Legal

Privacy

The formal policy is still to be written. What the product does with data is already decided, so this page describes that instead of promising it.

Worth knowing

A description, not the final policy

This page is accurate about how Union behaves today, but it is not yet a privacy policy in the legal sense, and it has not been reviewed by a lawyer. It will be replaced by the real document before Union is generally available. If you need a DPA or specific commitments in writing before you can use Union at work, ask us rather than reading between these lines.

Two kinds of data

Your account. The email address you signed up with, the workspaces and projects you create, and the credentials you connect (App Store Connect, RevenueCat, Survicate). Connected credentials are encrypted at rest.

Events from your app. Whatever your build and your backend send: sessions, screens, custom events, releases, and the subscription and survey events your other tools forward. This is your data — you decide what is sent, and you can delete a project and everything under it.

What Union deliberately does not store

A project can run in strict_anonymous mode, which is enforced at ingest rather than in the dashboard: no install identity is kept, so nothing can be tied back to a person even by us.

IP addresses are never stored whole. They are truncated before they are written, and they are used only to derive a coarse country and region. Server-to-server events get no location at all, because the address belongs to a datacentre rather than to a person.

Third-party subject identifiers — a RevenueCat customer id, a Survicate respondent — are stored only as a keyed hash, never in the clear.

Survey answers reach Union as a category and a score. The question text and any comment a respondent typed are left out of the schema on purpose, so the free text people write never lands in our database at all.

Union has no crash reporting of its own, no session video replay, and no automatic capture of taps or form input. Nothing is recorded that your build does not explicitly send.

Where data goes

Union runs on Cloudflare, and your data is stored there. The only outbound traffic is to the services you connect yourself — Apple, RevenueCat, Survicate — and, if you turn on the optional AI suggestions, to a model provider. That last one is opt-in per project and off by default, and the prompt is limited by type to schema metadata: event and screen names, your public store listing, your keyword terms. No event data and no identities.

Union does not sell data, does not share it between workspaces, and does not use one customer’s events to build anything for another.

Retention and deletion

Raw events are kept for a per-project retention window and then purged; the daily aggregates behind the dashboard have their own, longer window. Deleting a project deletes its events, its aggregates and its keys. Ask and we will delete your account.

Questions

If anything here is unclear, or you want a commitment this page does not make, get in touch. A specific answer about your setup is worth more than a longer document.