Privacy Policy

Last updated 12 October 2026

This policy explains what personal data ReleaseKit collects, why, who it is shared with, and your rights. The controller is Jules Le Prince, who operates ReleaseKit (see the legal notice). For any question or request: support@releasekit.dev.

What we collect

• Your account: your email, whether it is confirmed, your password (stored only as an Argon2id hash, never readable), and, if you sign in with GitHub or Apple, the account identifier and the name they give us.
• Your sessions: a cookie that keeps you signed in; the server keeps only a hash of it.
• Your plan: from Polar, your plan, its status and dates, and Polar's identifiers for you and your subscription. We never see your card or bank details.
• Your apps: what you upload and enter: app names, bundle identifiers, versions, release notes, archives, and the apps' Sparkle signing keys (stored encrypted).
• Emails we send: the time and kind of each email (no address and no content), to check that sending works.
• Network addresses: your IP address is held in memory, for at most an hour, to limit repeated sign-in attempts. We do not keep logs of IP addresses, and we use no analytics or tracking.

Why, and on what basis

• Providing the service you signed up for: your account, your apps, your plan (performance of the contract).
• Keeping the service and your account secure: rate limits, confirming your email, emails about your account (legitimate interest, and the contract).
• Billing and its records, kept by Polar (legal obligation).

We do not sell your data, and do not use it for advertising.

Who processes it

• PulseHeberg (SERVERD SAS, Paris, France): the server that runs the website and the database, in France.
• Cloudflare, Inc. (USA): stores your apps' files (R2), serves the update feeds and downloads to your app's users, and your custom domains.
• Polar (polar.sh): merchant of record for the plans. Polar processes your payment details as a controller under its own privacy policy.
• Resend (resend.com, USA): sends our emails, from its European region (Ireland).
• GitHub and Apple, only if you choose to sign in with them.

Some of these providers are in the United States. Transfers rely on the European Commission's standard contractual clauses, or on the EU-US Data Privacy Framework where the provider is certified.

Your app's users

When a copy of your app checks for updates or downloads one, its request goes to Cloudflare, which serves the file and sees the request's IP address and user agent, as any web server does. ReleaseKit does not receive these requests and keeps no record or count of them.

Cookies

ReleaseKit uses only the cookies the service needs, so it asks no consent: rk_session keeps you signed in (30 days), rk_oauth protects a GitHub or Apple sign-in while it happens (10 minutes). No advertising or analytics cookies.

How long we keep it

• Your account and apps: as long as the account exists. Deleting your account (Account page) deletes them at once, with their files.
• Nightly database backups are kept 30 days, so a deleted account leaves them within 30 days.
• After a plan ends, the account stays read-only for 90 days, after which its apps' files may be deleted.
• Email codes and links expire after an hour; the email log is kept 30 days.
• Billing records are kept by Polar as long as the law requires.

Security

Connections are encrypted (HTTPS). Passwords are hashed with Argon2id, sessions and email links are stored as hashes, and signing keys are encrypted with a key kept apart from the database and its backups.

Your rights

You can access, correct, export or delete your data, object to or restrict its processing. Most of it is in your hands: the Account page shows your sign-in methods and lets you delete your account; each app's settings let you download its signing key. For anything else, write to support@releasekit.dev; we answer within a month. You can also complain to the CNIL (cnil.fr) or the data protection authority of your country.

Changes

If this policy changes in a way that matters, you will be told by email before the change applies.