Privacy & Data

OpenConnect runs on your own machine. It has no account with Odd Omens, no analytics and no crash reporting, and Odd Omens never receives your data.

What It Stores, and Where

Everything is in the ./data folder next to docker-compose.yml (or DATA_DIR without Docker):

• dashboard.db, a SQLite database with:
  • your apps (name, bundle ID, SKU, icon, category, price, current version, release date),
  • every line of the sales, subscription and subscription event reports it has downloaded,
  • impressions and product page views,
  • customer reviews (rating, title, text, the reviewer's nickname, country, date) and your responses,
  • ratings and chart positions per storefront and day,
  • exchange rates,
  • settings: your API key details if entered in Settings (including a pasted .p8 key), sync options and dashboard layout,
  • sign-in data: the password hash, hashes of session tokens (with each session's browser user agent) and hashes of API tokens.
• studio/, the screenshot studio's projects, uploads, previews and exports.

Your API key file stays in ./keys, mounted read-only. The database is readable by its owner only.

Nothing personal is built into the Docker image or committed to git: .env, keys/, data/, *.p8 and *.pem are excluded from both.

What Leaves Your Server

Only requests to Apple and to one exchange-rate service:

Destination	What for
api.appstoreconnect.apple.com	Your apps, sales and subscription reports, analytics reports and customer reviews, signed with your API key.
itunes.apple.com and rss.marketingtools.apple.com	Public App Store data: ratings and listing details per storefront, top-chart feeds, and the App Store listing used by promo cards. No key is sent.
open.er-api.com	The latest exchange rates against the US dollar, at most every 12 hours. Nothing about you or your apps is sent.

Your browser also loads app icons and App Store screenshots from Apple's image servers (*.mzstatic.com).

The impressions setup creates analytics report requests in your App Store Connect account. Apart from that, OpenConnect only reads from App Store Connect.

When Claude uses the screenshot studio, Claude sees what its tools return (app profiles, slide text, preview images) as part of your conversation, under your Claude account's terms. API tokens can't reach your sales data.

Permissions

OpenConnect needs an App Store Connect API key with the roles listed in Installation. Use the least access that covers what you want to see: a Sales key covers everything after the one-time impressions setup.

Exporting and Deleting Your Data

• Back up or move everything: copy the ./data folder. See Updating.
• Marketing cards and screenshots: download them from the Marketing page and the studio.
• Delete everything: stop the container and delete ./data. Then revoke the API key in App Store Connect under Users and Access > Integrations if you no longer need it.
• Remove a pasted key: Settings has no button to remove a pasted .p8 key. Revoke the key in App Store Connect, or start over.