Privacy Policy

RevBell (formerly ReviewBell) is a Mac app for managing App Store and Google Play reviews and, if you enable it, customer messages sent to a RevBell-hosted support address. This policy describes the data each feature handles.

1. Store credentials and review data

• For App Store Connect, RevBell uses the App Store Connect API key (.p8) that you provide. For Google Play, RevBell asks you to sign in with Google and approve the Google permissions shown on the consent screen.
• App Store credentials and Google OAuth access and refresh tokens are stored only on your Mac, in the macOS Keychain. They are never stored on RevBell's servers. There are two exceptions to "never transmitted": to confirm an app is yours for real-time sales (see Real-time sales notifications below), and for each optional Google Ads read (see Optional AdMob and Google Ads connections below), RevBell sends a short-lived Google access token to its server, which uses it only for those Google API calls and discards it.
• RevBell calls Apple's and Google's official APIs directly from your Mac. Google Play access is used to list apps, read reviews and reports, submit replies you approve, and read the order or subscription information needed for enabled sales features.
• If you provide a Google Play historical-report bucket, RevBell uses read-only Google Cloud Storage access only to import that bucket's Play Console reports. It does not create, change, or delete Cloud Storage objects.
• Real-time Google Play sales are optional. When you turn them on, you paste RevBell's topic into your app's Play Console (see Real-time sales notifications). Connections set up before September 2026 may instead use a topic and subscription in your own Google Cloud project, which RevBell keeps reading until you remove it.
• Reviews, drafts, translations, triage tags, and settings are cached in an on-device database. You can remove this local data by removing the connection or deleting the app's data.
• When you request an AI feature for a review, turn on email AI, or use automatic review analysis on Pro, the relevant bounded review or support-message text and necessary tone or template settings are sent over HTTPS to a RevBell Cloudflare Worker and then to OpenAI, which produces that result, and to TypeSafe, which selects relevant earlier context and checks generated drafts and translations. Dedicated sender and recipient address fields and attachment content are excluded from this AI payload, but text supplied by a sender may itself contain names, addresses, or other personal information.
• Urgency triage runs automatically on every plan, including Free: the title and text of each new review, with the app name and review language, are sent over HTTPS through the same Worker to TypeSafe, which returns an urgency label, topic and reason. Reviewer names, account details and credentials are not sent.
• RevBell does not use review or support-message content to train an AI model.

Google OAuth scopes and exact uses

RevBell requests the following scopes when you connect Google Play. These are the narrowest scopes Google provides for the production features described below; RevBell does not request the broader cloud-platform scope.

• openid and email: authenticate the Google sign-in session, read the selected account's primary email address, and show which Google account is connected.
• https://www.googleapis.com/auth/androidpublisher: read Google Play reviews, submit only the review replies you approve or explicitly configure for eligible automation, and read the order, subscription, and voided-purchase information used by the enabled sales features. Google does not provide narrower method-specific scopes for these Android Publisher operations.
• https://www.googleapis.com/auth/playdeveloperreporting: discover the package names and display names of apps the signed-in developer can access. Google exposes one scope for the Play Developer Reporting API.
• https://www.googleapis.com/auth/devstorage.read_only: list and download Play Console review, install, and financial report files only from the historical-report bucket URI you provide. This read-only scope cannot create, change, or delete Cloud Storage objects.
• https://www.googleapis.com/auth/pubsub (only for connections that completed the earlier per-project real-time setup; new setups no longer request it): create or reuse the fixed reviewbell-rtdn topic and pull subscription in the Google Cloud project you select, add the publisher and subscriber IAM bindings needed for Google Play real-time developer notifications, and pull, acknowledge, or extend the acknowledgement deadline for those notifications. Google does not offer a narrower Pub/Sub scope for these operations.
• https://www.googleapis.com/auth/service.management (earlier per-project setup only; no longer requested for new setups): enable only the Cloud Pub/Sub API in the Google Cloud project you select so the in-app real-time notification setup can complete. RevBell does not use this scope to enable, disable, or configure other Google services, and requests it instead of the broader cloud-platform scope.

Optional AdMob and Google Ads connections

AdMob and Google Ads are separate, optional connections. Each asks for its own Google sign-in, requesting only openid, email and the one scope below, and only when you choose to connect it in Settings or onboarding. Connecting Google Play never requests them.

• https://www.googleapis.com/auth/admob.readonly: read your AdMob account (publisher ID, reporting currency and time zone), its app list (app names, platforms and store IDs, used to match each AdMob app to your store app), and the AdMob Network report (daily estimated earnings, impressions, clicks, ad requests and matched requests per app). RevBell shows these earnings next to your store revenue. This read-only scope cannot change ads, ad units, mediation, payments or account settings. These calls go directly from your Mac to admob.googleapis.com.
• https://www.googleapis.com/auth/adwords: Google offers no read-only Google Ads scope. RevBell uses it only to list the Google Ads accounts you can access (account ID, name, currency, time zone and manager link) and to read, per campaign and day, cost, clicks and impressions, with each campaign's name and linked app ID and store, so it can show ad spend next to revenue. RevBell never creates, changes, pauses or removes campaigns, budgets, bids, ads or billing. Because Google Ads API access belongs to RevBell's Cloud project, each read sends a short-lived access token over HTTPS to RevBell's Cloudflare Worker. The Worker checks the token with Google, makes only these fixed read-only queries, returns the result to your Mac, and stores neither the token nor the report; error messages never include it.
• The AdMob and Google Ads refresh tokens stay in the macOS Keychain. Their earnings and spend are stored in the app's on-device database. Disconnecting AdMob or Google Ads in Settings removes its credential from the Keychain. Earnings or spend already downloaded stay in the on-device database until you delete the app's data or uninstall the app. You can also revoke ReviewBell from your Google Account.

Google API data storage, transfer, retention, and deletion

• The raw Google data RevBell can access consists of the selected account email; accessible app package and display names; review identifiers, ratings, text, author display names, language or country, app version, device details, and developer replies; the report files and metrics in the bucket you select; purchase, subscription, order, and voided-purchase status needed for enabled sales features; and the Pub/Sub resources and real-time notification payloads created for the apps you select. If you connect them, it also includes the AdMob and Google Ads account details, app or campaign lists, and daily earnings or spend described above.
• Google OAuth tokens stay in the macOS Keychain. Imported Google data, derived dashboard totals, drafts, translations, classifications, and settings are stored in the app's on-device database. RevBell does not upload refresh tokens or report-bucket contents. Order and purchase details stay on your Mac unless you explicitly enable the ChatGPT/dots connection described below. Data used by real-time sales is described in the next section.
• When an enabled AI review feature runs, RevBell may send a bounded payload containing the review identifier, rating, title or body, territory or language, optional app name, your selected tone, template, or recent published-reply samples, and, for reply drafts, earlier answered reviews of the same app (with their published replies) and issue-status notes you recorded, to a RevBell Cloudflare Worker, OpenAI and TypeSafe solely to return the visible classification, translation, summary, theme, or reply draft. OpenAI writes these results; TypeSafe provides urgency triage, selects which earlier reviews or notes are relevant, and checks generated drafts and translations. Reviewer display names, Google account emails, OAuth tokens, report files, purchase data, Pub/Sub payloads, and device details are excluded from this AI payload.
• Removing a Google Play connection clears its credential and associated local connection data. You can also revoke ReviewBell from your Google Account and remove on-device data by deleting the app's data or uninstalling the app.
• If you used the earlier per-project real-time setup, those Google Cloud resources remain in your Google Cloud project under your control. Because removing the connection does not delete those cloud resources, you must delete the reviewbell-rtdn topic, subscription, or IAM bindings in Google Cloud if you no longer want to retain them.

Real-time sales notifications

• Google Play. When you paste RevBell's topic (projects/reviewbell-play-production/topics/reviewbell-rtdn) into an app's Play Console, Google Play sends that app's real-time developer notifications to RevBell's server. For each notification RevBell stores only the package name, notification type, purchase token, product ID, order ID when present, and event time, for at most 7 days. It never stores buyer identifiers (notifications' obfuscated account or profile IDs are discarded). Notifications for an app whose ownership has not been confirmed are discarded on arrival (test notifications are kept for at most 10 minutes so setup can finish).
• Confirming the app is yours. So that only you can read your apps' notifications, RevBell's Mac app sends a short-lived Google access token (the androidpublisher permission you already granted) to RevBell's server about once a day. The server uses it for exactly two Google API calls — Google's token-information endpoint, to check the token was issued to ReviewBell, and a read of the app's voided-purchase list, which Google only allows for accounts that can view the app's financial data — then discards it. The token is never stored or logged. RevBell keeps only the fact that the app was confirmed, when, and the confirming Google account's email, and deletes a confirmation 30 days after it was last renewed. The worker never calls any other Google API with your token.
• Reading them. Your Mac pulls the stored notifications for your confirmed apps and resolves each purchase token with your own Google credential on your Mac; order amounts and details stay on your Mac unless you explicitly enable the ChatGPT/dots connection described below. A persistent connection from your Mac to RevBell's server only carries a signal that new data is available — never sales data.
• App Store. If you switch on real-time App Store revenue for an app, Apple sends that app's App Store Server Notifications to RevBell's server, which verifies Apple's signature and keeps only transaction identifiers, product, price, currency, storefront, dates, and environment for 45 days — never the raw notification or the app account token.
• Removing a connection or resetting RevBell deletes the Mac's real-time client on RevBell's server together with its app confirmations. Every confirmation attempt is logged for 90 days for security, with the confirming Google account's email and never a token.
• Turning real-time App Store revenue off for an app, or resetting RevBell, ends that app's endpoint on RevBell's server: its stored notifications are deleted and later notifications are refused. If your Mac has not collected an endpoint's notifications for 90 days, RevBell deletes the ones it holds and stores no new ones until your Mac collects again.

Optional ChatGPT / dots connection

When you choose Connect to dots and approve ReviewBell in ChatGPT, you authorize your own ChatGPT account to read RevBell activity. Starting an event-monitoring task in ChatGPT enables automatic analysis and notifications for new activity. During connection and later in RevBell connection settings, you can choose individual API capabilities and notification categories, pause all automatic notifications while retaining on-demand access, and opt in to historical data synchronization. ChatGPT can additionally restrict a monitor to particular apps or event types.

• New review events include the app and review identifiers, rating, title, text, territory, and app version. New sales events may include app, transaction and product identifiers, product name, event type, price, currency, country, time, and production environment. Purchase-state events can arrive before their amount is available.
• Support-email events identify the message and thread. ChatGPT can request the current accessible inbox and thread, including subject, message text, contact details needed for the conversation, and reply status. Existing account and subscription access rules still apply. Store API keys, Google refresh tokens, and raw report files are not shared with ChatGPT.
• RevBell sends these events over HTTPS through its Cloudflare service to OpenAI/ChatGPT so your dot can summarize, translate, prepare replies, and notify you. Event payloads and webhook signing keys are encrypted in RevBell's database. Event records are retained for up to 30 days. Events waiting for upload remain in your Mac's local database until acknowledged or the connection is removed.
• If you enable historical data, RevBell synchronizes the reviews, production transactions, app metadata, daily store metrics, and AdMob metrics already collected on your linked Mac. Each record of this copy is encrypted, except the fields needed to add up sales on the server — amount, currency, sale type, app identifier and, for Stripe, the connected account identifier — which rely on Cloudflare's encryption at rest. The copy is separate from the 30-day event journal and does not trigger notifications for old records. It is kept until you disable historical sync or disconnect, or until 30 days after your Pro subscription and introductory Pro period have ended, whichever comes first; each removes the server copy without deleting your original data. Store report files, API keys, and refresh tokens are not included.
• With the reply permission, ChatGPT can submit the final reply you instruct it to send. Email uses RevBell's existing delivery service; store review replies are posted through your connected Mac. An accepted or queued reply is distinguished from confirmed delivery or publication.
• You can stop a monitoring task in ChatGPT, revoke its app connection, or choose Disconnect in RevBell. Disconnecting in RevBell revokes the connection's grants and removes its subscriptions, stored event records, historical copies, and device link. It does not remove the original reviews, sales, or support messages. Content already received by ChatGPT follows your OpenAI account settings and OpenAI's privacy policy.

Optional Stripe revenue connection

When you connect Stripe, you approve read-only access in Stripe's own authorization screen. RevBell's Cloudflare-hosted server exchanges that authorization for encrypted access and refresh tokens. The server uses these tokens to read your connected account's identifier and display name, payments, refunds, invoices, Checkout line items, products, prices, and relevant events so your Mac can show revenue and sales notifications. You do not provide your own Stripe secret API key to the Mac app.

Cloudflare stores the encrypted tokens, connection and synchronization records, and normalized payment, refund, product, and price records. These include Stripe object identifiers, amounts, currencies, statuses, timestamps, and product names. The revenue database does not store buyer names, email addresses, postal addresses, payment-card details, or raw webhook payloads. Stripe data is not sent to our AI providers for this feature.

The initial import covers recent history, normally the previous 30 days. Server event and change records are pruned after 30 days, and transaction records after 45 days without an update; the Mac keeps its downloaded history locally. Account and catalog records remain while a connection needs them. Disconnecting in Settings removes this Mac's server connection. When the last Mac disconnects from that account and environment, the server deletes the grant, encrypted tokens, and associated revenue and catalog records. Local history can be removed using the disconnect option. You can also revoke the app's access in Stripe's installed-app settings.

2. Hosted support-email account

Creating or managing an address at hello-support.com requires Sign in with Apple. We request only the Apple identity needed to authenticate you; the app does not request your Apple name or email scopes for this feature.

• We store a keyed, non-reversible representation of your Apple user identifier, account and session identifiers, subscription entitlement, project and source assignments, and security/audit events.
• If Apple provides an authorization code, we exchange it for an encrypted Apple refresh token so we can revoke the Sign in with Apple credential when you delete the account. We never receive your Apple password.
• Access and refresh tokens are stored in your Mac's Keychain. Server-side token values are stored as keyed digests, not plaintext.

3. First-party product analytics

RevBell sends limited feature-usage events to its own service (Cloudflare Workers and D1)—never to an advertising or third-party analytics SDK. There are two kinds.

Anonymous app usage (all users). The Mac app records which features are used so we can decide what to improve. It is on by default and you can turn it off at any time in Settings → General → Share anonymous usage data; turning it off also discards events that have not been sent yet.

• Examples include opening the app, the menu-bar popover, or a page (Home, Reviews, Sales, Settings, …); generating, applying, or dismissing an AI reply suggestion; publishing a reply and whether it was written by you, based on an AI suggestion, or posted by Autopilot; seeing or clicking a notch alert; changing an inbox filter or an Autopilot mode; onboarding steps and whether connecting App Store Connect or Google Play succeeded; viewing the paywall and the outcome of a purchase or restore; turning real-time sales on or off; when the app asks for an App Store rating;seeing or tapping a preview of a Pro feature; the start and end of your introductory Pro period; which offer-code campaign you redeemed; and, if you answer the one-time question, where you heard about RevBell.
• Each event contains only fixed categories—feature, screen, result, and variant (for example "AI suggestion" or "monthly plan"), the store category (App Store or Google Play), and its time—plus the subscription tier, interface language, app version and build, and a random identifier created for this installation.
• The installation identifier is a random value generated on your Mac; it is not derived from your device, Apple ID, Google account, or RevBell account. These events are not linked to a RevBell account, and the stored event records do not include your IP address or location.
• They do not contain review or reply text, reviewer names, app names, bundle or package identifiers, store app or account identifiers, sales amounts, email addresses, or arbitrary custom properties.

Hosted support email (signed-in users). When you are signed in to hosted support email, RevBell records limited interactions needed to understand whether the feature works and which parts are useful. These records are linked to your RevBell account and user identifier.

• Examples include viewing the support-email card or inbox, choosing the all/reviews/email filter, opening setup or a thread, copying an address, starting and completing address creation or assignment, starting and sending a reply, changing an address state, requesting an upgrade, and exporting data.
• Each event may include its time, result, screen and mode, source-provider category (App Store, Google Play, or web), subscription tier, app version and build, and opaque RevBell account and user identifiers.
• Product-analytics events do not contain the hosted email address or alias, project name, store app identifier, website URL, sender or recipient, subject, message body, reply text, attachment name, Apple token, or arbitrary custom properties.

We use both kinds of records for product decisions, adoption and funnel measurement, reliability, support, capacity planning, and abuse prevention—not advertising, data sale, or cross-app profiling.

4. Support messages we store

When someone sends mail to your hosted address, RevBell processes and stores data needed to show the conversation and send your approved reply:

• sender, recipient, and reply-to addresses; subject; text body; message and threading headers; timestamps; delivery status; message size; and the project/mailbox receiving the message;
• your outbound reply text and delivery or bounce status; and
• limited operational records used for de-duplication, abuse prevention, suppression, retention, and incident investigation.

Message text (received mail and your replies) and images are stored in a private Cloudflare R2 bucket. Account and message metadata are stored in Cloudflare D1. Cloudflare encrypts both at rest, and data is encrypted in transit.

Additional application-level encryption: before storing them, RevBell's server also encrypts these fields with AES-256-GCM under a key it holds: sender, recipient and reply-to addresses; the display names of people who write to you; subjects of received mail and replies; image filenames; verified forwarding addresses; the Apple refresh token; and ChatGPT/dots event payloads, historical copies (except the sales fields named in the ChatGPT/dots section) and webhook signing keys. Stripe tokens are encrypted under a separate key. Message and reply text, image contents, message-ID and threading headers, your hosted addresses as stored in the mailbox record, project names, sizes, timestamps and delivery status do not receive this additional layer and rely on Cloudflare's encryption at rest. Values used only for matching—such as subject and conversation fingerprints, the duplicate-message check, and bounce or complaint suppression—are stored as keyed digests.

Image attachments: RevBell stores inbound PNG, JPEG, GIF, and WebP images in the same private Cloudflare R2 storage used for message bodies and makes them available only through an authenticated account-scoped request. Image attachment filenames are stored with application-level encryption so the authenticated viewer can show them; a filename is erased when its image expires or is deleted. Unsupported, mismatched, or over-budget attachments—including video, SVG, documents, archives, and executables—are discarded and shown as omitted. Images are retained as long as message text — up to 365 days after receipt — on every plan, including images in locked messages (see below).

Per-message safety limits: incoming messages larger than 20 MB, with more than 10 attachments, with any attachment over 8 MB, or with attachments totalling more than 10 MB are rejected. Daily receiving limits per account and per hosted address also apply, and images beyond an account's daily image budget are omitted from the message.

Access to stored mail: The app retrieves content through authenticated requests scoped to your hosted-email account. RevBell's server processes and decrypts content to provide the inbox, exports, approved replies, and enabled forwarding. This is not end-to-end encryption: the service can access message content, and Cloudflare operates the storage and processing infrastructure. Connecting ChatGPT separately grants the capabilities described above.

Optional personal-email forwarding

Forwarding is off by default. During Pro or the introductory Pro period, you can verify one external address per hosted mailbox using a code, then separately turn forwarding on. We store that address encrypted, a short-lived keyed digest of the verification code, verification and enablement times, and delivery status. Verification codes expire after 15 minutes with at most five attempts. Unverified configurations are removed after expiry plus one day by the cleanup process. A verified address is kept until you remove it in RevBell, replace it by verifying a different address, or the hosted address is permanently deleted (after its recovery period) or the account is deleted; turning forwarding off does not delete it. Verification delivery records, including the encrypted destination and provider message identifier, are retained for seven days to handle delivery events. Bounce and complaint suppression uses a keyed address digest (see section 5).

Only newly received, readable mail is eligible. Forwarding skips mail whose headers mark it as automatic, bulk, mailing-list or spam: an Auto-Submitted value other than no; Precedence: bulk, junk or list; a List-Id or List-Unsubscribe header; X-Spam-Flag: YES or X-Spam-Status: Yes; or RevBell's own forwarding marker. RevBell does not scan message content for spam. We send a text copy through Cloudflare Email Sending; original HTML and attachments are not included. The original remains in RevBell. Existing mail is not forwarded when you enable the feature. Forwarding stops when disabled or the address or account is unavailable, and it requires an active Pro entitlement or the introductory Pro period when sent. When both have ended, copies pause while the setting stays on for 30 days, so subscribing again within them continues forwarding as before; after 30 days RevBell switches forwarding off and keeps the verified address so you can switch it on again after subscribing. Safety and daily limits, suppression, or delivery failures may prevent a copy from arriving; always use the RevBell inbox as the record of received mail.

The destination provider (for example, Google for Gmail) receives the copy, including contact details and message text, under its own privacy and retention rules. Verify an address you control and have authority to use for your customers' support data. Deleting mail in RevBell does not delete an external copy, and disabling forwarding cannot recall an in-flight or already accepted send. Replies in the external inbox use your personal address and are not synchronized to RevBell.

Email AI permission

Email AI is off until you turn it on — on the last step of setup, in Settings → Support email, or when the app asks the first time you use an email AI action. Reply drafts, regenerated drafts and translations for support email run only after that, and then run automatically until you turn it off. While it is on, the visible subject, the project name, the conversation's messages, including earlier messages and your earlier replies in the same conversation, reply drafts, and text you ask to translate may be sent through RevBell's Cloudflare service to OpenAI, which writes translations and reply suggestions, and to TypeSafe, which selects relevant earlier messages from the same conversation and checks the quality of generated drafts and translations. Your earlier replies in the conversation are also used as writing examples. Sender and recipient address fields and attachments are excluded, but the text can contain personal information included by a sender. You must confirm before sending a suggested reply. Your choice is stored on your Mac and stays in effect across restarts and sign-outs until you turn it off in Settings → Support email. Turning permission off stops new requests and clears the email-assistance cache, but cannot recall information already transmitted. Signing out clears the email-assistance cache but keeps your choice. This control is separate from an optional ChatGPT connection.

5. Access rules and retention

• Message bodies and images become inaccessible through the inbox, image and export APIs at 365 days after receipt, on every plan. Background cleanup removes stored objects and identifying metadata in bounded, retryable batches; physical cleanup can lag during a provider outage or backlog.
• Mail that arrives while your account is on the Free plan — after the introductory Pro period (section 7) and without an active subscription — is stored locked: RevBell shows the sender's name and the subject, but does not return the message body or images to the app. Subscribing unlocks those messages; so does the introductory Pro period starting on a Mac linked to the account (once per account). Locked messages follow the same retention as other messages, so nothing is deleted early because it was locked. Mail that arrived during the introductory Pro period or while you were subscribed stays readable. Ending Pro deletes nothing: received mail keeps its retention period and can be exported at any time on every plan.
• Accounts created before RevBell 2.0.0 keep one selected hosted address whose incoming mail is not locked.
• Requesting mailbox deletion stops new mail immediately. The mailbox enters a 7-day recovery period. Reactivation is blocked once that period ends or irreversible cleanup begins, after which its messages and body objects are deleted and the alias is permanently tombstoned to prevent reassignment to another customer.
• Expired content is removed from R2 and its identifying message metadata is cleared; a placeholder without addresses, subject or text remains until the whole conversation has been cleaned up.
• Operational records. Bounce and complaint suppression entries (a keyed digest of the address, the reason and the time) are kept until the hosted-email account is deleted, so RevBell does not send to that address again. Security and audit events (event type, an internal target identifier and the time) are kept until the account is deleted. Forwarding delivery status (state, failure code and the provider's message identifier) stays with the conversation's records until expiry or deletion cleanup removes them. Alias tombstones and account-deletion receipts contain only keyed digests and dates and are kept indefinitely, to prevent an address from being reassigned to another customer or an account from being reused abusively.
• Provider backups and logs. Cloudflare D1, the database service, keeps automatic point-in-time recovery history for up to 30 days, and Cloudflare keeps the logs written by RevBell's server code for up to 7 days. These are features of the provider. Deleted or expired database records can remain in that recovery history until they roll off. The logs hold request identifiers, outcomes and error details; an error message returned by an AI provider can quote a short part of the request.
• Raw first-party product events are deleted after 90 days. Daily event counts associated with opaque account and user identifiers are deleted after 760 days. Deleting the hosted-email account deletes both forms of analytics through the same account-deletion process.
• Anonymous app-usage events are deleted after 90 days. Daily counts and the per-installation summary (first and last seen, app version, tier, interface language) are deleted 760 days after the installation was last seen.
• The keyed hash used for the introductory Pro period (section 7) is kept indefinitely, because its only purpose is to give that period once per Apple Account. Its link to a hosted-email account is deleted with that account. Daily website visit totals (section 9) contain no personal data and are kept as aggregate statistics.
• On-device data remains until you remove it or uninstall the app.

6. Your controls

• You can pause, reactivate within the recovery period, unassign, or request deletion of a hosted address from the app. Pausing or requesting deletion also switches forwarding off; restoring the address does not switch it back on.
• You can turn forwarding off at any time, or remove the verified forwarding address, which deletes it from RevBell's database (subject to the provider recovery history in section 5).
• You can permanently delete a conversation after confirmation. It immediately disappears from account access, attachment access, and exports; stored message bodies and images are then removed by background cleanup. This has no recovery period. New messages from the sender can start a new conversation. Deleting a conversation in RevBell does not remove the original message or your replies in the customer's own mailbox, copies already forwarded to your personal inbox, external exports, or information already received by ChatGPT or an AI provider.
• On every plan — also after Pro has ended — you can export from Settings a folder with a spreadsheet (CSV) of your messages, the images still retained, and an NDJSON copy of currently accessible hosted-email account and message data, including first-party product-event records and daily counts. Messages locked on Free appear only as dated entries marked locked, without sender, subject, body or images. You can also save a single image from the in-app image viewer while it is retained, or contact us for a statutory access request.
• When you delete your hosted-email account, you can choose a full export that also includes the text of locked messages (images are not included). Choosing it confirms the deletion: the account is closed before the download starts.
• You can delete the hosted-email account in Settings after a fresh Sign in with Apple confirmation. RevBell immediately revokes active sessions, requests deletion of Cloudflare data, and queues revocation of the stored Apple credential independently. An Apple outage does not hold up deletion of email content or the account. The encrypted credential and client identifier may remain in an isolated revocation queue for up to 30 days, with bounded retries, then are removed. Copies already forwarded to your personal inbox, files you exported, the messages and replies in your customers' own mailboxes, and information already sent to AI providers or ChatGPT are not affected.
• For a statutory access, correction, or deletion request—including retained data not shown by the self-service export—contact privacy@hello-support.com. We may need to verify account ownership.
• You can revoke store access by removing the connection in RevBell, revoking App Store Connect access, or revoking ReviewBell from your Google Account's third-party connections page.

7. Subscriptions and payments

Subscriptions are sold through Apple's App Store using StoreKit. Apple handles payment details. RevBell receives and verifies signed subscription status, transaction identifiers represented as keyed digests, product tier, expiration, refund, revoke, billing-retry, and grace-period events so access can be applied across devices.

Your introductory Pro period

RevBell includes Pro at no charge for an introductory period, once per Apple Account. When you first connect a store — or, if you already used RevBell, the first time you open version 2.0.0 — the app asks RevBell's server whether your introductory Pro period has started. It sends Apple's signed record of your app download (StoreKit's AppTransaction) and, if you subscribe, your signed subscription transaction and renewal information. The server verifies Apple's signature and keeps only:

• a keyed hash (HMAC-SHA256 with a server-side secret) of the record's appTransactionID — an identifier Apple creates once for each Apple Account that downloads the app, which stays the same when you reinstall it or use another Mac;
• the time your introductory period started, and whether the purchase environment was the App Store or Apple's sandbox.

It does not store your name, email address, device identifiers, or the Apple records themselves. The hash is used only to give the introductory period once per Apple Account and to issue a short-lived access pass — valid for at most 7 days (24 hours in the sandbox) — which the Mac app keeps in its Keychain and sends with AI requests so the AI service can check your plan without contacting Apple. The pass contains the plan, its expiry and issue times, the environment, and the first 16 characters of the hash. The app sends the same signed records again whenever it renews that pass (when the pass expires, after a purchase, restore or subscription change, and in sample-data mode); the server stores nothing new on those requests. If you use hosted support email, the app also links your support-email account to the same hash so the server can tell whether a message arrived during your introductory Pro period or while you were subscribed (section 5).

The hash, start time and environment are kept indefinitely — also after you delete a support-email account — because their only purpose is to give that period once per Apple Account. They are not linked to your name, email address or store credentials.

8. Service providers and disclosures

We use the following providers. They process data under their own terms and as needed to perform these functions:

• Apple: App Store Connect access, Sign in with Apple, App Store subscriptions and App Store Server Notifications. Data: the credentials, identifiers and signed records described in sections 1, 2 and 7.
• Google: Google sign-in and Google Play access, read-only Google Cloud Storage for historical Play reports, Google Cloud Pub/Sub for optional real-time Play notifications (delivered to RevBell's Cloudflare-hosted server), and the optional AdMob and Google Ads connections. Data: as described in section 1.
• Cloudflare: application processing, email routing and sending, databases, object storage, queues, rate limiting, logs, and site hosting. Data: the server-side data described throughout this policy, including stored support messages.
• OpenAI: AI drafts, translations and the other AI results described in section 1, including automatic review analysis on Pro, and support-email drafts and translations after you turn on email AI. Data: the bounded AI payloads described in sections 1 and 4. OpenAI also operates ChatGPT, which receives data only if you connect ChatGPT/dots (section 1).
• TypeSafe: automatic urgency triage of new review text on every plan; and, whenever an AI review feature runs or email AI is on, selecting relevant earlier context and checking generated drafts and translations. Data: the review triage fields in section 1 and the bounded AI payloads described in sections 1 and 4.
• Stripe (optional revenue integration): supplies the authorized account data and event notifications; Cloudflare processes and stores the connection and revenue records described in section 1.

We may disclose information when legally required, to protect users or the service, or in connection with a business transfer subject to appropriate safeguards. We do not sell or rent support-message content or use it for cross-context behavioral advertising.

9. Website measurement

Aggregate visit counts. The RevBell website counts visits itself. When a page opens, when you click a Mac App Store button, when you first use a product demo on the home page, and when the code-redemption page opens, your browser sends RevBell's Cloudflare service four values: the kind of event, the page, the page language, and a source category taken from the link's utm_source value or the referring site's name (for example “Hacker News”, “Google” or “direct”). RevBell stores only daily totals for each combination of those values — no cookies, no identifiers, no full URL or referrer, and no offer codes. Cloudflare necessarily sees your IP address to deliver the request and to limit abuse, but it is not stored with these totals. So that later pages of the same visit count under the same source, the page remembers that source category in your browser's session storage for the current tab; the browser clears it when the tab closes.

The home page also uses Reddit Pixel and LinkedIn Insight Tag to measure site visits and Mac App Store link clicks; the guides and the code-redemption page do not load them. Those providers may process cookies, IP address, browser/device data, URL, referrer, and advertising identifiers. We do not intentionally send store credentials, review content, support messages, names, email addresses, or phone numbers to these tags; advanced or enhanced matching is not configured.

See the Reddit Privacy Policy and LinkedIn Privacy Policy.

Do Not Track. The RevBell website does not change its behavior in response to browser Do Not Track signals. The Reddit and LinkedIn tags described above can collect information about your visit to the home page over time and across other sites under those providers' policies; you can limit them with your browser's tracking protection or content blocking, or through each provider's advertising settings.

10. Security and appropriate use

We use access controls, tenant-scoped database relationships, encryption, rate limits, suppression rules, and retention jobs. No internet service is risk-free. Hosted support email is intended for ordinary product-support communications, not health records, financial-account data, government identifiers, legal secrets, or other regulated or highly sensitive information.

11. International processing and children

Service providers may process data in countries other than yours. RevBell is a developer tool, is not directed to children under 13, and should not be used to intentionally collect children's data through a hosted address.

12. Changes and contact

We will update the date above when this policy changes and will provide additional notice when appropriate. Privacy questions or requests can be sent to privacy@hello-support.com. Abuse reports can be sent to abuse@hello-support.com.