Privacy Policy

When you paste text or upload content into Subtext:

• The text is processed temporarily to generate your requested analysis.
• The text is not stored after the result is returned.
• We do not sell, share, or use submitted text for advertising purposes.
• We do not use submitted text to train models.

Text is processed only to provide the service you requested.

If you upgrade to a Subtext Pro subscription:

• You must create an account.
• We may store your email address and subscription status.
• Payment processing is handled by third-party providers. We do not store full payment details.

Free users are not required to create an account.

Free access may be limited to one analysis per device per day.

To enforce this limit:

• A local device-based record may be stored in your browser.
• This record does not contain your message content.

No account is required for free usage.

• You sign in with your Google account. An account is required to use AppShip.
• Google shares your name, email address and profile picture with us. These are kept with your account record by our sign-in provider, Supabase.
• We also store your email address, your account role and settings (for example, admin or tester access) and the date you joined.
• Your signed-in session is kept in your browser’s local storage so you stay logged in.

To upload to Apple, AppShip asks for your App Store Connect API Key ID, Issuer ID and private key (.p8).

• These are held in your browser only while the page is open.
• Each time Apple needs a fresh token, they are sent over an encrypted connection to our server, which uses them to create a short-lived token (valid for 20 minutes) and returns it to your browser.
• We do not save your private key, Key ID or Issuer ID to our database or logs.
• They are cleared when you reset the form or close the page.

We recommend using an API key with the lowest role that can upload builds, and revoking it in App Store Connect when you no longer need it.

• Your .ipa file is read on your device and sent in parts, through our server, straight to Apple’s upload location.
• We do not keep a copy of your build.
• We keep a record of each upload: your email address, the App Store app ID, version and build number, file name and size, upload status, any error message, and the request and response of the final upload step with Apple.

This record lets you see your upload history and helps us fix failed uploads.

If you complete the pre-flight checklist, we store your answers (for example, whether your app has a privacy policy or a developer account) and your progress, linked to your email address.

• Messages you send to SAL, the in-app assistant, are sent to our AI provider (Anthropic) to generate a reply.
• We do not store your SAL messages.
• Please do not paste your private key or other secrets into SAL.

• Payments are taken by Stripe on its own checkout page. We never see or store your card details.
• We store your email address, the plan bought, the Stripe payment reference, the purchase date, the expiry date for annual plans, and how many submissions you have used.

• Supabase — database, sign-in and server functions (data stored in London, UK)
• Vercel — website hosting
• Google — sign-in
• Apple — receives your build and the upload requests you make
• Stripe — payments
• Anthropic — SAL assistant replies

Some of these providers process data outside the UK. Where they do, we rely on the transfer safeguards they provide under UK data protection law.

• Your account, upload records and checklist answers are kept while your account is open.
• If you ask us to delete your account, we delete this data within 30 days.
• Purchase records are kept for six years to meet UK tax and accounting rules.

AppShip does not use advertising or analytics cookies. It stores only your sign-in session and a note that you have seen the introduction screen, both in your own browser.

• The Companies House public register: the company name and number, its registered office address, and the name and role of one director.
• The company’s own website: its web address and logo.
• We take only a director’s name and role from the register. We do not collect or store dates of birth or other personal details.

• We post the item to the company at its registered office. It may be addressed to the director.
• We print your company’s logo and a QR code on a card inside it.
• We keep a record in a spreadsheet and a database, so we know what has been posted and do not contact you twice.

• The code opens a page on this website made for your company. It shows your company name. It does not show the director’s name.
• We record that the code was scanned, when, and how many times. We do not record who scanned it.
• As on every page of this site, the visit also appears in our basic visit statistics (see section 6).
• Nothing you type is sent until you press the button. If you complete the automation check, we receive your answers and the email address you give, and use them to send you the summary you asked for.

Our lawful basis is legitimate interests. We think the owner of a business may find our services useful, and one piece of post is a small intrusion. We have recorded our reasoning in a legitimate interests assessment, which we can share on request.

You can ask us not to contact you again at any time by emailing alison@black-box.solutions. We will stop straight away. Your right to object to direct marketing is absolute, and you do not need to give a reason.

We keep only your company number on a do-not-contact list, so that we do not add you again.

• Google — spreadsheet and file storage
• Supabase — database (data stored in London, UK)
• Vercel — website hosting
• n8n — workflow automation
• Brave Search — used to find a company’s website; it receives the company name

Some of these providers process data outside the UK. Where they do, we rely on the transfer safeguards they provide under UK data protection law.

• Lead records are kept for up to 12 months after we add them.
• If you get in touch, we keep your details while we are talking or working together.
• Do-not-contact entries are kept so that we can honour your request.