DashlyticsPrivacy Policy
Your data stays between you and your providers.
Dashlytics has no account system and no server of its own. This page explains what the app and this website do with data, who else is involved, and what you can do about it.
The short version
- No Dashlytics server. The app talks directly to the providers you connect. Nothing you see in the app passes through us.
- Your credentials stay in the Keychain. API tokens and Google sign-ins live in your device's Keychain and, if you leave iCloud Sync on, in your end-to-end encrypted iCloud Keychain.
- No tracking, no ads, no analytics in the app. The app uses no analytics, advertising, or tracking of any kind. This website counts visits with Vercel Web Analytics, without cookies and without identifying you.
- Purchases go through Apple. No one else is involved, and no company sees your provider data.
- Who we are
- The app
- Services the app contacts
- Google user data
- Purchases
- This website
- Your rights
- Deleting your data
Who is responsible
The controller for the processing described here is:
Jonas Gehring
Am Blumenstrich 32
69151 Neckargemünd, Germany
Email: apps@jonasgehring.com
We are not required to appoint a data protection officer. Questions about privacy go to the address above.
What the app handles, and where it stays
Dashlytics is a client for other services. You connect an account at a provider (for example Vercel, Namecheap, or Google Search Console), and the app shows you that account's data. We do not receive, store, or see any of it.
| API tokens and keys | Stored in the Keychain on your device, one item per connected account. With iCloud Sync on (the default), these items are synchronized through iCloud Keychain, which is end-to-end encrypted: Apple cannot read them. With iCloud Sync off, they never leave the device. Only Dashlytics can read them, and only once the device has been unlocked after it started, so checks can run while the app is closed. Tokens are never written to logs, caches, or files. |
|---|---|
| Google sign-ins | The OAuth access and refresh tokens, and the email address of the Google account you signed in with, are stored in the Keychain in the same way. |
| Provider data | Projects, deployments, domains, analytics, and everything else the app displays is fetched directly from the provider. So that Home can tell you what needs you as soon as it opens, the app checks every connected account when it starts and when you return to it, and keeps a summary of each one on your device: the names of your projects, domains, apps, and properties, their status, expiry dates, and metric values. The summary sits in a protected file in the app's own storage on this device, is excluded from backups, is not synced to your other devices, and never contains your credentials or your account names. Disconnecting an account deletes its summary; disconnecting all accounts deletes every summary. Everything else is held in memory while the app runs. |
| Views and hidden items | The views you create and the items you hide are stored in the Keychain and follow the iCloud Sync switch, like your accounts. |
| Settings and recent items | Tab order, appearance, the app lock setting, and the last eight items you opened are stored on the device only. |
| Notifications | Domain reminders and alerts are scheduled and shown by your device's own notification system. No push service and no server is involved. With background checks or the morning brief on (Dashlytics Pro), the app contacts the same provider APIs while it is closed, directly from your device, and keeps up to 35 days of daily numbers (visitors, downloads, proceeds, clicks, uptime) for the brief in the same protected file. Which notifications you want is stored on the device only. |
| Widgets and menu bar | Widgets, the Control, and the Mac menu bar show the same summary Home shows, read from the app's own protected storage on this device. They never contact a provider or read your credentials, and with the app lock on they show counts only. |
| Namecheap client IP | The public IP address you enter or detect for Namecheap is stored on the device only and never synchronized. |
| App lock | Face ID, Touch ID, Optic ID, and your passcode are handled entirely by Apple's operating system. The app only learns whether unlocking succeeded. |
Because none of this reaches us, we cannot view, export, or recover it for you. The legal basis for processing on your device is the performance of our contract with you, Art. 6(1)(b) GDPR.
Services the app contacts
The app only connects to the following. Every connection uses HTTPS without cookies or a shared cache.
The providers you connect
When you connect an account, the app sends requests with your token directly to that provider's API, for example api.vercel.com or api.namecheap.com, or to a self-hosted address you entered yourself. Like any server, the provider sees your IP address and the requests. The provider's own privacy policy applies to that account. Dashlytics is not affiliated with any provider.
Some actions change data at a provider, such as editing a DNS record or purging a cache. The app always asks for confirmation before it sends one.
Your project's own website
To show a project's icon, the app may load the favicon from that project's own HTTPS address. No third-party favicon service is used.
ipify
Namecheap and Name.com only accept requests from allowlisted IP addresses. When you open the connection form for one of these two registrars, the app asks api.ipify.org for your public IPv4 address, so you can copy it into the registrar's allowlist. ipify sees your IP address and nothing else: no token, no account data. This happens only on that form, never in the background.
Apple
Apple processes App Store purchases, iCloud Keychain, and, if you agreed to share them with developers, crash reports and usage statistics under Apple's privacy policy.
Google user data
This section describes exactly how Dashlytics handles data it receives from Google APIs. It applies to the three integrations that use Google sign-in: Google Search Console, Google Analytics, and Firebase Hosting. You choose which of them to connect, and each one asks Google only for its own permission.
What Google user data the app accesses
| Your Google account | Scopes openid and email. The email address of the Google account you sign in with, used only to label the connection in the app. The app does not request your name, profile photo, contacts, or any other account data. |
|---|---|
| Google Search Console | Scope webmasters.readonly (read-only). The list of Search Console properties you have access to; search performance for those properties (clicks, impressions, click-through rate, and average position, broken down by date, search query, page, country, and device); your sitemaps and their status; and URL Inspection results for pages you inspect. |
| Google Analytics | Scope analytics.readonly (read-only). The Analytics accounts, GA4 properties, and data streams you have access to, and aggregated report data for the property you open: active users, sessions, page views, engagement rate, event count, and session duration, broken down by date, traffic source and channel, page path and title, event name, country and city, and device category, browser, and operating system; plus the realtime active-user count. These are aggregated figures that Google Analytics reports for your property. The app does not access data about individual visitors. |
| Firebase Hosting | Scope firebase.hosting. Your Firebase Hosting sites, their versions, releases, preview channels, and custom domains. This scope also allows changes. The app sends a change only when you start it yourself in its API explorer and confirm it in a dialog; it never changes anything on its own. |
| Sign-in tokens | The OAuth access token and refresh token Google issues when you sign in, so the app can load this data without asking you to sign in every time. |
How the app uses it
Google user data is used only to show you your own Search Console, Analytics, and Firebase Hosting data inside the app, and, for Firebase Hosting, to carry out changes you confirmed. It is not used for any other purpose. In particular, it is not used for advertising, not used to build profiles, not used to determine credit-worthiness or for lending, and not used to develop, improve, or train artificial intelligence or machine learning models. No person at Dashlytics can see it.
With whom it is shared
Dashlytics does not share, transfer, sell, or disclose Google user data to anyone. The app sends requests from your device directly to Google's own API servers (googleapis.com), and the responses come back directly to your device. There is no Dashlytics server in between, so the data never reaches us.
The data is not given to advertisers, data brokers, analytics providers, AI services, or any other third party. The only place any of it leaves your device is your own iCloud Keychain, if you leave iCloud Sync on: your Google sign-in tokens, and the identifiers of properties or sites you hide or add to a view, are synchronized to your other Apple devices through iCloud Keychain, which is end-to-end encrypted, so Apple cannot read them. Report data such as your traffic figures is never synchronized. We would disclose Google user data only if required by law, and we cannot, because we never have it.
How it is protected
- Encrypted in transit. Every request to Google uses HTTPS (TLS), without cookies or a shared cache, and the app refuses redirects to any other host.
- Tokens in the Keychain. OAuth tokens are stored only in the Apple Keychain, which is encrypted by the operating system and readable only by Dashlytics, and only once the device has been unlocked after it started. With iCloud Sync on, they are synchronized as end-to-end encrypted iCloud Keychain items; with it off, they never leave the device. Tokens are never written to logs, caches, or files.
- No server, no copies. Report data is held in memory while you use it. On the device, the app keeps only a small summary for the Services overview (property names and headline numbers), in a file inside the app's own container that is protected by the operating system's data protection and excluded from backups, and the titles of the last eight items you opened, which never leave the device.
- Sign-in through Google. You sign in on Google's own page in a secure system browser sheet, using PKCE. The app never sees your Google password.
- Optional app lock. You can lock the app with Face ID, Touch ID, Optic ID, or your device passcode.
How long it is kept, and how to delete it
- Report data in memory is discarded when you close the app or disconnect the account.
- The Services summary and the sign-in tokens are kept until you disconnect the Google account in the app. Disconnecting deletes both. With iCloud Sync on, the tokens are also removed from every other device that syncs them; with it off, the app asks whether to remove only this device's copy or the one in your iCloud Keychain as well. Settings → Disconnect all accounts also clears the recently opened items. Deleting the app deletes the summary file and the recent items.
- You can revoke Dashlytics' access at any time in your Google Account permissions. The app then can no longer load any data and asks you to sign in again.
Limited Use
Dashlytics' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Purchases
Dashlytics Pro subscriptions and the lifetime purchase are sold through the App Store. Apple processes the payment; we never see your name, Apple Account, or payment details.
To know whether Pro is active, the app asks StoreKit on your device which purchases are current and checks Apple’s signature there. Nothing about your purchases is sent to us or to anyone else, and there is no account or user ID on our side. We see only the aggregate sales figures Apple reports to every developer in App Store Connect.
This is why the app's App Store privacy label says "Data Not Collected".
This website
This website is hosted by Vercel (Vercel Inc., USA). When you visit it, Vercel's servers process your IP address, the page requested, the time, your browser's user agent, and the referring page, in order to deliver the site and protect it against abuse. These logs are kept for a short period. The legal basis is our legitimate interest in running a secure website, Art. 6(1)(f) GDPR. Vercel is bound by a data processing agreement, and transfers to the USA rely on the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. See Vercel's privacy policy.
To see how many people visit the site and which pages they read, the website uses Vercel Web Analytics. Its script is served from this domain, sets no cookies, and stores nothing on your device. For each page view it records the page, the referring page, your approximate location (country, region, and city, derived from your IP address, which is not stored), and your browser, operating system, and device type, each with its version. To count a visitor only once per day, Vercel forms a hash from the request that is discarded after 24 hours, so visits cannot be linked across days or to you as a person. We see only aggregated figures. The legal basis is our legitimate interest in understanding how the site is used, Art. 6(1)(f) GDPR; the same data processing agreement with Vercel applies. See Vercel Web Analytics privacy.
The website sets no cookies and loads no fonts, scripts, or images from third parties. If you use the light/dark toggle, your choice is saved in your browser's local storage and never leaves your device.
If you write to apps@jonasgehring.com, for support or to be told about the launch, we use your address and message only to answer you, or to send that one launch email. We delete launch requests after the launch and support conversations once they are resolved, unless the law requires us to keep them. The legal basis is Art. 6(1)(b) or, for launch requests, your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time by replying.
Children
Dashlytics is a tool for people who run websites and apps. It is not directed at children, and we do not knowingly collect data from them.
Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
Since the app keeps your data on your devices, the data we hold about you is limited to emails you sent us. Your purchase record is held by Apple; requests about it go to Apple.
Deleting your data
- One account: open the workspace, choose the account, and disconnect it. With iCloud Sync on, its Keychain item is deleted on every device that syncs it, and a short record of which item was removed and when (no keys, no account names) stays in your iCloud Keychain for 400 days so that no other device brings it back. With iCloud Sync off, the app asks whether to delete only this device's copy or the copy in your iCloud Keychain as well.
- Everything: Settings → Disconnect all accounts removes every connected account together with your hidden and recently opened items. Views you created stay until you delete them.
- Google access: revoke it in your Google Account permissions.
- At a provider: delete the API token you created in that provider's dashboard.
- Deleting the app removes its local files. Synchronized Keychain items stay in iCloud Keychain until you disconnect them from another device or delete them in the Passwords app.
Changes to this policy
If the app or this website starts processing data differently, we update this page and the date at the top before the change ships. Material changes are also mentioned in the app's release notes.