← Back

StoreRows Privacy Policy

Last updated: 2026-07-22

StoreRows is a Google Workspace add-on for Google Sheets that imports your own App Store Connect (ASC) sales and review data into your own spreadsheet.

Summary

StoreRows does not operate any server, and no StoreRows-controlled system ever receives your Google user data or your App Store Connect credentials. Everything runs inside your own Google account's Apps Script project and talks directly to Apple's App Store Connect API.

Google user data we access

The only Google user data StoreRows accesses is the content of the spreadsheet in which you have installed and opened the add-on, via the https://www.googleapis.com/auth/spreadsheets.currentonly scope. Specifically, the add-on:

• Reads the Sales, Reviews, and Dashboard sheets it created, to determine what has already been imported.
• Writes imported App Store sales and review rows into those same sheets.

StoreRows does not access your Google account email address, profile, contacts, Gmail, Calendar, Google Drive files other than the currently open spreadsheet, or any other Google user data. The remaining scopes (script.external_request, script.container.ui, script.scriptapp) do not grant access to Google user data; they allow the add-on to call Apple's API, show its sidebar, and manage its optional daily refresh trigger.

How we use Google user data

• Spreadsheet content is read and written solely to provide the add-on's single user-facing feature: importing your App Store Connect sales and review data into your own spreadsheet.
• Your spreadsheet content is processed only inside your own Google account's Apps Script runtime. It is never transmitted to the developer or to any third party, never used for advertising, never sold, and never read by any human.
• StoreRows' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• AI/ML disclosure: StoreRows does not use any Google Workspace user data (including spreadsheet content) to develop, improve, or train generalized or non-personalized artificial-intelligence and/or machine-learning models.

What other data the add-on handles

• App Store Connect API credentials you enter: Issuer ID, Key ID, the private key (.p8) contents, and your Vendor Number.
• Your App Store data returned by Apple: sales/units/proceeds and customer reviews for the apps you choose.
• A short license key, if you enter one, to unlock Pro features.

Where it is stored

• Credentials and settings are stored using Google Apps Script's PropertiesService (User properties), scoped to your Google account. They are not written into the spreadsheet and are not visible to other editors of the sheet.
• Imported sales and reviews are written to sheets in your own spreadsheet, which you fully control.
• The developer operates no server and no database; nothing is stored outside your Google account and your spreadsheet.

Where data is sent

• Apple's App Store Connect API (api.appstoreconnect.apple.com) — authenticated with a short-lived (≤20 minute) token the add-on generates from your key. Requests are made by your own Apps Script project. Your spreadsheet content is never sent to Apple.
• Dodo Payments' license API (live.dodopayments.com) — only if you enter a Pro license key, and only the license key string itself is sent for activation/validation. No Google user data and no App Store data is ever sent to Dodo Payments.
• The add-on's manifest technically restricts outbound requests to exactly these two hosts. There is no analytics, tracking, or telemetry.

How we protect your data

• Encryption in transit: all external requests (Apple, Dodo Payments) are made exclusively over HTTPS/TLS. The add-on cannot make plain-HTTP requests.
• Encryption at rest: stored properties and spreadsheet content reside in Google's infrastructure and are encrypted at rest by Google.
• Isolation: sensitive credentials (your ASC private key, license key) are kept in User properties, which other editors of the spreadsheet cannot read, and are never written into the sheet or logs.
• Least privilege: the add-on requests the narrowest available spreadsheet scope (spreadsheets.currentonly — the current file only, not your Drive), and its outbound network access is allow-listed to two hosts in the manifest.
• Short-lived tokens: Apple API tokens are generated per session and expire within 20 minutes; the add-on stores no long-lived session tokens.
• No developer-side copies: because there is no StoreRows server, there is no developer-side data store to breach.

Sharing

We do not sell, share, or transmit your data to anyone. Access is governed entirely by your Google account and your App Store Connect account.

Your control & data deletion

• Remove stored credentials at any time by clearing the fields (or uninstalling the add-on, which removes its user properties).
• Delete imported data by deleting the Sales, Reviews, or Dashboard sheets.
• Revoke the add-on's access to your Google account at any time from Google Account › Security › Third-party access.
• Revoke the API key in App Store Connect to cut off all access immediately.

Scopes requested and why

• spreadsheets.currentonly — read/write the active spreadsheet to append data (the only scope that touches Google user data).
• script.external_request — call the App Store Connect API (and Dodo Payments for license validation).
• script.container.ui — show the sidebar and menu.
• script.scriptapp — create/remove the optional daily auto-update trigger.

Changes to this policy

If this policy changes, the updated version will be published at this URL with a new “Last updated” date.

Contact

Questions about privacy or data handling: taro@taronogu.com