Security
How credentials are handled, in plain language
This product asks for access to your developer accounts and store connections. You deserve a straight answer about what happens to them.
Your credentials, scoped and short-lived
Store platform connections use revocable application passwords or API keys, never your store account password. WooCommerce, Shopify, BigCommerce, and Magento connections work this way.
The publishing add-on, when it launches, will use scoped keys for the stores: an App Store Connect API key with a limited role, and a Google service account key with release permission. These are not your Apple ID and never your Google password. At launch, you submit your downloaded files yourself with the accounts you already own.
What we do with them
Credentials are encrypted at rest, stored separately from other application data, and never written to logs at any level.
They are used only for the submission or connection they were provided for, and you can replace them at any time. We never ask for your Apple ID or Google password, and nothing is ever published under Tapbound's own accounts.
Where your website's traffic goes
The finished app loads your live website directly. Your site's traffic and your visitors' data are never routed through Tapbound's own servers.
Store platform connections you explicitly enable are the only platform-side calls the app makes beyond loading your site.
The honest limit
No software can make discovery of its own internals impossible. A determined technical user can decompile an app binary and see the libraries it uses. We do not claim otherwise.
What we do guarantee is the practical standard: no casual path to your credentials, no logging of them, no reuse after their job is done.
Vulnerability reporting
Found a vulnerability? Reach us at [email protected], also published at the standard security.txt location so a researcher has a documented path to report responsibly.