隐私政策
生效日期:2026 年 9 月 8 日 · English below
Catch(下称「本服务」)帮助开发者接收 App Store 服务器通知并推送到自己的设备。本政策说明我们收集什么、为什么收集、保存多久,以及你如何删除。
我们收集的数据
| 数据 | 来源 | 用途 |
|---|---|---|
| Apple 账号标识(Sign in with Apple 的用户标识)及你选择共享的邮箱 | 你登录时 | 创建并识别你的账号 |
| 设备推送令牌(APNs device token)与平台类型 | 你允许通知时 | 向你的设备发送推送 |
| App Store 服务器通知中的必要字段:通知类型、bundle id、产品 id、价格与货币、商店区域、环境(沙盒/生产)、时间戳、退款申请原因 | Apple 发送到你的专属地址时 | 生成推送与流水列表 |
退款申请通知中的 transactionId | Apple 发送 CONSUMPTION_REQUEST 时 | 供你在 Apple 给的 12 小时窗口内回传消费信息;只保存 12 小时,到期自动删除 |
| 你的偏好设置:通知类型、免打扰时段、时区偏移、数据保留天数、转发地址 | 你在 App 内设置时 | 按你的意愿推送与转发 |
| 团队成员关系:你加入的团队、角色、加入时间 | 你创建或加入团队时 | 把团队的通知推送给全部成员;团队成员可以看到彼此的邮箱和角色 |
我们不收集的数据
- 通知中的
appAccountToken、originalTransactionId等可关联到你的用户个人的标识一律不保存。 - 唯一的例外是退款申请(
CONSUMPTION_REQUEST)通知里的transactionId:Apple 只给 12 小时回传消费信息,而调用那个接口必须带上它。它单独存放、不进流水事件,窗口一过即删除,也不再下发到客户端。 - 不接入任何分析、广告或第三方追踪 SDK,不收集设备广告标识。
- 不保存你的 App Store Connect API 密钥或账号密码。如果你在 App 内使用「回传消费信息」,那把密钥只写进你这台设备的钥匙串,回传请求由设备直接发给 Apple,我们的服务器既拿不到密钥,也不参与回传。
保存多久
- 流水事件按你设置的保留天数自动清理,最长 365 天。
- 退款申请通知中的
transactionId只保留 12 小时(Apple 给的响应窗口),由每小时运行的定时任务删除,不随流水事件一起保留。 - 验签失败的原始通知最多保留 7 天,仅用于排查兼容性问题,每个账号最多 50 条。
- 登录会话最长 90 天,退出登录即失效。
- 在 App 内「设置 → 删除账号」会立即删除你的账号、设备、App 记录和全部事件,不可恢复。
数据去了哪里
- 服务端运行在 Cloudflare Workers 与 D1 上,数据存储在 Cloudflare 的基础设施中。
- 推送通过 Apple Push Notification service 发送;登录通过 Sign in with Apple 验证。
- 如果你为某个 App 设置了转发地址,该 App 的原始通知会被转发到你指定的服务器;该服务器由你控制,不在本政策范围内。
- 除上述情况外,我们不向任何第三方出售、共享或转让你的数据。
安全
所有传输均使用 HTTPS。每条来自 Apple 的通知都会验证到 Apple Root CA 的完整证书链,伪造的通知不会入库。你的专属通知地址包含随机令牌,可随时在 App 内重新生成。
儿童
本服务面向软件开发者,不面向 13 岁以下儿童,也不会有意收集儿童的个人信息。
变更与联系
本政策如有变更会在此页面更新并注明生效日期。任何问题请通过支持页面联系我们。
Privacy Policy
Effective September 8, 2026
Catch ("the Service") lets developers receive App Store Server Notifications and get them pushed to their own devices. This policy explains what we collect, why, how long we keep it, and how you can delete it.
What we collect
- Your Apple account identifier from Sign in with Apple, and the email address you choose to share, to create and identify your account.
- Push tokens (APNs device tokens) and platform type, to deliver notifications to your devices.
- Selected fields from App Store Server Notifications sent to your personal endpoint: notification type, bundle id, product id, price and currency, storefront, environment (sandbox or production), timestamps, and the customer's stated refund reason. These are used to build your push notifications and event list.
- The
transactionIdof a refund request (CONSUMPTION_REQUEST), so you can send consumption information to Apple within the 12 hours Apple allows. It is kept for those 12 hours only and then deleted automatically. - Your preferences: notification types, quiet hours, time zone offset, retention period, and any forwarding URL you configure.
- Team membership: the teams you create or join, your role and join time, so the team's notifications reach every member. Team members can see each other's email address and role.
What we do not collect
- We never store identifiers that could be linked to your customers, such as
appAccountTokenororiginalTransactionId. - The one exception is the
transactionIdin a refund request (CONSUMPTION_REQUEST): Apple gives you 12 hours to send consumption information, and that API call requires it. It is stored separately from your events, deleted as soon as the window closes, and no longer sent to the app after that. - No analytics, advertising or tracking SDKs. No advertising identifiers.
- We never store your App Store Connect API keys or passwords. If you use Send Consumption Info in the app, that key is written only to your device's keychain; the request goes straight from your device to Apple, and our servers neither receive the key nor take part in the call.
Retention
- Events are deleted automatically after your configured retention period (up to 365 days).
- The
transactionIdof a refund request is kept for 12 hours only (the response window Apple allows) and removed by an hourly job; it is never kept alongside your events. - Notifications that fail signature verification are kept in raw form for at most 7 days (at most 50 per account) solely to diagnose compatibility problems.
- Sessions expire after 90 days or when you sign out.
- Settings → Delete Account removes your account, devices, apps and all events immediately and irreversibly.
Where your data goes
- The Service runs on Cloudflare Workers and D1; data is stored on Cloudflare infrastructure.
- Pushes are delivered through the Apple Push Notification service; sign-in is verified through Sign in with Apple.
- If you configure a forwarding URL for an app, that app's raw notifications are forwarded to the server you specify, which is under your control and outside the scope of this policy.
- We do not sell, share or transfer your data to any other third party.
Security
All traffic uses HTTPS. Every notification from Apple is verified against the full certificate chain up to the Apple Root CA; forged notifications are never stored. Your endpoint contains a random token that you can regenerate at any time in the app.
Children
The Service is intended for software developers and is not directed at children under 13. We do not knowingly collect personal information from children.
Changes and contact
Changes to this policy will be posted on this page with a new effective date. Questions: see the support page.