Privacy Policy

ROASSensor (“ROASSensor,” “we,” “us,” or “our”) provides a unified Return-on-Ad-Spend analytics platform for app developers, mobile game studios, subscription publishers, and performance agencies. This Privacy Policy explains what information we collect when you use our website, beta program, and product (together, the “Service”), how we use it, and the choices you have.

By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

Account & contact information. When you join the beta waitlist or create an account, we collect your name, email address, company, role, and similar details you provide.

Connected platform data. With your authorization, we read ad spend and revenue metrics from the platforms you connect campaign, ad set, and creative performance, plus store and subscription revenue.

Data from your apps and websites. When you add our SDK or tracking snippet, we process data about your own users on your behalf, as your processor under our Data Processing Agreement: pseudonymous visitor, session and click identifiers; mobile advertising identifiers (Google Advertising ID, IDFA and App Set ID), which we store only as SHA-256 hashes; the iOS identifier for vendor (IDFV); App Tracking Transparency status; device and app details such as operating system and version, device model, app version and country; push notification tokens, if you turn on uninstall measurement; IP address, used when a request arrives and stored only as a salted hash; the events and purchases your app, website, store or payment processor reports; and email addresses or phone numbers only if you send them, normalized and hashed before storage.

Usage data. We collect standard product and device telemetry, such as pages viewed, features used, IP address, and browser type, to operate and improve the Service.

We use the information we collect to provide and operate the Service, reconcile spend against revenue into ROAS, generate recommendations, communicate with you about the beta and product updates, provide support, and keep the Service secure.

We do not sell your personal information or your connected ad and revenue data.

When you connect a platform such as Meta, Google, TikTok, Apple Search Ads, AppLovin, Unity Ads, Mintegral, the App Store, Google Play, RevenueCat, or Stripe, you authorize ROASSensor to access the metrics needed to compute your ROAS through that platform’s official API.

By default we only read from a connected ad account. The one place we make changes in it is Apple Search Ads, and only on your workspace’s instruction. If the Apple Ads API key you connect has Apple’s API Account Manager role, an Owner or Manager of your workspace can use the Apple Search Ads Manager to create, copy, pause, enable and delete campaigns, ad groups and keywords, change budgets, bids and target cost per acquisition, and add negative keywords. They can also create rules that make some of these changes on a schedule (pausing, changing a bid, budget or target cost per acquisition, or adding a keyword or negative keyword); a rule only lists what it would do until an Owner or Manager turns it live. Every change is recorded in Settings → History. With a read-only Apple Ads key, nothing is changed.

We do not create, edit, pause or delete campaigns, ads or budgets on any other platform. Apart from the Apple Search Ads changes above, the only data we send to an ad platform is the conversion events, postbacks and audiences you turn on, described under Sharing & Disclosure.

You control which sources are connected and can disconnect any of them at any time from your workspace settings.

We do not sell personal information. We share it only as follows:

• Ad platforms you configure. When you turn on conversion sending for Meta (Conversions API), Google Ads or TikTok (Events API), we send each attributed sale or event to that platform with its value and currency (unless you turn value sharing off), click identifiers, hashed identifiers such as hashed email, phone and visitor id, and, for app events, device details.
• Ad platforms you sync audiences to. When you sync an audience to Meta, Google Ads or TikTok, we create a customer list in that ad account, or replace its members, using the members’ hashed email addresses or phone numbers or, for a Meta device audience, their hashed advertising identifiers.
• Ad networks you add postbacks for. When you add a postback for AppLovin, Unity Ads or Mintegral, we send that network one request for each install, in-app event or purchase we attribute to it, carrying the network’s own click id, campaign and creative ids, timestamps, the event name, the value and currency (unless you turn value sharing off) and device details such as operating system, device model and country. We never send raw advertising identifiers or IP addresses to these networks.
• Your own systems. If you set up postbacks or webhooks to your own servers, or ask us to forward App Store notifications, we send that data to the addresses you choose.
• Service providers who process data on our behalf (such as hosting and email delivery), bound by confidentiality and data-protection obligations.
• When required by law, or in connection with a merger or acquisition.

You can pause or remove any platform, postback or webhook at any time from your workspace.

We retain your information for as long as your account is active or as needed to provide the Service. When you close your account, we delete or anonymize your personal and connected-platform data within a reasonable period, except where retention is required by law.

Data travels between your apps and websites, our servers and the platforms you connect over encrypted connections (TLS). In the data we collect from your apps and websites, advertising identifiers (Google Advertising ID, IDFA and App Set ID), email addresses and phone numbers are hashed before storage, and IP addresses are stored only as a salted hash. The credentials you give us for connected platforms (access tokens, API keys, private keys and webhook signing secrets) are write-only: once saved they are never sent back to your browser, and your workspace shows only whether one is set. Within a workspace, roles decide who can change settings, and access to our production systems is limited to the staff who need it to run and support the Service. No method of transmission or storage is perfectly secure, but we work continuously to protect your data.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, contact us using the details below.

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Service is used. You can control cookies through your browser settings; disabling some may affect functionality.

We may process and store information in countries other than your own. Where we transfer data internationally, we use appropriate safeguards consistent with applicable data-protection laws.

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the revised policy.

Questions about this Privacy Policy or your data? Email us at [email protected] and we’ll be glad to help.