Privacy Policy

Shipcue is built to know as little about you as possible. This page explains what we store, where, and why.

Draft. This policy is a working draft and will be finalised before Shipcue is released. Updated 28 October 2026.

Who we are

Shipcue is made by AppLabs.lv (Latvia). Questions about this policy: privacy@shipcue.app.

The short version

• No account, no name, no email, no password.
• No analytics, advertising or tracking SDKs.
• In Private mode your App Store Connect API keys never reach our server.
• Our server only learns about you once you turn on Shipcue Pro and push notifications, or when you tap Send Test Notification in Settings (then it stores only your anonymous Shipcue ID and that device's push registration).

On our server

Our server runs in the EU (DigitalOcean, Frankfurt). Before you subscribe to Shipcue Pro and set up push, it knows nothing about you. Send Test Notification in Settings is the one exception: it works without Pro and registers that device (anonymous Shipcue ID and the device details below). Once you use Pro with push, the server stores:

• An anonymous Shipcue ID: the public part of a key your device made on first launch, plus a random ID for your subscription.
• For each device with push: its push token, model, iOS version, Shipcue version, language, time zone, which of your keys it holds (by fingerprint) and a hash of its session token. Sessions expire after 90 days without use.
• Account names you chose, the key type and a fingerprint of each key's public part, and for team keys a keyed hash of the Issuer ID; never the key or the Issuer ID itself.
• App names, bundle IDs, version numbers, review states and their history, including unreleased apps.
• For apps that are on the App Store: the public address of the app's icon, looked up in Apple's public App Store directory with the app's ID only, so notifications can show it. Refreshed weekly and deleted when no one tracks the app.
• Webhook routing data and encrypted webhook secrets, so we can verify that status updates come from Apple. Webhook events are kept for 30 days.
• Your notification settings, signed auto-release rules and timer times.
• Action history (what was released, withdrawn or cancelled, and from which device) and a 30-day push log.
• Delivery confirmations: the push ID and the time a notification reached your device (reported by the app when it arrives, not whether you opened it). Kept for 30 days.
• Whether Shipcue Pro is active and when it renews or ends, plus RevenueCat event records kept for 30 days.
• Encrypted backups of the above, kept for 30 days.
• Server logs with secrets and tokens removed, kept for about 7 days.

Server-assisted mode (planned for a later version, opt-in per account): an encrypted copy of that account's API key. It is never included in backups and is deleted immediately when you switch the account back to Private, disconnect it or delete your Shipcue data.

In your iCloud Keychain

End-to-end encrypted by Apple, synced to your own devices and included in your encrypted device backups. None of this reaches our server.

• Your API keys (.p8) with Key ID, Issuer ID and account name, except keys you choose to keep on one device only.
• Shipcue's signing key, which signs your auto-release rules so our server can't change them.
• A small record of your latest rules and cancelled timers.

On your device only

• API keys you chose to keep on one device. They are not synced and not backed up.
• Your session, cached status, theme and appearance settings.

Purchases

Apple processes all payments. We use RevenueCat to check subscription status; it receives a random Shipcue ID and your purchase history, never your name, email, API keys or app data.

What we don't collect

Your name, email address, Apple Account password, analytics or tracking data. Crash reports reach us only through Apple, and only if you have chosen to share analytics with app developers in iOS Settings.

Deleting your data

Delete Account in the app settings removes your data from our server (backup copies within 30 days) and your keys from your iCloud Keychain. Deleting does not cancel Shipcue Pro, which is billed by Apple, and does not revoke your API keys; do that in App Store Connect if you no longer use them.

Your rights

Under the GDPR you can ask for access to, correction of or deletion of your data, and you can complain to your local data protection authority. Because we don't know who you are, we may ask you to send the request from within the app.

Changes

If this policy changes, we will update this page and the date above, and mention significant changes in the app.