Privacy Policy

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

[LEGAL NAME]
[STREET AND NUMBER]
[POSTCODE AND CITY]
Germany

Email: [CONTACT EMAIL]

Nod is run by one person; “we” in this policy means that person. We have not appointed a data protection officer, because the law does not require one for a business of this size.

2. The short version

• No advertising, no analytics and no tracking. The only cookies are the ones needed to sign you in.
• You sign in with GitHub. We store your GitHub user name, display name, the address of your profile picture and, if it is public, your email address.
• To check an app we read its store listing with your App Store Connect key, read the repository you choose, and run the build you upload. Parts of this material are sent to an AI model operated in the USA, which writes the findings.
• You can delete an app with its checks in the dashboard at any time. To have your account deleted, write to us.

3. Visiting the website

When your browser requests a page it sends your IP address, the date and time, the address of the page and technical details such as the browser type. Cloudflare, which sits in front of our server, and the server itself process this data to deliver the page and to keep the service secure. The Nod application does not keep a log of page visits. Error messages written to the server log can contain an account identifier or the name of a repository.

The public pages load no scripts, fonts or images from other companies. The typefaces are served from our own server.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to offer a website that works and is protected against attacks.

4. Account and sign-in

You sign in with your GitHub account. GitHub asks you to authorise Nod and then tells us your numeric GitHub user id, your user name, your display name, the address of your profile picture, your email address if you made it public on your profile, and which installations of the Nod GitHub App you can access.

We store these details together with an internal account number, your plan, the date the account was created and the number of your GitHub App installation. The access token GitHub issues during sign-in is used for that sign-in only and is not stored.

For each sign-in we store a session: a hash of the random number in your session cookie, your account, and when the session was created and when it expires.

In the dashboard your browser loads your profile picture directly from GitHub's servers. GitHub receives your IP address when that happens.

Legal basis: Art. 6(1)(b) GDPR (the contract about using Nod).

5. Apps and checks

A check has up to three parts. You decide which sources you connect; a part whose source is missing is skipped. The checks are carried out by a separate program that we operate, the runner. It fetches what a check needs from our server and reports the results back.

Store listing (App Store Connect)

You give us an App Store Connect API key: issuer ID, key ID and the private key. The private key is stored encrypted (AES-256-GCM) and is only used on our server to send read requests to Apple's App Store Connect API. We never change anything in your App Store Connect account.

With the key we read: the app's name, bundle ID and SKU; its versions, their states and submissions; the listing texts and links in each language; the number and sizes of screenshots and previews; the age rating answers; the price, in-app purchases and subscriptions; the attached build; and the App Review information (review notes, contact email address and phone number, and the user name and password of the demo account).

The demo account password is handed to the runner while a check runs, so that it can be typed into your app's sign-in screen in the simulator. It is not stored with the results, it is not part of the text sent to the AI model, and the runner masks it in everything it reports.

Source code (GitHub)

You install the Nod GitHub App on the repositories you choose. It has read-only access to their contents and metadata. For a check, our server asks GitHub for an archive of the branch you selected and passes it on to the runner. The runner unpacks it into a temporary folder, examines it, and deletes the folder when the check ends.

Files that usually hold secrets (for example .env files, keys, certificates and files your .gitignore excludes) are not sent to the AI model. A limited selection of source files and excerpts is. Findings can quote short passages of your code, and those quotes are stored with the results.

Builds and the live run

You upload a simulator build of your app, in the dashboard or from a script with an upload token (we store only a hash of the token). The server keeps the newest three builds of each app and deletes older ones when a new build arrives.

For a live run the build is copied into a fresh macOS virtual machine on a Mac we rent from Scaleway in Paris. It is installed in an iOS simulator there and operated by an AI agent, while screenshots and a screen recording are taken. Whatever your app shows on screen during the run ends up in them. The virtual machine can reach the internet, so your app can talk to its own servers. It is deleted when the run ends.

AI analysis

The findings are written by an AI model: Claude, developed by Anthropic, which we reach through the service OpenRouter in the USA. The model receives:

• the texts and facts of your store listing, including your review notes;
• the selected source files and excerpts;
• during a live run: screenshots of the simulator, a list of the elements on screen, the top of a crash report if your app crashes, and the user name of the demo account;
• for rejection help: the message you paste, basic details of the app, and the findings of its latest check.

We do not use your material to train AI models. OpenRouter and the company that runs the model process the requests under their own terms and may keep them for a limited time, for example to detect abuse.

Results

We store the results of each check so that you can come back to them: findings, individual checks, the log, the steps of the live run with their screenshots, the screen recording, the notes prepared for App Review, and which findings you marked as fixed.

Rejection help

If you paste a rejection message from App Review, we store the message together with the analysis in your account.

Other people's data

Please use test accounts and test data. If the material you connect contains personal data of other people (for example names in source code, or the App Review contact in your listing), we process it on your behalf and only to carry out the check.

Legal basis for this section: Art. 6(1)(b) GDPR.

6. Payments

Paid plans are billed through Stripe. When you choose a plan we create a customer record at Stripe with your account name, your email address if we have one, your internal account number and your GitHub user name. You enter your payment details and billing address on Stripe's pages; we never see your card number.

We store the number of your Stripe customer record and of your subscription, its status, the end of the paid period and whether it has been cancelled. Invoices and payment records are kept at Stripe. Stripe also processes some data as a controller in its own right, for example to prevent fraud; see Stripe's privacy policy.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR where tax and commercial law require us to keep records.

7. When you write to us

If you send us an email we use your address and what you write to answer you. Legal basis: Art. 6(1)(b) GDPR if your message is about your account or a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).

8. Cookies

Nod sets only cookies that are strictly necessary to sign you in. They need no consent (§ 25(2) no. 2 of the German TDDDG), which is why there is no cookie banner. We do not use the browser's local storage.

Cloudflare may add a cookie of its own (for example __cf_bm) to tell browsers from automated traffic; it is likewise strictly necessary. When you pay, you are on Stripe's pages, where Stripe sets its own cookies.

9. Who receives data

We do not sell data and we do not pass it on for advertising. These companies receive data because the service cannot work without them:

• Hetzner Online GmbH (Germany). Hosts the server on which the website, the database, uploaded builds, screenshots and screen recordings are stored.
• Cloudflare, Inc. (USA, with data centres worldwide). Sits between your browser and our server. All requests to the website pass through Cloudflare, which decrypts and forwards them. This includes uploads.
• Scaleway SAS (Paris, France). Rents us the Mac on which the virtual machines for live runs are started. Your simulator build is installed there for the duration of a run.
• OpenRouter, Inc. (USA). Receives the material the AI model reads (store listing texts, source-code excerpts, simulator screenshots, pasted rejection messages) and passes it on to the provider that runs the model.
• Anthropic, PBC (USA). Develops the Claude models that write the findings. OpenRouter sends the requests to Anthropic or to a cloud provider that runs Anthropic's models (at the time of writing Amazon Web Services and Google Cloud).
• GitHub, Inc. (USA). Sign-in, and read-only access to the repositories you choose, through a GitHub App. GitHub learns that you use the service and when repositories are read.
• Apple Inc. and its affiliates (USA and Ireland). The App Store Connect API answers read-only requests made with the API key you provide. Apple learns that your key is used from our server.
• Stripe Payments Europe, Ltd. (Ireland, with transfers to Stripe, Inc. in the USA). Payment for paid plans: checkout, invoices and the billing portal.

Beyond that we disclose data only where the law obliges us to.

10. Transfers to countries outside the EU

Our server (Germany) and the Mac for live runs (France) are in the European Union. Cloudflare, OpenRouter and the companies that run the AI model, GitHub, Apple and Stripe process data in the USA, and some of them in other countries as well.

For the USA the European Commission has decided that companies certified under the EU-US Data Privacy Framework offer an adequate level of protection (Art. 45 GDPR). Where a recipient is not certified, the transfer is based on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). You can ask us which basis applies to a recipient and for a copy of the clauses.

11. How long we keep data

• Sessions: 30 days, or until you sign out. Signing out deletes the session at once.
• Source code: only for the duration of a check, in a temporary folder that is deleted when the check ends. Quotes inside findings stay with the results.
• Builds: the newest three per app, until you delete the app.
• Virtual machines of live runs: deleted when the run ends.
• App Store Connect key: until you disconnect it or delete the app.
• Apps and results of checks: until you delete the app. Deleting an app in the dashboard removes its checks, screenshots, screen recordings, rejection help, builds, the App Store Connect key and the upload token at once.
• Account: until you delete it. You can delete the account with everything that belongs to it in the dashboard under “Account & GitHub”; a paid plan has to be cancelled first. There is no automatic deletion of inactive accounts at present. You can also write to [CONTACT EMAIL] and we delete it for you.
• Invoices and payment records: for as long as German tax and commercial law require, which is up to ten years (§ 147 of the Fiscal Code, § 257 of the Commercial Code).
• Emails: until your request is dealt with, and longer only where the law requires us to keep business correspondence.

12. Your rights

Under the GDPR you have the right to:

• know whether we process data about you and receive a copy of it (Art. 15);
• have incorrect data corrected (Art. 16);
• have data deleted (Art. 17);
• have the processing restricted (Art. 18);
• receive the data you gave us in a machine-readable format, or have it sent to someone else (Art. 20);
• object, on grounds relating to your particular situation, to processing that we base on legitimate interests (Art. 21).

To use any of these rights, write to [CONTACT EMAIL]. We answer within one month. None of the processing described here is based on consent, so there is no consent to withdraw.

13. Right to lodge a complaint

You can complain to a data protection supervisory authority, in particular in the EU member state where you live or work or where you think the law was broken (Art. 77 GDPR). The authority responsible for us is the data protection authority of the German federal state in which we are based (our address is in the Legal Notice).

14. Whether you have to provide data, and automated decisions

No law obliges you to give us data. Without a GitHub sign-in you cannot use the dashboard, and a check can only cover the sources you connect.

We do not make decisions about you by automated means within the meaning of Art. 22 GDPR. The AI model assesses your app, not you, and its findings have no legal effect.

15. Security

The connection to the website is encrypted. App Store Connect keys are stored encrypted; session numbers and upload tokens are stored only as hashes. Each account sees only its own apps and checks. Live runs take place in a virtual machine that is created for that run, holds none of our keys and cannot reach the Mac it runs on.

16. Changes to this policy

We update this policy when the service or the law changes. The date at the top shows when it was last changed. The Terms of Service describe the service itself.