Privacy policy

Who we are

ExportKit is a browser tool for building app-store graphics, at exportkit.app. Questions, requests and complaints all go to hello@exportkit.app.

What we never see

Your designs. Icons, screenshots, feature graphics, the app screens you drop in, your listing text — all of it is rendered on a canvas in your browser. It is not uploaded, not processed on a server and not seen by us. The .zip you download is assembled in the same browser tab.

This is true whether or not you are signed in. There is exactly one exception, it is manual, and it has its own section below: cloud backup, which uploads a copy of a kit when — and only when — you press Back up now.

What is stored in your browser

• Signed out: your kits are held in sessionStorage. They survive a reload and disappear when you close the tab. Nothing is written to long-term storage.
• Signed in: your kits move to localStorage, so they are still there next time you open the editor on that device.
• Either way: a few small preferences — whether you have dismissed the first-run hints, and whether you have opted out of analytics.

You can clear all of it at any time through your browser's "clear site data" control. We have no copy of it unless you signed in and backed it up.

What we store when you sign in

Signing in uses Google via Supabase, which handles authentication and hosts our database. We receive and store:

• your email address;
• your display name and profile picture URL, as Google provides them;
• the date your account was created.

We never receive your Google password, and we do not request access to your Gmail, Drive, contacts or anything else in your Google account.

Cloud backup

It is manual, and nothing happens until you use it. There is no timer, no background sync and no upload when you close the tab. A kit leaves your browser only when you are signed in and choose Back up now from the account menu.

What is uploaded. One file holding the kits the backup covers — their settings, your listing text and the app screens you added to them — together with your saved icons, text drafts and screenshot sets. It is the same data your browser is already holding, written out as a single file.

Where it goes. A private storage bucket at Supabase, in a folder named after your account id. The access rules permit that account and nothing else: there is no public link, and the key shipped in this page cannot read it back. Stored beside it is one small record — when you last backed up, how many kits it covered and how many bytes it was — so the editor can tell you when the last backup ran without downloading the file to find out.

How much. The free tier backs up one kit: the first one you created. Pro backs up every kit, up to 2 GB. Past that limit backup pauses and nothing else changes.

Getting rid of it. Backing up again replaces the stored file. Deleting your account deletes it. If you want it removed without closing your account, email hello@exportkit.app.

We do not open your backup. Nothing in it is read by us, used for analytics, or used to train anything. It exists so that you can get your work back.

If you join the Pro list

If you ask to be notified when Pro opens, we store the email address you type and nothing else. It is used for exactly one message — that Pro is available — and then it is deleted. It is not a newsletter and it is not shared.

Analytics

We use PostHog to count page views and see which parts of the editor get used. It records the page you are on, which buttons you press, which settings you change — a template, a colour, a font, a size — that you moved or resized something on the canvas, your approximate country, and your browser and screen size. Session recording is switched off, so we cannot watch what you do.

Analytics never touch the contents of your designs. We cannot see your app name, your screenshots or your listing text. Where it is useful to know that a field was filled in, we record how long what you typed was — never what it said.

If you are signed in, your account id and your email address are attached to this, so we can tell a returning visitor from a new one and see how the editor is used over time rather than only within a single visit. Signed out, there is no account to attach and the analytics identifier is a random one PostHog keeps in your browser.

Surveys. PostHog also shows the occasional one-question survey inside the editor — for example, after you export a kit, what was missing. Answering is optional, there is a dismiss button, and what you write goes to PostHog with the same identifier as above. Nothing you type in a survey is shared or sold.

To turn analytics off: enable Do Not Track in your browser, which we respect, or open your browser console and run localStorage.setItem('ek.analytics.off','1').

Cookies

No advertising cookies and no third-party trackers. The only things stored are the PostHog analytics identifier described above, and — if you sign in — the session token that keeps you signed in.

Who else gets your data

Three service providers, each doing one job and none of them selling anything:

• Supabase — authentication, database, and backup storage.
• PostHog — product analytics and the in-app surveys. Receives your email address only if you are signed in.
• Google Firebase Hosting — serves these pages, and processes request logs including IP addresses.

We do not sell your data, and we do not share it for advertising.

How long we keep it

Your account record lasts until you delete your account. A backup lasts until you replace it, ask us to delete it, or delete your account — we do not expire it on your behalf, and we do not keep an older copy once a new one is written. Analytics events are retained for 12 months. Waitlist emails are deleted once Pro opens and the one message has gone out.

Your rights

You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it — a backup you have stored with us included. Email hello@exportkit.app and we will action it within 30 days, and usually within a day.

Deleting your account removes your profile row, any backed-up kits and your authentication record. The self-service button inside the editor is not live yet, so for now email us and we will do it by hand. Kits stored in your own browser are yours to clear.

Children

ExportKit is a developer tool and is not directed at children under 13. We do not knowingly collect their data.

Changes

If this policy changes in a way that matters — a new category of data, a new provider — we will update the date at the top and say what changed. Cloud backup going live on 16 October 2026 was exactly that, and this is the updated page. On 17 October 2026 the Analytics section was expanded to describe what is measured inside the editor, to state plainly that a signed-in account id and email are attached to it, and to cover the in-app surveys.