Privacy

Last updated 2 September 2026

XToGo has nothing to sign up for and no analytics. It is a client that talks to Apple's App Store Connect API on your behalf, using a key you provide, from your device. What syncs between your devices goes through your own iCloud account and Apple's infrastructure.

There is one exception, and it is the only reason XToGo has a server at all: build notifications. The app cannot watch a build while it is closed, so if you switch notifications on, a copy of your App Store Connect key is sent to that server so it can watch on your behalf. Switch them off and the copy is deleted. Everything below says exactly what that means; if you never turn notifications on, no key and no build data ever leaves your device.

What XToGo stores, and where

Your App Store Connect API key

To reach Xcode Cloud, XToGo needs an App Store Connect API key: an issuer ID, a key ID, and an ES256 private key (the .p8 file Apple gives you). When you add an account, the private key is written to the Keychain and read back only to sign a request. It is never sent to Apple's API — only the short-lived tokens signed with it leave the device. Unless you switch on build notifications, it is never sent anywhere else either; see Build notifications.

The key is stored as a synchronising Keychain item. If you use iCloud Keychain, that means it reaches your other Apple devices the same way your saved passwords do — end-to-end encrypted by Apple, who cannot read it — and it is included in your encrypted device backups. If iCloud Keychain is off, the key stays on the device you added it to.

The non-secret half of an account — the name you gave it, the issuer ID and the key ID — is kept in the app's own storage so the list survives a relaunch, and written to iCloud's key-value store so your other devices see the same accounts. That store holds no private keys and no build data. It is part of your iCloud account and is governed by Apple's terms for it.

Removing an account deletes its key from the Keychain and takes it out of the synced account list, on that device and the others.

Your build data

Products, workflows, build runs, issues, test results and commit details are fetched from Apple when a screen needs them and held in memory for as long as that screen is on screen. XToGo keeps no database, writes no cache of them to disk, and syncs none of them to iCloud.

Artifacts you download

Log bundles and other artifacts you choose to download are written to the system temporary directory so the app can unzip them and hand them to a share sheet. The system clears that directory on its own schedule, and deleting the app removes them immediately.

Build notifications

Build notifications are part of XToGo Pro and are off until you turn them on. They exist because the app cannot notice a build finishing while it is closed: Xcode Cloud has no way to push, and an app that is not running cannot ask. Something has to stay awake and check, and that something is a server.

Turning notifications on therefore uploads a copy of the App Store Connect private key for each account in your list to that server, so it can sign its own requests to Apple in the same way the app does. This is the only circumstance in which a key leaves your device, and there is no way to have notifications without it. The screen that switches them on says so.

The copy is encrypted with AES-256-GCM under a key held in Google Secret Manager, separate from the database, so a database copy on its own cannot be read. It is deleted when you switch notifications off, when you remove that account from XToGo, when your Pro subscription lapses, and when Apple reports the device as gone.

Alongside it the server keeps: an APNs device token, a random identifier and secret generated on your device, your time zone (quiet hours are meaningless without it), your language, the app version, your notification settings, and the last state it saw each of your builds in. There is no account, no email address and no name — nothing on that server identifies a person. Reinstalling XToGo produces a new identifier, and the old record expires.

Proof that you are a Pro subscriber is a signed transaction from StoreKit, which the server verifies against Apple's certificate chain. It never sees your Apple Account.

The server runs on Google Cloud (Firebase Cloud Functions and Firestore, in the EU) and sends notifications through Apple's Push Notification service. Their handling of that data is governed by Google's terms and Apple's privacy policy. Its source is in the Firebase/ directory of XToGo's repository.

With notifications off, none of this applies: nothing is uploaded, and the server holds no record of you at all.

What XToGo sends, and to whom

With build notifications off, every network request XToGo makes itself goes to one of two hosts, both operated by Apple:

• api.appstoreconnect.apple.com — the App Store Connect API, for everything the app shows, and for starting a build when you ask it to.
• is1-ssl.mzstatic.com — Apple's content delivery network, to load the app icons shown beside your products.

Artifact downloads follow the download URL that Apple's API returns for that artifact. Separately, iCloud syncing is performed by the operating system on XToGo's behalf; the app hands data to the system's Keychain and key-value store and does not talk to iCloud directly.

Requests to Apple are authenticated with a JSON Web Token that XToGo signs on your device with CryptoKit, valid for a few minutes at a time. Your use of the App Store Connect API is subject to Apple's privacy policy.

With build notifications on, XToGo additionally talks to europe-west1-xtogo-9d385.cloudfunctions.net — the notification server described above — to register the device, to keep your settings in step, and to hand over the keys it needs.

What XToGo does not do

• No sign-up, and no account with us. iCloud syncing uses the Apple Account already signed in on your device.
• No analytics, crash reporting, attribution or advertising SDKs. There are no third-party frameworks in the shipped app.
• No tracking as the App Store's privacy questionnaire defines it, and no data shared with data brokers.
• Nothing leaves your device for the notification server unless you switch build notifications on, and nothing that does identifies you.
• No server of ours sits between you and Apple for anything you read in the app. Every screen, log line and artifact is fetched by your device, signed by your device.

App Logs

XToGo keeps a short record of what it did — permission answers, whether a push token arrived, whether the server accepted a registration — under Settings → App Logs. It lives on your device, is capped at a couple of thousand lines, and is not sent anywhere. Nothing secret goes into it: private keys are never written, and device tokens and identifiers are shortened to a few characters, enough to match against a server log and not enough to use.

Exporting it is yours to do and yours to send. If you attach it to a problem report, everything in it goes wherever you send it — which is why it is built to contain nothing you would mind sharing.

Demo mode

The sample data you see before adding a key is bundled with the app and generated on device. Demo mode makes no network requests at all.

Turning syncing off

Both kinds of syncing are yours to control in system settings: iCloud Keychain governs the private key, and iCloud Drive's app data governs the account list. Switch either off and XToGo keeps working with what is on that device.

The notification server is controlled by the switch in Settings → Notifications. Turning it off deletes everything that server holds about you, including the uploaded keys.

Children

XToGo is a developer tool. It is not directed at children and collects no personal information from anyone.

Changes

If this policy changes, the updated version will be posted here with a new date above. Material changes will also be noted in the app's release notes.

Contact

Questions about this policy: use the contact form, or reach me on X.