Operator and scope
ASO Signals is operated by emonster, inc. ("emonster", "we", "us"). This policy covers asosignals.dev, its waitlist, privacy choices, and the separate restricted development application at app.asosignals.dev. Contact [email protected] for privacy questions or requests and [email protected] for product support.
Information we collect and where it comes from
You provide your email address, language, Terms acceptance, optional product-news preference, and optional analytics choice when joining the waitlist. We store the normalized contact address, original signup time, notice and choice versions, timestamps, and email-delivery status. Registration is not verification that you control the mailbox.
When you allow optional analytics, we also store limited browser and operating-system categories, device type, first-party landing path, referring website origin, and allowlisted campaign context. Without that choice, these fields remain unknown or empty.
Separately, hosting infrastructure may supply coarse geographic context. The private signup service may send your request IP to IPinfo to look up its approximate country and continent, whether or not optional analytics is allowed. The signup stores only the permitted coarse result and lookup time. Raw IP addresses, full URLs or queries, raw referrers, raw user-agent strings, and bot tokens are not stored in signup records.
How we use information
We use waitlist information to register and deduplicate requests, send one registration receipt and requested launch or access updates, notify an authorized administrator of a new signup, manage communication choices, protect the form, and understand aggregate demand. Internal notifications contain signup, consent, and coarse location context.
Product news and offers require the separate optional checkbox. Browser and acquisition context depends on the independent optional analytics choice. Accepting the Terms is not consent to every processing purpose. Waitlist information is not used for advertising audiences, cross-product marketing profiles, or automated pricing decisions.
If you contact us, we use the information you provide to answer the inquiry or handle your request. Please do not send Apple credentials or other secrets by email.
Communication choices and repeat submissions
The signed marketing-unsubscribe link withdraws product-news and offers permission. It leaves your waitlist registration and requested launch updates active. To leave the launch list or request deletion, contact [email protected]. The registration receipt and administrator notification do not depend on optional marketing.
A repeat submission receives the same response as a new signup and does not send another receipt or administrator notification. It can record the Terms you newly accept and your explicit marketing choice while preserving original signup, privacy-notice, acquisition, and retention context. Missing acceptance or consent is never inferred from an older record.
Optional analytics and browser storage
The current public site does not activate Google Analytics or an advertising tracker. Privacy settings stores your analytics choice in this browser. It controls optional context in future waitlist submissions; changing the toggle does not update or delete data already stored on the server. Contact our privacy team about earlier records.
The site stores language and explicit Light or Dark preferences locally, and language in a first-party cookie. System appearance removes the explicit theme override. A short-lived completion-timing token stays in page memory. reCAPTCHA Enterprise is used for bot assessment when the form requests it and may use its own security cookie and technical signals.
Service providers and recipients
Cloudflare handles public-site request delivery and network protection. Google and Firebase provide App Hosting, Cloud Functions, Firestore, authentication for the restricted application, secret storage, and reCAPTCHA Enterprise abuse assessment. IPinfo receives the transient request IP for country and continent lookup. Resend sends waitlist receipts and administrator notifications and returns delivery events.
These providers process the network, security, diagnostic, message, and delivery information needed for their services. The limit on what ASO Signals stores in a signup record does not mean that providers never process raw IPs or technical logs. Email links may be processed for delivery or link tracking under provider settings; browser Privacy settings does not control email-provider tracking.
Access within emonster is restricted to authorized operations. Information may also be disclosed where required by applicable law. Provider privacy information is available below.
Restricted application and planned Apple features
The public waitlist does not initialize Firebase Authentication or create a sign-in session. The separate development application uses Google and Firebase Authentication and currently restricts access to server-verified Google identities on the exact emonster.com domain. It processes identity, email, verification and session data, with browser authentication persistence and an HTTP-only session cookie.
The restricted development application supports its own App Store Connect connection, server-side credential storage, app selection, and retrieval of listing metadata and screenshots. These are separate from the public waitlist. Joining this waitlist does not import Apple data, collect an app user's activity, connect credentials, or authorize changes to an app.
Planned analytics and recommendations distinguish private Apple source data, public keyword intelligence, user drafts, and derived results. ASO Signals owns its connection and app data; another product subscription is not required. Planned editing covers app names, subtitles, and keywords using the connected account's permissions, with validation, explicit approval, conflict checks, and verification. It never submits or releases an app. Notices must reflect the actual data handling before further capabilities are introduced.
Retention and deletion
Waitlist signup records are scheduled to expire 24 months after their original creation time; duplicate signups do not restart that period. Short-lived waitlist abuse records are scheduled to expire within 24 hours. Identifier-free aggregate waitlist records have a 36-month expiry measured from the end of their reporting period, and aggregate slices below 10 signups are suppressed. Firestore time-to-live deletion is asynchronous and may occur after the recorded expiry time.
We retain personal data only for as long as needed to provide the Service, meet the purposes described in this policy, and satisfy applicable legal obligations. Our retention controls cover source and derived data, stored files, integration credentials, and account configuration. Temporary data used only for immediate processing is discarded when that processing ends.
When you confirm account deletion, ordinary product access, synchronization, background processing, reports, and analytics stop immediately. Remaining account data is frozen for a 30-day grace period. Signing in gives access only to deletion status and the controls to reactivate before the displayed deadline or start permanent deletion sooner. Signing in alone does not cancel deletion. Necessary authentication, deletion administration, security, and legal-compliance operations may continue solely for those purposes.
Permanent deletion removes the account's integration credentials, source and derived data, stored files, configuration, and authentication identity from live systems. It also removes waitlist signup records matching the account's verified email address. Identifier-free aggregates cannot be linked back to an individual and may remain under their stated retention schedule. Copies you downloaded and data held independently by other services are outside this workflow.
Account-owned support records and private support archives are included in cleanup. Shared support discussions are handled through verified ownership mappings so that another account’s contributions are preserved.
Encrypted residual backup copies expire within 30 days after permanent deletion and are not used to restore a deleted account or continue processing its data. The product’s private support archive currently has soft deletion and versioning disabled; Firestore point-in-time recovery and scheduled backups are disabled. Restores are isolated, and the current deletion ledger is applied before restored data becomes available for use. Minimal deletion receipts and replay-prevention records expire 30 days after cleanup completes.
Operational logs and Resend email content and delivery logs have a 30-day retention period. Google Cloud's mandatory administrative and system audit logs use its required 400-day retention; these restricted security records are separate from ordinary product use and are not copies of private Apple data, ASO results, or integration keys. Other narrow legal-retention obligations are handled separately, with access restricted and records deleted when the applicable requirement ends; we do not retain credentials or continue ordinary processing on that basis.
For a deletion request, Resend sends you only the initial confirmation and one final warning targeted for 24 hours before the deadline. A separate plain-text notice is sent to our administrator when a new request is confirmed. Delivery problems do not extend the deadline. We send no deletion-completion or reactivation email. ASO Signals currently has no online checkout or active paid-subscription integration, so this workflow does not create a subscription or take a payment. Contact [email protected] to exercise applicable privacy rights; the product's grace period does not limit those rights.
Security and international processing
ASO Signals uses private server-side persistence, denied direct browser database access, product-specific keyed record identifiers, restricted service identities, and bounded requests. No method of transmission or storage is completely secure.
Information may be processed in the United States and other countries where emonster or its providers operate, including outside the European Economic Area. Data protection laws may differ. Contact [email protected] for information about processing locations and applicable transfer safeguards.
Your choices and rights
Where the GDPR applies, you may request access, correction, erasure or restriction in the circumstances provided by law, and object to relevant processing, including direct marketing. Portability applies to qualifying data you provide when processing is automated and based on consent or contract. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.
You may also have protections relating to solely automated decisions with legal or similarly significant effects. Contact [email protected] to make a request; proportionate information may be needed to confirm identity. The GDPR normally requires a response within one month, subject to its permitted extension and notice rules.
You may complain directly to a competent supervisory authority, including in the EU country where you live or work or where the alleged infringement occurred. You do not need to contact us first. Our GDPR page explains these rights and the current service in more detail.
Policy changes
We may update this policy as the service and its information practices change. The date above identifies this version. Material changes to data handling will be reflected in the relevant notices.