Valemko Studio Apps Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains how the apps listed below access, use, store, and share personal information and data obtained from Google services. It applies to AdMob Bar for macOS and StoreScope for Android. Valemko Studio is the publisher and data controller responsible for the processing described here ("Valemko Studio," "we," or "us").

Data controller and privacy contact: Valemko Studio. For privacy questions, requests to exercise your data rights, or complaints, contact hello@valemko.app.

Apps covered by this policy

AdMob Bar for macOS, which lets an AdMob publisher view estimated earnings and related reporting metrics.
StoreScope for Android, which lets a Google Play developer import and view Play Console reports and app statistics.

This policy applies only to the apps identified here. Before another Valemko Studio app uses Google user data, we will add that app and its specific data practices to this policy and make the policy available from that app.

How the apps use Google data

When you choose Google sign-in, Google authenticates you and may share the account information shown during its consent flow, such as your email address and basic profile details, so the app can identify the account you selected. Your Google password is never shared with Valemko Studio.

Each app requests Google API access only to provide the reporting features described below. Google API data is not sold, used for advertising or profiling, or used to train generalized artificial intelligence or machine-learning models. Data obtained through one listed app is not used to provide another app's features. We do not operate a Valemko server that receives or stores the reports described in this policy. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

AdMob Bar

When you authorize your Google account, AdMob Bar requests the AdMob reporting scope https://www.googleapis.com/auth/admob.report. It uses the AdMob API to retrieve the AdMob publisher accounts available to you, account reporting time zone and currency, and estimated earnings reports by date. The app uses these data to display revenue summaries, trends, and a macOS widget.

The OAuth refresh token is stored in the macOS Keychain. Short-lived access tokens are held in memory. Account selections and app preferences are stored locally. A limited revenue snapshot is shared between AdMob Bar and its widget using the app's macOS shared container; the widget reads that snapshot and does not make Google API requests. Disconnecting an account removes its saved token and clears the widget snapshot.

StoreScope

When you choose Google sign-in, StoreScope asks for access to the Google account shown on the consent screen. It requests https://www.googleapis.com/auth/devstorage.read_only to list and download the Play reports you select from the Cloud Storage bucket URI you provide. This scope is used for reading report files only; StoreScope does not upload, edit, or delete bucket contents. It requests https://www.googleapis.com/auth/playdeveloperreporting to search the apps in your Play Console account and retrieve their package names and display names. StoreScope uses the results to identify the apps whose reports you choose to view. It does not use either scope to change your Google data. Reports may contain app and package identifiers, report dates and paths, install and store-performance statistics, sales and earnings records, product and country details, currencies, transaction references, and revenue amounts.

Google authenticates you; StoreScope never receives your Google password. The Google Sign-In SDK supplies short-lived OAuth access tokens when StoreScope needs to call the approved Google APIs. StoreScope holds each token in memory for the request, sends it only to Google in an HTTPS authorization header, and does not save the access token in its reports database or files. StoreScope stores a local connection-mode marker; Google Sign-In manages the sign-in session needed to restore the connection. The app does not send imported reports or OAuth tokens to a Valemko server. Reports are processed on your Android device and stored in the app's private local SQLite database. This database is not separately encrypted by StoreScope. Temporary report downloads are removed after processing; files left by an interrupted import may be cleaned up during a later sync. Existing installations may instead use a Service Account: in that separate connection path, its JSON credential, including the private key, is stored with Android secure storage backed by Android Keystore protection, not in the analytics database.

Other services used by StoreScope

Google Mobile Ads in StoreScope: StoreScope's Android Free and Demo modes may display native ads on dashboard and analytics screens; ads are hidden in Pro mode. Ad requests are subject to the consent choices and controls available through Google and the app. Google's Mobile Ads SDK may automatically collect and share an IP address, app and ad interactions, diagnostic information, and device or account identifiers for ad delivery, measurement, analytics, and fraud prevention. This ad-related processing is performed by Google and is separate from Play report data accessed through Google APIs. See Google's current Mobile Ads data disclosure.
Google Play Billing: Google processes purchases and payment details. StoreScope receives the purchase status needed to enable features; it does not receive or store payment-card numbers.
European Central Bank: when currency conversion is needed, StoreScope requests exchange rates using currency codes and dates. It does not send Play report rows or revenue amounts to the ECB.
Public Google Play pages: StoreScope may request public app listing information using a package name and the selected country or region.

Information stored locally and retention

The apps do not create a Valemko user account. AdMob Bar keeps its OAuth refresh token in the macOS Keychain, short-lived access tokens in memory, and its limited widget snapshot in the macOS shared container described above. StoreScope's Google OAuth access tokens are held transiently in memory and are not written to the app's database or files; only a local connection-mode marker is saved by StoreScope. The Google Sign-In SDK manages its sign-in session. If the legacy Service Account option is used, its JSON credential is stored with Android secure storage backed by Android Keystore protection. Imported reports and settings are stored in StoreScope's Android app-private SQLite database, which StoreScope does not separately encrypt.

Local data remains on the device until you delete it, disconnect the relevant account, clear the app's data, or uninstall the app. In AdMob Bar, disconnecting clears the saved token and widget snapshot. In StoreScope, Settings lets you disconnect Play Console while choosing whether to keep imported analytics or delete them. Uninstalling an app normally removes its private local data. We do not receive these local reports on a Valemko server, so we cannot remotely delete a copy that we do not hold.

Google and other service providers process information sent to them according to their own terms, privacy notices, and retention practices. Their systems may process data in countries other than the country where you live.

Legal bases and your choices

Where data protection law applies, we use the data you authorize or provide as needed to deliver the app features you request. Google API access is based on the authorization you grant through Google's consent flow. Where applicable, ad-related processing uses the consent choices and controls provided by the app, Google, and your device.

You can stop Google API access at any time by disconnecting the account in the app and, if desired, removing the app's access from your Google Account security settings. You can also change Android advertising ID settings on your device. Revoking access may prevent reporting features from working until you authorize access again.

Your privacy rights

Depending on where you live and the applicable law, you may have rights to request access to, correction of, deletion of, restriction of, or a copy of personal information we hold, and to object to or withdraw consent for certain processing. To make a request, email hello@valemko.app. We may ask for information reasonably needed to verify and respond to your request. You may also have the right to complain to your local data protection authority.

For information processed directly by Google, use Google's privacy settings and review the Google Privacy Policy. You can review or revoke third-party access in your Google Account.

Security

For StoreScope, sensitive Play data is protected by limiting OAuth access to the two scopes listed above and using the Google consent flow; access tokens are short-lived, kept in memory by the app, and sent only to Google API endpoints over HTTPS. StoreScope does not store those OAuth tokens or imported reports on a Valemko server. The optional legacy Service Account JSON is stored using Android secure storage with Android Keystore-backed protection. Imported reports remain in Android's app-private SQLite database, which StoreScope does not separately encrypt; protect your device with its screen lock and keep Android up to date. AdMob Bar stores its OAuth refresh token in macOS Keychain and uses HTTPS for Google API requests. No method of storage or transmission is completely secure.

Children

These apps are designed for people who manage Google Play or AdMob publisher accounts. They are not directed to children, and we do not knowingly collect personal information directly from children through the apps.

Changes to this policy

We may update this policy when an app's features or data practices change. The current version will be published at this URL with a revised update date. If an app begins accessing or using Google data in a new way, we will update the relevant disclosures and request any additional authorization required before doing so.