ReFlight
Privacy Policy
Effective October 12, 2026
ReFlight (“we”, “us”) is a web app for viewing and editing App Store listing text, such as What’s New and Promotional Text, through Apple’s App Store Connect API. This policy explains what information we handle and why. Questions: hello@reflighthq.com.
What we collect
- Account information. When you sign in with Apple or Google we receive a unique account identifier from that provider, your email address, and your name if you choose to share it. With Sign in with Apple your email may be a private relay address.
- Your App Store Connect API key. The Issuer ID, Key ID and private key (.p8) you connect, plus an optional default app bundle ID. The private key is encrypted with AES-256 before it is stored.
- Sign-in sessions. A session cookie keeps you signed in. We store only a one-way hash of it.
- Error logs. Our server records errors, such as a failed request to Apple, to keep the service working.
- Early-access list. If you sign up for early access on our website, we collect your email address. It’s stored by Kit, the email service we use, together with the date you signed up and whether you confirmed it.
We don’t store your App Store content. Apps, versions and release notes are fetched from Apple when you use ReFlight. We keep only short-lived copies in memory, such as links to app icons, for up to a day.
How we use it
- To sign you in and keep your account secure, including limiting repeated sign-in attempts.
- To read your App Store Connect data and to send the changes you save to Apple.
- If you joined the early-access list, to email you about early access and the launch of ReFlight.
We don’t sell your information or show ads.
Website analytics
On our website (reflighthq.com) we use Umami, a privacy-friendly analytics tool, to count visits, see which pages and links people use, and how many people sign up for early access. Umami doesn’t use cookies, doesn’t collect personal information such as your name or email, and doesn’t track you across other websites. It records things like the page visited, the referring site, your browser type and country, in aggregate. The ReFlight app itself doesn’t use analytics.
Cookies and local storage
| Name | Purpose | Lasts |
|---|---|---|
rf_session | Keeps you signed in | 30 days, or until you sign out |
rf_oauth | Protects the sign-in step against forgery | 10 minutes |
Your browser also keeps a few preferences in local storage: theme, sidebar width, last selected app and section. These stay on your device.
Services we rely on
- Apple: the App Store Connect API, Sign in with Apple, and the public App Store lookup used to show app icons.
- Google: Sign in with Google, and Google Fonts, which receives your IP address when a page loads its fonts.
- Kit (kit.com): stores the early-access list and sends those emails.
- Umami (umami.is): cookieless website analytics for reflighthq.com.
- Our hosting provider, which runs the servers that store the information above.
Each of these handles data under its own privacy policy.
How long we keep it, and deleting it
We keep your account information and key while your account exists. You can delete your account at any time from the Account page in ReFlight. That immediately deletes your account, your saved key and your sessions. Disconnecting a key deletes it right away. You can also revoke the key yourself in App Store Connect under Users and Access → Integrations.
We keep your early-access email until you unsubscribe. Every email has an unsubscribe link, or you can ask us to remove you.
Security
Keys are encrypted at rest, sessions are stored only as hashes, and the service is served over HTTPS. No system is perfectly secure, but we work to protect your information and will tell affected users about any breach as the law requires.
Your rights
You can access, correct or delete your information. Depending on where you live, for example in the EU, the UK or California, you may have further rights, such as data portability or objecting to processing. Email hello@reflighthq.com and we’ll respond within 30 days.
Children
ReFlight is for app developers and isn’t intended for anyone under 16.
Changes
If we change this policy we’ll update the date above, and tell signed-in users about significant changes.