KurappPrivacy Policy
This policy explains what data the Kurapp app for iPhone (“Kurapp”, “the app”) accesses, how it uses and stores that data, and what it shares. Kurapp is made by SoyApps, an independent developer in Japan (“we”, “us”).
In short
- Kurapp has no servers. It connects to Apple and Google directly from your device.
- Your credentials and your revenue data stay on your device and, if you allow it, in your iCloud Keychain. We never receive them.
- Kurapp only reads data. It never changes anything in your accounts.
- We don't sell, share or use your data for advertising.
Data you connect
App Store Connect
You give Kurapp an App Store Connect API key (the private key, key ID and issuer ID) and your vendor numbers. Kurapp uses them to read your sales, subscription and payment reports and your list of apps from Apple.
Google account (Google Sign-In)
When you sign in with Google, Kurapp requests the following permissions:
| Permission | What Kurapp reads | Why |
|---|---|---|
Email address (openid, email) |
The email address of the Google account | To show which account is connected and to tell several accounts apart |
AdMob, read-only (admob.readonly) |
Your AdMob accounts, your apps, and network reports (earnings, impressions, clicks, ad requests, matched requests by date, app and country) | To show your ad revenue and metrics |
Cloud Storage, read-only (devstorage.read_only) |
The report files in your Google Play Console report bucket
(pubsite_prod_rev_*): sales, earnings, installs and subscriptions
|
To show your Google Play revenue and metrics |
Kurapp reads only the Google Play Console reports in the bucket you choose. It doesn't read other buckets, and it never writes or deletes anything.
Google Cloud service account (optional)
Instead of signing in with Google, you can give Kurapp the JSON key of a service account that you created. Kurapp uses it only to read the same Google Play Console reports.
How Kurapp uses this data
Kurapp uses the data above only to show your revenue and metrics inside the app: totals, charts, breakdowns by app and country, and the links between the iOS version, the Android version and the ads of the same app. All of this is computed on your device.
Where the data is stored
- Credentials (the App Store Connect private key, Google refresh tokens and service account keys) are stored only in the iOS Keychain. By default they sync through your iCloud Keychain so your other devices can use them; you can switch to “This device only” in Settings. Google access tokens are kept only in memory.
- Reports and the figures read from them are stored in a database on your device, encrypted by iOS Data Protection so they can't be read while the device is locked. They are not synced between devices.
- No credentials or revenue data are sent to any server operated by us.
Sharing
We don't sell, rent or transfer your data to anyone. Data from Google APIs is not used for advertising, is not used to train AI or machine learning models, and is not read by people. Because the data never leaves your device through us, we have no copy to share.
Kurapp's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Services the app uses
| Service | What is sent |
|---|---|
| Firebase Analytics (Google) | Usage events: progress through the introduction and setup, which kind of source you connected (App Store Connect, AdMob or Google Play), and whether a sync succeeded and the kind of error. Never amounts, app names or IDs, figures by country, account names or credentials. |
| Firebase Crashlytics (Google) | Crash and error reports, to fix bugs. They are designed not to include credentials or revenue figures. |
| Google AdMob | Kurapp shows one banner ad. It requests only non-personalized ads and doesn't ask for permission to track you. In the European Economic Area and the UK, Kurapp asks for your consent through Google's consent tool before showing ads. |
| Frankfurter and currency-api (via jsDelivr) | Currency pairs and dates, to convert amounts into your display currency. Never the amounts themselves. |
| Google Play store pages (play.google.com) | The package names of your Google Play apps, to fetch their public names and icons. |
| Apple's iTunes Lookup API | The App Store IDs of your apps, to fetch their names and icons. |
Keeping and deleting data
- Kurapp fetches up to one year of history and keeps it on your device until you delete it.
- Disconnecting a source in Settings deletes its data, and its credentials unless another connection uses them. When Kurapp deletes a Google sign-in, it also revokes the access you granted to Kurapp in your Google account.
- “Delete all data” in Settings deletes all credentials and all data, and revokes the access granted through Google Sign-In.
- You can revoke Kurapp's access to your Google account at any time at myaccount.google.com/permissions. You can revoke an App Store Connect key in App Store Connect.
Children
Kurapp is a tool for app developers and is not directed to children.
Changes
If we change this policy, we will update this page and the date above.
Contact
SoyApps — info@soyapps.studio