Privacy Policy

Last updated: April 8, 2026

Ashboard ("we", "our", "the app") is a mobile application developed by Copoche that provides a dashboard for Firebase and related developer services. We take your privacy seriously. This policy explains what data we access, how we use it, and what we don't do.

The Short Version

Ashboard connects directly to Google, Apple, RevenueCat, and GitHub APIs from your device. We do not operate proxy servers that see your data. We do not collect, store, or sell your personal information. Your API keys and tokens never leave your device (they are stored in the iOS Keychain).

Data We Access

When you sign in with Google and connect your Firebase projects, Ashboard accesses the following data through Google's APIs using your OAuth2 credentials:

Firebase project metadata — project names, app IDs, linked services
Google Analytics (GA4) — active users, sessions, events, crash-free rate, revenue, retention
Firebase Auth — user counts, recent signups, user metadata (email, display name, providers)
Firestore — collection names, document data (when you use the Firestore browser)
Remote Config — parameter names and values
Crashlytics (via BigQuery) — crash issues, stack traces, affected versions
Google Play — Android Vitals, Play Store reviews (if scope granted)

When you connect optional integrations:

App Store Connect — app ratings, reviews, versions, TestFlight builds, in-app purchases
RevenueCat — subscription metrics (MRR, churn, trial conversion, subscriber data)
GitHub — repository releases, open issues labeled as bugs

How Data Flows

All API calls are made directly from your device to the respective service providers (Google, Apple, RevenueCat, GitHub). Ashboard does not route your data through our servers, with two exceptions:

AI features — When you use the AI Daily Brief, AI Chat, or Weekly Report features, your project's aggregate metrics (not individual user data) are sent to our Cloud Functions, which call the Anthropic (Claude) API to generate insights. This data is not stored beyond the cache period (4 hours for briefs).
Crashlytics and Firestore browsing — These features use Cloud Functions as proxies to avoid requiring restricted OAuth scopes. The Cloud Functions validate your identity and forward requests using your OAuth token.

Data We Store

On your device (iOS Keychain + local storage):

Google OAuth tokens (managed by Google Sign-In SDK)
App Store Connect API key (ES256 private key in Keychain)
RevenueCat API key (in Keychain)
GitHub personal access token (in Keychain)
Cached dashboard data (in app sandbox, not backed up to iCloud)
User preferences (role, notification settings, recommendation dismissals)

On our servers:

Firebase Authentication record (your Ashboard account — email or phone)
AI brief cache (aggregate project metrics, cached for 4 hours, keyed by project ID)
No personal data, no analytics data, no user data from your Firebase projects

Data We Do NOT Collect

We do not collect or store your users' personal information
We do not access your users' data except when you explicitly query it (e.g., Firestore browser, user search)
We do not sell, share, or transfer data to third parties for advertising
We do not use tracking pixels, third-party analytics SDKs (other than Firebase Analytics for our own app), or advertising frameworks
We do not access location, health, financial, contacts, or any data unrelated to your developer tools

Google OAuth Scopes

Ashboard requests the following Google OAuth2 scopes. All are classified as "sensitive" (not restricted) and are used solely to display your project data to you:

firebase.readonly — List your Firebase projects
analytics.readonly — Read GA4 analytics data
identitytoolkit — Read Firebase Auth user data
bigquery.readonly — Query Crashlytics data (requested on-demand)
datastore — Browse Firestore data (requested on-demand)
firebase.remoteconfig — Read/write Remote Config (requested on-demand)
androidpublisher — Read Google Play reviews (requested on-demand)
playdeveloperreporting — Read Android Vitals (requested on-demand)

You can revoke Ashboard's access at any time at myaccount.google.com/permissions.

Third-Party Services

Ashboard integrates with the following third-party services, each governed by their own privacy policies:

Data Deletion

You can delete all locally stored data by signing out of Ashboard (Settings > Sign Out). This removes all cached data, preferences, and API keys from your device.

To delete your Ashboard account and any server-side data, contact us at privacy@ashboardapp.com.

Revoking Google access at myaccount.google.com/permissions immediately prevents Ashboard from accessing your Google data.

Children's Privacy

Ashboard is a developer tool not intended for use by children under 13. We do not knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of Ashboard after changes constitutes acceptance.

Contact

For privacy-related questions or data deletion requests:
privacy@ashboardapp.com