system's own translation service, which does the work on the device. The system may download the language it needs from Apple the first time. The review text is not sent to us and not sent to any third party of ours; Apple's handling of it is covered by Apple's privacy policy.

Build notifications — App CI

Build notifications are part of App CI Pro and are off until you turn them on. They exist because the app cannot notice a build finishing while it is closed: Xcode Cloud has no way to push, and an app that is not running cannot ask. Something has to stay awake and check, and that something is a server. Neither App Reviews nor App Finances has one.

Turning notifications on therefore uploads a copy of the App Store Connect private key for each account in your list to that server, so it can sign its own requests to Apple in the same way the app does. This is the only circumstance in which a key leaves your device, and there is no way to have notifications without it. The screen that switches them on says so.

The copy is encrypted with AES-256-GCM under a key held in Google Secret Manager, separate from the database, so a database copy on its own cannot be read. It is deleted when you switch notifications off, when you remove that account from App CI, when your Pro subscription lapses, and when Apple reports the device as gone.

Alongside it the server keeps: an APNs device token, a random identifier and secret generated on your device, your time zone (quiet hours are meaningless without it), your language, the app version, your notification settings, and the last state it saw each of your builds in. There is no account, no email address and no name — nothing on that server identifies a person. Reinstalling App CI produces a new identifier, and the old record expires.

Proof that you are a Pro subscriber is a signed transaction from StoreKit, which the server verifies against Apple's certificate chain. It never sees your Apple Account.

The server runs on Google Cloud (Firebase Cloud Functions and Firestore, in the EU) and sends notifications through Apple's Push Notification service. Their handling of that data is governed by Google's terms and Apple's privacy policy. Its source is in the Firebase/ directory of App CI's repository.

With notifications off, none of this applies: nothing is uploaded, and the server holds no record of you at all.

What the apps send, and to whom

With App CI's build notifications off, every network request any of these apps makes goes to one of the hosts below. All but one are operated by Apple.

Artifact downloads in App CI follow the download URL that Apple's API returns for that artifact. Separately, iCloud syncing is performed by the operating system on the apps' behalf; they hand data to the system's Keychain and key-value store and do not talk to iCloud directly.

Requests to Apple are authenticated with a JSON Web Token signed on your device with CryptoKit, valid for a few minutes at a time. Your use of the App Store Connect API is subject to Apple's privacy policy.

What these apps do not do

App Logs — App CI

App CI keeps a short record of what it did — permission answers, whether a push token arrived, whether the server accepted a registration — under Settings → App Logs. It lives on your device, is capped at a couple of thousand lines, and is not sent anywhere. Nothing secret goes into it: private keys are never written, and device tokens and identifiers are shortened to a few characters, enough to match against a server log and not enough to use.

Exporting it is yours to do and yours to send. If you attach it to a problem report, everything in it goes wherever you send it — which is why it is built to contain nothing you would mind sharing.

Demo mode

The sample data you see before adding a key is bundled with each app and generated on the device. Demo mode makes no network requests at all — in any of the three.

Turning syncing off

Both kinds of syncing are yours to control in system settings: iCloud Keychain governs the private key, and iCloud Drive's app data governs the account list. Switch either off and the apps keep working with what is on that device.

The notification server is controlled by the switch in App CI's Settings → Notifications. Turning it off deletes everything that server holds about you, including the uploaded keys.

Children

These are developer tools. They are not directed at children and collect no personal information from anyone.

Changes

If this policy changes, the updated version will be posted here with a new date above. Material changes will also be noted in the affected app's release notes.

Contact

Questions about this policy: use the contact form, or reach me on X.