Privacy Policy

Last updated: October 9, 2026

What we collect

When you purchase a Pro license, we store:

• Your email address (from the checkout provider)
• A generated license key
• Your subscription ID (for managing renewals and cancellations)
• If you later use asc_start_trial to fetch your paid key onto a machine, the same one-way fingerprint described below, recorded once so that a second person who knows your email address cannot read your key out of the API

When you start a free 7-day trial with the asc_start_trial tool, we store:

• The email address you give the tool, so we can send you the key
• A generated license key and its expiry date
• A one-way SHA-256 fingerprint of your App Store Connect Issuer ID (see below)
• The name of the tool you were trying to use when you started the trial, if any
• The date the record was created, and the date each of the emails described below was sent, so that none is sent twice

If you unsubscribe from our emails, we store the time you did, on the same record, so that the instruction is kept. It stays as long as the record does, and deleting the record deletes it too.

Using the free tier, or using Pro once your key is set, stores nothing with us. The server runs locally on your machine, and what it keeps there is listed under What is saved on your own machine.

The trial fingerprint, specifically

A trial gives away paid software, so we need to know that one person cannot take an unlimited number of them. The anchor we use is your App Store Connect Issuer ID, because it identifies an Apple developer account rather than a person.

Your Issuer ID is not sent to us. It is hashed with SHA-256 on your own machine and only the resulting digest is transmitted. It is sent only when you call asc_start_trial, whether that is to begin a trial or to fetch a paid key onto a new machine, so a subscriber who never trialled can still have one recorded. It is never sent on startup and never sent during normal use of any other tool.

The digest cannot be turned back into your Issuer ID by anyone who obtains it. It is not anonymous, though: the hashing recipe is public in our open-source code, so somebody who already knows a specific Issuer ID could confirm a digest matches it. We treat it as pseudonymous personal data, and everything below applies to it.

What we don't collect

• Your .p8 private key never leaves your machine. It signs a short-lived token there; that token names your Key ID and Issuer ID and goes to Apple only. None of them is sent to us, and your Issuer ID reaches us only as the one-way digest described above, only when you call asc_start_trial
• No App Store Connect data passes through our servers
• No usage analytics or telemetry from the software. The MCP server does not report which tools you run, or when, or how often, apart from the one tool name a trial request may carry, listed above. Our marketing site does count page views, in the aggregate form described below
• No cookies, no advertising identifiers, no third-party trackers

How your data flows

The MCP server runs locally. It talks directly to Apple's API from your computer. It makes exactly two kinds of call to our infrastructure, both of which you control:

• A license key validation check, sending only the license key string. This happens on startup when you have a key set, and the result is cached for 24 hours.
• A trial request, sending the email you provided, the one-way fingerprint, and the tool name. This happens only when you call asc_start_trial.

Separately, when you click a subscribe link from inside your agent, it passes through a redirect on our server that increments a daily counter of the form "3 people clicked the buy link from the submit_for_review tool today". That counter holds a date, a tool name and a number. It records no identifier, no IP address, no user agent, and nothing that could be tied back to you. Your browser's user agent string is read at the moment of the request, and only to tell a crawler apart from a person so that the two are counted separately; it is not stored. A link we email you may carry your address in it as a checkout prefill, so you do not have to retype it; that value is passed to the checkout and is not written to the counter.

Our marketing site counts page views the same way. Each page asks our own server to add one to a daily count of the form "12 views of the home page today". The only thing the page puts in that request is the path you are on. It is an ordinary web request, so it also carries what your browser attaches to every request it makes, including your IP address and your user agent; we read the user agent and the browser's prefetch headers at that moment, for the same reason as above, to count a crawler separately from a person. Neither is stored, and neither reaches the counter. What is written down is a date, a page name and a number: no cookie, no local storage, no advertising or device identifier, and no third-party analytics service. The stored count cannot distinguish you from any other visitor, or one of your visits from the next, and there is nothing in it to link back to a licence, a trial or an email address.

What is saved on your own machine

None of this is sent to us. It is listed so you know what the software leaves on your disk.

• ~/.asc-mcp/license.json: your licence key, in plain text, written when you call asc_start_trial to start a trial or to fetch a paid key. On macOS and Linux it is given owner-only permissions. It is read on startup when no ASC_LICENSE_KEY is set in your client. Delete the file to remove it.
• ~/.asc-mcp/preview.json: one number, how many of the 5 free preview calls to Pro read tools have been used on this machine.
• ~/.asc-mcp/last-verdict.json: the result of the last successful Pro licence check and a SHA-256 hash of the key, not the key, so a paid licence keeps working for up to 14 days if our server cannot be reached.
• Your MCP client configs: the same call adds the key as ASC_LICENSE_KEY to every asc-mcp entry it finds in the Claude Desktop config, ~/.claude.json (including per-project entries), .mcp.json in the current folder, and the Cursor, Windsurf and Cline configs. It changes nothing else in those files and does not touch a file that has no asc-mcp entry. The first time it edits a file it leaves a copy of the original beside it, named with .bak. That copy holds whatever the file held, including settings for your other servers.

Deleting your record at /delete removes it from our database. It cannot reach your machine: remove the file and the ASC_LICENSE_KEY lines yourself.

Data storage

License data is stored on Cloudflare D1 (EU region). Cloudflare acts as our infrastructure provider under their Data Processing Agreement.

Email delivery

Licence keys, a reminder shortly before a trial ends and one note shortly after it, deletion confirmation links and the occasional product notice are sent through Brevo, a French email provider acting as our processor under their data processing agreement. They receive your email address and the message, and they keep their own delivery records for it.

Payment processing

Payments are handled by Polar.sh, who acts as Merchant of Record. We never see your credit card details. Polar's privacy policy applies to the checkout process.

Data retention

We keep your email, license key and subscription id for as long as the record exists, including after a subscription is cancelled or a trial ends. Two honest reasons: a cancelled subscriber who resubscribes should get their history back rather than a support ticket, and deleting a finished trial record is the same as handing out a second free trial.

The counters described above, the buy-link clicks and the page views, and a third of the same shape that counts trials started per tool per day, are kept indefinitely, because a date, a page or tool name and a number are not about anyone and there is nothing in them to delete.

You can delete all of it whenever you like at /delete. We email you a confirmation link first, so that nobody can remove your license by typing your address into a form, and the deletion runs when you click it. This is the only deletion mechanism: there is no automatic purge on a timer, and we would rather say so than publish a promise no code keeps.

Who controls this data

The data controller is Povilas Konopackas, sole trader, Lithuania, reachable at povkonop@gmail.com.

Why we are allowed to hold it

• Your email, licence key and subscription id, for a paid subscription: performance of the contract you entered into when you subscribed (GDPR Article 6(1)(b)). We cannot deliver or validate a licence without them.
• Your email and licence key, for a free trial: taking steps at your request before entering a contract (Article 6(1)(b)).
• The one-way Issuer ID fingerprint: our legitimate interest in not giving the same person an unlimited number of free trials, and in not reading a paying customer's key out to a stranger who guessed their email address (Article 6(1)(f)). We considered doing this with the email alone and rejected it, because that would let anyone burn a stranger's trial by typing their address.
• The user agent, prefetch headers and IP address that reach our server while a page view or a buy-link click is being counted: our legitimate interest in knowing how many real people arrive, and in keeping automated traffic out of a payment funnel (Article 6(1)(f)). None of it is stored, and what is stored is a count that identifies nobody.
• An email to someone who has started a trial or held a subscription, about that product: our legitimate interest in asking a small number of our own users what they thought and whether they want to continue (Article 6(1)(f)). For a trial that is two automated messages, one shortly before it ends and one shortly after, and occasionally one personal note from the developer. Every such message names us, says why you are receiving it and carries a free opt-out, and you can object at any time under Article 21(2) by using the unsubscribe link where the message has one, by replying with the word stop, or by writing to the address below. The link takes effect immediately. A reply is read and acted on by hand, normally within two working days, and a message already scheduled inside that time may still arrive. After that we will not email you about the product again. The emails a licence needs in order to work, the key itself and a deletion confirmation link, are not affected.
• The time you opted out of product email: our legitimate interest, and yours, in keeping that instruction (Article 6(1)(f)).
• The name of the tool you started a trial from: our legitimate interest in knowing which features lead people to try the product (Article 6(1)(f)).

Your rights (GDPR)

You can ask for access to your data, correction of it, a copy of it in a portable format, or its deletion, at any time. To delete it, visit /delete and click the link we email you, or email us and we will do it by hand. Because the fingerprint is held on legitimate interest, you can also object to that processing under Article 21; in practice objecting means the record is deleted, which also ends any trial anchored to it. We answer within one month.

If you think we have handled your data badly you can complain to the Lithuanian State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija, vdai.lrv.lt), or to the supervisory authority where you live.

Contact

For privacy questions: povkonop@gmail.com

This project is not affiliated with, endorsed by, or sponsored by Apple Inc. Apple, App Store, App Store Connect, TestFlight, Xcode, iOS, and macOS are trademarks of Apple Inc.

← asc-mcp · Privacy · Terms · povkonop@gmail.com