App Indexer ASO Rank Tracker Get it free
App Indexer · Legal

Privacy Policy

App Indexer keeps what you track on your device unless you turn on sync. This policy says exactly what leaves the device, where it goes, and why.

Effective 3 November 2026 Package com.dolev.appindexerfordevelopers

01 Who this covers

This policy applies to App Indexer: ASO Rank Tracker (“App Indexer”, the “app”), a free app built and provided by Dolev Franco, published on Google Play as Dolev Ltd. (“I”, “me”), and to its web app at asoranktracker.dfranko.com/app. Words defined in the Terms of Service mean the same here.

02 In short

  • You don't need an account. Without one, your apps, keywords and position history stay on your device or in your browser, and I do not collect your name, email address or contacts.
  • Sync is optional. If you sign in with Google or Apple, your apps, keywords, position history and category history are stored on my server under that account so your devices can share them, along with the email address the provider shares. You can turn sync off and delete that copy, or delete your account, at any time, on the phone or at the web app's Settings.
  • To check a rank, the app sends only the search phrase, the store id and the country. Nothing else about you is attached. When you add an app in the web app, the name you type is also sent, to search the stores for it.
  • The phone app sends anonymous usage analytics to Google (Firebase Analytics). They never include a keyword, package id, app name or store link. The web app sends no analytics.
  • If you connect Google Play Console or App Store Connect, that data goes directly between your device and Google or Apple. I never receive it, and your console keys never leave the device.
  • If you buy Premium, RevenueCat holds the purchase record under a random id. It never receives your name, your email address or anything you track.
  • The app shows no ads and does not collect the advertising ID.

03 What stays on your device

The apps you add (names, Google Play package ids, App Store ids), your keywords and countries, every position reading and its date, your settings, and any reports downloaded from a connected developer account are stored in the app’s private storage on your device. The web app keeps the same apps, keywords and readings, and its settings, in your browser’s own storage. Unless you turn on sync (section 04), there is no cloud backup and I have no copy. Settings → Clear all data deletes them from that device or browser, as does uninstalling the app. If you use sync, clearing turns sync off there first, so it does not touch the synced copy, which stays until you delete it.

04 Sign-in and sync (optional)

The app and the web app both work with no account. Sign in only if you want your devices to share one set of data. Sign-in is through Google or Apple and only identifies your account: the provider confirms who you are and gives me an identifier and, usually, an email address. Apple sends the address only the first time you sign in. Neither provider sees what you track. A Google sign-in and an Apple sign-in are separate accounts, and I do not link accounts by email address. The web app contacts Google and Apple only once you open its sign-in.

What syncs. While you are signed in, these are stored on my server under your account:

  • your apps: their names and store ids;
  • your keywords: the phrase, the country, the package id, the date you added it and the iOS devices you chose;
  • your position readings, for every store and device, with their dates and the details the check reported, such as how many results were checked;
  • your category history, one record per store and app;
  • which app is your free app, so the same free limits apply on every device.

What does not sync. Your console keys and Google Play Console permissions never leave the device they were added on. Traffic figures, competitors, custom alerts, app icons, your theme and your other settings stay on each device too.

Where it is stored. Synced data is kept in a MongoDB database behind my server, which runs on Heroku. I use it only to give it back to you on your devices. It is not sold or shared.

Sign-in tokens. The token from Google or Apple is used once, to confirm the sign-in, and is not stored. My server then issues a random session token. The phone keeps it in secure storage and the web app keeps it in your browser’s local storage. The server stores only a hash of it, with your account id and a short label for the kind of device. It lasts 180 days from when it was last used, and normally ends sooner when you turn sync off or delete your data. If your device can’t reach my server at that moment, the token is still removed from the device, and the hash on the server stays until those 180 days run out.

Turning it off and deleting it. On the phone or in the web app’s Settings you can:

  • Turn off sync. That device or browser stops syncing and keeps its own copy. The synced copy stays on the server until you delete it.
  • Delete the synced copy. Your apps, keywords and readings are removed from the server and your other devices stop syncing. Your account stays, and each device keeps its own copy.
  • Delete your account. Your account, your synced data and your sessions are deleted from the server right away. Each device keeps its own copy until you clear it there. If you can’t reach a device that is signed in, you can sign in at the web app’s Settings just to delete the account.

If your account is an Apple one, deleting it first asks Apple to confirm it is you. My server uses that confirmation to revoke the sign-in tokens Apple issued for App Indexer, so your Apple ID stops listing the app. If Apple doesn’t accept the request, the account is still deleted, and you can remove App Indexer in your Apple ID settings yourself. A Google sign-in can be removed from your Google Account.

05 Rank checks

When a keyword is checked, by you or by the optional daily check, the app sends the search phrase, the store id (Google Play package id and/or App Store id) and the country, which is what is needed to search the store and return the position. Category checks send the store ids and the countries in the same way.

These requests carry no account, name or device identifier, even when you are signed in, and I do not use them to identify you, build a profile of you, or link your checks together. The web app sends the same requests from your browser.

06 Requests made directly to the stores

When you add an app, the phone app looks its id up directly with Google Play and Apple (itunes.apple.com) to confirm the id exists and to load its name and icon. Google and Apple receive these requests, with your IP address, under their own privacy policies. The web app makes these lookups through my server instead, and as you type an app’s name when adding it, it sends what you have typed there to search both stores. Those searches carry no account, name or device identifier.

07 Usage analytics

This section is about the phone app. The web app has no analytics. The phone app uses Google Analytics for Firebase to understand how it is used: which screens are opened, which controls are used, and how checks turn out (for example the country, the rank band such as “top 10”, and whether a rank went up or down). Firebase also collects standard information such as an app-instance identifier, device model, operating system version, app version, approximate location derived from the IP address, and the time of use.

Analytics never include a keyword phrase, package id, App Store id, app name or store link, and I do not set a user id or link analytics to you. The app removes the advertising ID permission, so the advertising ID is not collected. Analytics collection is always on; to stop it, uninstall the app. Google processes this data under the Firebase privacy information and the Google Privacy Policy.

08 Connecting Google Play Console

This is optional. If you connect, you sign in with Google through Google Play services and grant two read-only permissions: Play Developer Reporting, and read-only access to the Cloud Storage bucket that holds your Play Console reports. The app shows the signed-in account’s email address so you know which account is connected.

Access tokens are managed by Google Play services on your device. The app uses them to download your apps’ reports (such as store listing visitors, installs, conversion, traffic sources and search terms) directly from Google to your device, where they are stored. Neither the tokens nor the reports are ever sent to me. Disconnecting in the app signs out and deletes the stored reports, and you can also remove App Indexer’s access from your Google Account.

09 Connecting App Store Connect

This is optional. If you connect, you import an App Store Connect API key (the key file, its key id and issuer id) that you created in your Apple account. The key is kept in your device’s secure storage (Android Keystore-backed encrypted storage) and is used only on the device to sign requests sent directly to Apple. To show downloads and traffic, the app may ask Apple to start generating analytics reports for the apps you connect. The data Apple returns is stored on your device. Neither the key nor the data is ever sent to me.

Disconnecting in the app deletes the key and the stored data. You can also revoke the key at any time in App Store Connect.

10 Premium and RevenueCat

Premium is optional and is bought in the phone app through Google Play or the App Store, which take the payment. RevenueCat validates the purchase with the store and holds the purchase record under a random app user id. RevenueCat never receives your name, your email address or anything you track. RevenueCat handles this data under its privacy policy.

Without an account, that id is one RevenueCat generates and nothing connects it to you. If you sign in, the phone app moves your RevenueCat id to your account’s own random id, which keeps your purchases and lets the web app recognise Premium. My server asks RevenueCat about that id for any signed-in account, whether or not you have bought anything, which can create an empty record there, and it keeps the yes-or-no answer with your account.

That link stays when you sign out or delete your account: only the random id is at RevenueCat, and the purchase is kept under it, so Premium keeps working on the phone that paid for it. It changes only if another account signs in on that phone. Once your account is deleted, my server no longer holds anything that connects the id to you. Deleting your account does not cancel a subscription, which is billed by the store and is cancelled there.

11 Notifications and permissions

The app asks for network access to run checks, and for permission to post notifications only if you turn on the daily check. The daily check’s notification is created on the device; no push service is used. When you share something from the app or pick a key file, Android’s own share sheet and file picker are used, and the app only reads the file you choose.

12 Sharing and selling

I do not sell or rent personal information, and I do not share it for advertising. The only third parties involved are the ones named above: Google (Firebase Analytics, Google Play, Google Sign-In and the Play Console APIs), Apple (App Store lookups, the App Store purchase, Sign in with Apple and the App Store Connect API), RevenueCat (purchase records), and the providers that host my server and its database (Heroku and MongoDB). I may disclose information if required by law.

13 Security

All network requests use HTTPS. On the phone, developer keys and your session token are kept in encrypted secure storage, and everything else stays in the app’s private storage. In the web app, your data and session token are in your browser’s storage, so anyone with access to that browser profile can reach them. On the server, session tokens are stored only as hashes. No method of transmission or storage is completely secure, so I cannot guarantee absolute security.

14 Your choices and rights

You control your data directly: edit or delete apps and keywords, disconnect developer accounts, use Clear all data, uninstall the app, or, if you use sync, delete the synced copy or your account (section 04). Depending on where you live, including under the Israeli Protection of Privacy Law and the EU and UK GDPR, you may have rights to access, correct or delete personal information about you. Without sync I hold no account data. With or without it, you can contact me with any request and I will help as far as I can, including with requests about analytics data held by Google.

15 Children

The app is a tool for app developers and is not directed at children under 13. I do not knowingly collect personal information from children. If you believe a child has provided personal information through the app, contact me and I will take steps to delete it.

16 Changes to this policy

I may update this policy when the app changes. The new version will be posted on this page with a new effective date, and it applies from that date.

17 Contact

Questions or requests about privacy: dolevfranco2005@gmail.com.