AppProceeds

Support

One question, one address.

AppProceeds shows your whole App Store Connect portfolio on your phone and pushes you a notification when something happens. Write to timkrechel@googlemail.com and the person who wrote the app answers.

I see my apps, but no downloads or revenue

Almost always a missing vendor number. Apple requires it for every sales report and offers no way to look it up through the API, so AppProceeds cannot fill it in for you. You find it in App Store Connect under Payments and Financial Reports, top left under your name; it is an eight-digit number. Enter it under Settings › App Store Connect.

Second possibility: the report for a given day simply does not exist yet. Apple publishes daily reports the following day, roughly between 5 and 8 a.m. Pacific time, so today is always empty and yesterday may be too.

The Live tab stays empty

Reviews arrive with the next sync. Sales and in-app purchases arrive only after you have pasted your webhook URL into App Store Connect, per app, under App Information › App Store Server Notifications. That step is not optional decoration: it is the only channel that delivers a purchase within minutes. The reporting API is aggregated per day and would never be live.

Your webhook URL is in Settings › Live events. Treat it like a password. Apple sends no authentication header with these notifications, so the secret part of that URL is what keeps strangers from posting events into your feed.

Settings shows an error from Apple

That text comes straight from App Store Connect, untranslated, so you can search for it. The two common ones: the key was revoked in App Store Connect, or it lacks the role needed to read what was requested. Creating a fresh key with the Finance or App Manager role and entering it again fixes both.

How do I delete everything?

Settings › Delete account. That removes the encrypted key and every stored metric from the server immediately. It is a deletion, not a hidden flag. You can additionally revoke the key in App Store Connect, which cuts access instantly and independently of us.

What happens to your API key

It is stored encrypted on the server, decrypted only where reports are fetched, and never sent back to any app.

This section exists because AppProceeds asks for something serious: an App Store Connect API key that can read your sales. A tool that asks for that owes you an exact description of what it does with it, not a reassuring sentence.

Why the server needs it at all

Push notifications and up-to-date numbers require something that polls while your phone is asleep. iOS does not allow an app to do that reliably on its own. A version that kept the key only on your device could show you charts when you opened it, but it could never tell you about a sale before you asked. That is the entire product, so the key lives on the server. This is a real trade-off, and it is the reason for everything below.

How it is stored

The private key goes into an encrypted vault at the moment you submit it. The database table that describes your key holds only its issuer ID, its key ID and a reference to the vault entry. A dump of that table, even with a stolen account token, yields no key material.

Where it is decrypted

Only in the background process that talks to Apple. The layer that answers the iOS app has no read access to the vault at all, and no endpoint in AppProceeds returns key material to any client. Once you submit the key, there is no path back out.

What we ask of you in return

Create the key with the Finance or App Manager role rather than Admin. AppProceeds only reads, so it never needs more, and the difference matters: a leaked read-only key exposes numbers, an Admin key exposes your apps. The onboarding says this too, because a security measure nobody hears about is not one.

The risk we do not talk away

Apple's terms for App Store Connect API keys state that a key may not be used "to provide services to any third parties". A server that holds customer keys and queries on their behalf is squarely within that wording. Established tools operate this way and have not been challenged, but that is an observation, not a guarantee from Apple. If Apple ever enforces this against small providers, AppProceeds is directly affected. You should know that before you hand over a key, which is why it is written here and not left out.

Privacy Policy

No tracking, no advertising, no analytics SDK, no data sold or shared. Only what the app needs to work.

Last updated: 20 August 2026

Who is responsible

Timothy Krechel, Germany · timkrechel@googlemail.com

What is processed

• Your App Store Connect API key (issuer ID, key ID, private key), stored encrypted as described above. Used solely to fetch your own reports from Apple on your behalf.
• Your vendor number, if you provide one. Required by Apple for sales reports.
• Metrics about your apps: downloads, proceeds, countries, platforms, ratings and review texts, as returned by Apple. These describe your apps, not you.
• Transaction events that Apple sends to your webhook URL when someone buys one of your apps: type, product, amount, storefront, timestamp.
• A push token for each device you enable notifications on. Used only to deliver the notifications you asked for.
• An anonymous account identifier. Sign-in is anonymous: no email address, no name, no password. We do not know who you are.

What is not processed

No name, no email address, no advertising identifier, no location, no contacts, no usage analytics. AppProceeds contains no analytics SDK and no advertising SDK. Nothing is sold, shared or handed to third parties for their own purposes, and nothing is used to track you across apps or websites.

Where the data is

On servers in the European Union, operated on our behalf by Supabase as a processor. Push notifications are delivered through Apple's Push Notification service, which receives the notification content and the device token in order to deliver it.

How long

Until you delete your account. Deletion removes the key and all stored metrics immediately and irreversibly. Accounts with no key and no activity are removed after twelve months.

Legal basis and your rights

Processing is based on performance of a contract (Art. 6(1)(b) GDPR): without the key and the metrics the app has no function. You have the right to access, rectification, erasure, restriction, data portability and to lodge a complaint with a supervisory authority. Because the account is anonymous, exercising these rights in the app is the fastest route: Settings › Delete account performs the erasure directly. For anything else, write to the address above.

Children

AppProceeds is a tool for App Store developers and is not directed at children.