Privacy Policy

App Store Connect MCP is run by Little Planet Labs, LLC ("Little Planet Labs", "we", "us"). It's a remote MCP server that lets Claude, or another MCP client, read your team's App Store Connect data through your own API key.

• We store your Apple ID email and name, your encrypted App Store Connect API keys, which MCP clients you've connected, and the IP address and browser each sign-in session started from.
• We log which tool ran, not what it returned. Apart from the statuses and notes you set on feedback, crash reports, and reviews, the priority and type we label them with (and the scores, model version, and token count behind each label), and the short refs we number them with, like VLW-12, tool arguments and results never touch our database.
• Builds, App Store versions and their metadata, App Review submissions, TestFlight groups and testers, Xcode Cloud build runs, performance metrics, diagnostic signatures and their logs, TestFlight feedback, crash reports and their logs, App Store customer reviews, and Apple's review summaries are read live from App Store Connect when you or your client ask for them. We don't store them.
• Customer reviews are written by other people and include the reviewer's nickname. We show them to you, don't store them, and never send the nickname to TypeSafe.
• TestFlight testers are other people too. Their names, emails, invite state, and usage are shown to you, not stored, and never sent to TypeSafe.
• Xcode Cloud build runs name the author of the commit each one built. We pass only a short commit ID, the author's name, and the first line of the commit message to your client, don't store them, and never send them to TypeSafe.
• App Store version metadata is your App Store listing text: each version's description, keywords, What's New, promotional text, and marketing and support URLs, and your app's name, subtitle, and privacy URLs. We pass it to your client, don't store it, and never send it to TypeSafe.
• Performance metrics are figures Apple aggregates across the people who share their data with developers. Diagnostic logs name the device type, OS version, and app version and build they came from, and show call stacks from your app and the system code it calls. We pass only those details, the device's architecture, and the frames Apple blames, which can be in your app or in system code, to your client, don't store them, and never send them to TypeSafe.
• If you have a license, we send TypeSafe the comments on TestFlight feedback and crash reports, with the app, build, and device details, and the rating, title, and text of App Store reviews, so it can label each one with a priority and a type. Tester names and emails, screenshots, crash logs, and reviewer nicknames and territories are never sent.
• We don't sell your data or show ads, and we share it only with the service providers listed below.
• Delete your account, your keys, and your activity any time from the dashboard's Account page.

Your account

When you sign in with Apple, we get the email address for your Apple ID, which may be a private relay address Apple generates on your behalf, and, only the first time you sign in, your name. We also store Apple's identifier for your account and the access, refresh, and ID tokens Apple issues at sign-in, encrypted at rest; App Store Connect MCP doesn't use those tokens itself.

Your license

If your account has a license, which is what lets connected clients use the tools, we store its status, where it came from (such as early access), its plan, when it was granted, when it expires or was revoked, when it last changed, and an optional note we add.

Sign-in sessions

Each time you sign in, we start a session and store the IP address and browser user agent it started from. A session record is kept until you sign out or delete your account. An expired session you never sign out of can stay stored until then.

Your API keys

An App Store Connect API key has three parts: an issuer ID, a key ID, and a private key. We store the issuer ID and key ID as-is, and encrypt the private key at rest with a per-key data key, itself protected by a versioned master key. Once you save a key, we never show the private key again, and we never log it.

Connected clients

When you connect an MCP client such as Claude, we store which client you connected, the scopes it was granted, and the access and refresh tokens issued to it, so we can enforce those scopes and let you revoke access.

Tool-call activity

Every time a connected client calls a tool, we log which tool ran, which App Store Connect instance and client it ran against, whether it succeeded, how long it took, and when it happened. We never log the tool's arguments or its results.

Feedback statuses

When you set a status or note on TestFlight feedback, a TestFlight crash report, or an App Store customer review, from the dashboard or a connected client, we store which kind of item it is, its ID, the app ID, your team's issuer ID, the status, your note, where you set it from, and when. We never store the item itself (comments, screenshots, crash logs, review titles and text, or tester, reviewer, and device details); it always comes live from Apple.

Feedback priority and type

If your account has a license, we store the priority and type TypeSafe gives each piece of TestFlight feedback, each TestFlight crash report, and each App Store customer review, along with which kind of item it is, its ID, the app ID, the scores and confidence behind them, the model version, how many input tokens the request used, when it was classified, and when the record was last saved. They're stored per account, not per instance, so deleting an instance doesn't delete them. We never store the comment, the review, or anything else we send to TypeSafe. See Feedback classification.

Feedback refs

The first time a piece of TestFlight feedback, a TestFlight crash report, or an App Store customer review comes up when we read a list of them, on the dashboard's Feedback or Reviews page or through a connected client's feedback, crash report, or review tool, we give it a short ref, like VLW-12, even if a filter hides it. That includes items you've never set a status on. We show refs on the dashboard and to your client, and your client can use a ref in place of the item's ID. For each app, we store its app ID, a short prefix made from the app's name (or from its bundle ID, if the name doesn't have enough letters), like VLW, the next number to give out, and when we started numbering it. For each item, we store which kind of item it is, its ID, the app ID, its number, and when it was numbered. Refs are stored per account, not per instance, so deleting an instance doesn't delete them. We never store the item itself, the app's name or bundle ID, or tester or reviewer details. The prefix is the only thing we keep that's made from the app's name or bundle ID.

Rate limiting

We keep short-lived counters in Upstash Redis to enforce rate limits on tool calls.

Analytics and performance

We use Vercel Web Analytics and Vercel Speed Insights, which are cookieless. They give us aggregate page-view and performance data and don't identify you individually.

When a tool call runs, it fetches data from Apple's App Store Connect API using your key and passes the result straight to the AI client you connected, such as Claude. We don't store that data ourselves; see Tool-call activity for the one record we do keep about the call, Feedback statuses for the statuses you set, and Feedback priority and type for the labels we save, and Feedback refs for the short refs we number feedback, crash reports, and reviews with.

The tools and the dashboard read your apps, your builds and their TestFlight status, your App Store versions and their release status, open App Review submissions, your TestFlight groups and testers, TestFlight feedback and crash reports, crash logs, App Store customer reviews, and Apple's summaries of those reviews. Each is loaded live from Apple when you or your client ask for it, and none of it is stored. A crash log is only fetched when you open it on the dashboard or your client asks for that one log. We only read from App Store Connect. We never reply to a review, invite a tester, change a group, start or cancel a build, edit your App Store listing, or change anything else there.

Customer reviews are written by other people, not your team. Each one includes the reviewer's nickname, their territory, their star rating, and what they wrote. We show reviews to you on the dashboard, and pass them to your MCP client when it asks. We don't store them. If you have a license, we send TypeSafe a review's rating, title, and text to label it, but never the reviewer's nickname or territory.

TestFlight testers are people your team invited, by email or through a public link. For each one we read their name, email, how they were invited, their invite state, which of the app's groups they're in, and how many sessions, crashes, and pieces of feedback they had over the last 7, 30, 90, or 365 days. For each group we read its name, whether it's internal or external, its public link settings, how many testers it has, and its builds. We show them to you on the dashboard, and pass them to your MCP client when it asks. We don't store them, and we never send tester or group details to TypeSafe.

Your MCP client can also read your apps' Xcode Cloud build runs. For each run we read its workflow, its status and result, why it started, when it was created, started, and finished, how many errors, warnings, and test failures it had, and the commit it built. Apple sends the whole commit: its full ID and message, the names and profile picture links of its author and committer, and a link to it. We keep only a short commit ID, the first line of the message, and the author's display name, and drop the rest without storing it. The author may be someone outside your App Store Connect team. For up to three steps of a run that failed or errored (the run itself can still be in progress), we also read their errors, warnings, and test results, and keep only the tests that failed, with the messages and file locations of each. We pass these to your MCP client when it asks. They aren't shown on the dashboard, we don't store them, and we never send them to TypeSafe.

Your MCP client can also read an App Store version's metadata. For each language, we read the version's description, keywords, What's New, promotional text, and marketing and support URLs, and your app's name, subtitle, privacy policy URL, and privacy choices URL, along with which version and app information they belong to and their App Store states. We pass them to your MCP client when it asks. They aren't shown on the dashboard, we don't store them, and we never send them to TypeSafe.

Your MCP client can also read your apps' power and performance metrics and diagnostics. The metrics are figures Apple aggregates across the people who chose to share their data with developers, like launch time, hangs, memory, disk writes, and battery use, for each app version and kind of device, along with Apple's notes on what got worse. We keep each metric's latest and previous version and Apple's goal, and drop the older versions. Diagnostic signatures are the recurring call stacks Apple found behind hangs, disk writes, and slow launches, each with its share and trend. When your client asks for one signature's logs, Apple sends up to three of them. From each we keep only the device type, processor architecture, OS version, app version, and build, and the call-stack frames Apple blames, whether in your app or in system code (function, binary, and file names, line numbers, and sample counts), and drop the rest, including your app's bundle ID and the other frames, without storing it. We pass these to your MCP client when it asks. They aren't shown on the dashboard, we don't store them, and we never send them to TypeSafe.

If you have a license, TestFlight feedback, crash reports, and App Store customer reviews also go to TypeSafe to be labeled, as described in Feedback classification.

If your account has a license, we use TypeSafe's Jev model to label each piece of TestFlight feedback, each TestFlight crash report, and each App Store customer review with a priority (critical, high, medium, or low) and a type (bug, improvement, feature request, or other), so you and your MCP client can see what to fix first. An item is sent the first time it loads without a label, on the dashboard's Feedback or Reviews page or through a connected client's feedback, crash report, or review tool, and again whenever you choose Reclassify on the dashboard. Once an item has a label, it isn't sent again unless you ask.

What we send TypeSafe depends on the kind of item.

For TestFlight feedback:

• the feedback comment
• the app's name, and the platform, version, and build the feedback came from
• the device model and OS version
• whether a screenshot is attached

For a TestFlight crash report:

• the tester's comment
• the app's name, and the platform, version, and build that crashed
• the device model and OS version
• the fact that the app crashed

For an App Store customer review:

• the star rating
• the review's title and text
• the app's name

Nothing else about an item is sent. We never send the tester's name or email, the screenshot itself, the crash log or the crash report's other device details, or the reviewer's nickname or territory. Feedback and crash reports without a comment, and reviews without a title or text, aren't sent. Accounts without a license never have anything sent to TypeSafe.

TypeSafe doesn't train its models on what we send. Under its own terms, it may keep telemetry derived from it, such as logs, summary statistics, and the classifications themselves, and it doesn't publish how long it keeps them.

We keep the result, not what we sent. See Feedback priority and type.

• To run the service: authenticate you, check your license, call the App Store Connect API on your behalf, and enforce scopes and rate limits.
• To show you your own connections and activity in the dashboard, along with your builds, App Store versions and App Review submissions, TestFlight groups and testers, TestFlight feedback and crash reports, and App Store customer reviews and Apple's summaries of them, which we load live from Apple.
• To label TestFlight feedback, crash reports, and App Store customer reviews with a priority and a type, if you have a license.
• To investigate problems and abuse.
• To reply when you contact us.

• We don't sell or rent your information.
• We don't share your App Store Connect data with anyone but the MCP client you connected it to and, if you have a license, TypeSafe, which labels your TestFlight feedback, crash reports, and customer reviews for us.
• We don't show ads or share data with advertisers.
• We don't track you across other companies' websites or apps.

We use a small set of service providers to run App Store Connect MCP. Each one handles data to provide its service to us. TypeSafe's terms also let it keep some data derived from what we send it, as described in Feedback classification.

• Vercel hosts the website and the MCP server, keeps request logs, and provides Web Analytics and Speed Insights.
• PlanetScale hosts our Postgres database, which holds accounts, licenses, encrypted keys, connections, the statuses, notes, priorities, types, and refs for your feedback, crash reports, and reviews, and activity records.
• Upstash hosts the Redis store we use for rate limiting.
• Apple provides Sign in with Apple and the App Store Connect API that the tools and the dashboard use on your behalf.
• TypeSafe (typesafe.ai), in the United States, runs the Jev model that labels TestFlight feedback, crash reports, and App Store customer reviews with a priority and a type, for licensed accounts only.

We may also disclose information if the law requires it, to protect the rights or safety of our users or others, or as part of a merger, sale, or transfer of App Store Connect MCP, in which case this policy would still apply to the information we hold.

• Account, key, connection, and activity records are kept until you delete them, and removed immediately when you do.
• Sign-in session records, including the IP address and browser they started from, are kept until you sign out or delete your account, including sessions that have expired.
• Statuses and notes on feedback, crash reports, and reviews are kept until you delete your account.
• Priorities and types for feedback, crash reports, and reviews are kept until you delete your account, even if you delete the instance they came from.
• Refs for feedback, crash reports, and reviews, and each app's prefix and counter, are kept until you delete your account, even if you delete the instance they came from or the item is deleted in App Store Connect.
• We don't store builds, App Store versions or their metadata, App Review submissions, TestFlight groups or testers, Xcode Cloud build runs, performance metrics, diagnostic signatures or logs, feedback, crash reports, crash logs, customer reviews, or review summaries. They come live from Apple each time.
• TypeSafe may keep logs, summary statistics, and classifications derived from what we send it, under its own terms. It doesn't publish a retention period for them.
• License records are kept until you delete your account, including after a license is revoked or expires.
• Rate-limit counters are short-lived and expire automatically.
• Hosting logs and analytics are kept for the periods Vercel sets for our plan.

• Disconnect a client any time from the dashboard's Connections page.
• Revoke a key in App Store Connect itself. That cuts off App Store Connect MCP's access to it immediately, whether or not you also remove it from the dashboard.
• Delete everything with the dashboard's Account page. It deletes your account, your license record, your instances, your encrypted keys, your connections, the statuses, notes, priorities, types, and refs for your feedback, crash reports, and reviews, and your activity log immediately. It can't reach what TypeSafe keeps under its own terms.
• Ask about your information. Depending on where you live, you may have the right to access, correct, delete, or object to how we handle your personal information. Email us and we'll help.

App Store Connect MCP is served over HTTPS. API key private keys are encrypted at rest with a per-key data key protected by a versioned master key. No system is perfectly secure, though, so we can't promise that information will never be accessed without permission.

App Store Connect MCP is a tool for people who build and ship apps. It isn't directed at children under 13, and we don't knowingly collect personal information from them. If you think a child has sent us personal information, email us and we'll delete it.

App Store Connect MCP is run from the United States, and our service providers may process data in the United States and other countries. If you use it from outside the United States, your information may be processed somewhere with different data protection laws than where you live.

If we change this policy, we'll update it here and change the "Last updated" date at the top. If a change meaningfully affects how we handle your information, we'll make it more visible, for example with a notice on the site.

Questions or requests about privacy go to appstoreconnect@littleplanetlabs.com.

See also our Terms of Service.