Privacy Policy

Last updated 11 November 2026

Push200 is run by Brazaustra Pty Ltd (ABN 45 647 949 488), an Australian company ("we"). This policy explains what personal information we collect, why, and your choices. We handle it in line with the Australian Privacy Principles and, where they apply to you, privacy laws such as the GDPR and UK GDPR. To contact us about privacy, email contact@push200.com.

What we collect

• Your account: your name, company, email, mobile number, chosen language and a protected form of your password. We never see your actual password after you set it. If you sign up with Google or GitHub, they tell us your name, your email address and your account ID with them, and nothing else.
• Your GitHub connection: your GitHub username and the ID of the connection you approved. We get short-lived access from GitHub only when we need it, and only to the repositories you chose. If you connected with a token before, it's encrypted before it's stored.
• Your apps and builds: repository names, app settings, build results, build minutes and the dates you added keys.
• Billing details: your plan, subscription status, renewal date and Stripe customer ID. Stripe handles card details, so we never receive or store your card number.
• Security information: failed sign-in counts, a one-way scrambled form of your network address to limit repeated sign-ups, and basic error records.
• Technical information: the logs our hosting provider keeps to run the service securely, such as IP addresses and browser type.
• Connected AI assistants: if you connect an assistant such as Claude, we keep its name, the dates you connected it and last used it, and a one-way scrambled form of its access. We receive only the requests it makes for you, such as which app to build, and not your conversation.

Your keys stay with you

Your Apple and Google store keys pass through our server once, are sealed for GitHub and go into your repository's encrypted secrets. That's the only place they stay. We keep only the date you added them, not the keys. If we create an Android key for you, you download the only copy we hand out, and we don't keep it.

To connect Google Play, we create a separate robot account for each app in our own Google project. You choose what it can do by inviting it in Play Console. Its key goes into your GitHub's encrypted secrets, and we don't keep it. We delete the robot when you remove the app or your account.

The same goes for your Apple certificate key. If you connect another app, a short job in your own GitHub seals your keys for that app's repository, so only GitHub can open them. We pass along the sealed copy, and we can't read it. Copies of Apple keys we held before this change have been deleted, and they leave our backups within 30 days.

We read files in the repositories you choose to detect your app's details, but we don't copy your source code into our database. Your code is built on your own GitHub account.

If someone else built your app, you can send them a private link. They can use it to add your app's Firebase settings files without an account. Each file goes into your GitHub's encrypted secrets, and we don't keep it. We keep the link's details until you remove the app, in a form that can't be read without our encryption key. The link expires after 7 days and you can cancel it at any time.

If you choose Connect with Google, you approve read-only access to your Firebase projects through Google's own screen. We use it only to find your apps and fetch their Firebase settings files, which go into your GitHub's encrypted secrets. We don't store your Google access or use it for anything else, and we give it back to Google as soon as we've finished. If we need to ask which project to use, it waits in an encrypted cookie in your own browser for up to five minutes. We keep only the date each file was added.

Push200's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and browser storage

We use one essential cookie that keeps you signed in, and one preference cookie that remembers the language you chose, shared by push200.com and the portal and kept for a year. Neither of them tracks you. Your browser also stores small preferences such as light or dark mode. We don't use analytics trackers. We use Google Ads cookies only if you press Accept on our cookie notice, to see which of our ads led to a sign-up or payment. If you decline, they never load, and you can change your mind by clearing your cookies for push200.com. Google reCAPTCHA runs when you confirm your mobile number, and it may set its own cookies to detect abuse.

Why we use it, and our legal basis

• To create your account, confirm your mobile number, run your builds and show their status, because we need to in order to provide the service you asked for
• To charge for paid plans, because that's part of our contract with you, and to keep tax and payment records, because the law requires it
• To keep the service secure and prevent abuse, because we have a legitimate interest in protecting you and us
• To contact you about your account or important changes, because that's part of providing the service

We don't sell your personal information or share it for advertising. We don't send marketing emails unless you've agreed, and you can opt out at any time. While you're setting up, we may send up to three short emails reminding you where you stopped. Each one has a link that stops them.

Who we share it with

We share only what each provider needs to do its job:

• Google Firebase and Google Cloud: our database, its backups, and sending PIN text messages. Google reCAPTCHA also checks sign-ups for abuse.
• Vercel: hosts this website.
• GitHub: runs your builds on your own account.
• Stripe: takes payments for paid plans.
• Apple and Google: receive the apps you choose to send them.
• Hostinger: handles email you send to us.
• Amazon Web Services: sends your build emails and setup reminders, and stores our encrypted backups in Sydney.
• Anthropic: writes two things for you, and only when you press the button for them. If you ask us to explain a build error, the end of that build's log is sent to Anthropic's Claude. If you use the store listing helper, the description of your app that you type is sent. Build logs don't contain your store keys, because GitHub hides them.
• The AI assistant you connect: if you connect an assistant such as Anthropic's Claude, it receives the answers to what it asks for you: your app names, what each app still needs and your build results. It never receives your store keys.

We may also share information if the law requires it, to protect people or our rights, or with whoever takes over the service if the business is sold. If that happens, this policy keeps applying to your information until you've been told otherwise.

Information sent overseas

These providers may store information outside Australia and outside your country, including in the United States. Where the GDPR or UK GDPR applies, we rely on the providers' approved safeguards, such as standard contractual clauses. You can ask us for details.

How long we keep it

• Account and app information: while your account is open. When you delete your account, it's removed from our live database straight away.
• Backups: daily backups are kept for 30 days, so deleted information can stay in them until they expire.
• Payment records: kept by Stripe and by us for as long as tax law requires, usually at least 5 years in Australia.
• Security information: kept only as long as it's needed to protect the service.

Your rights and choices

You can change your details, disconnect GitHub and remove apps in your portal at any time. You can delete your account under Account in the portal, which removes your personal information from our records as described above.

Depending on where you live, you may also have the right to see your information, correct it, get a copy, limit or object to how we use it, and withdraw consent. To ask, email contact@push200.com. We'll respond within 30 days, and we won't treat you differently for asking. We may need to confirm it's you first.

Removing an app from Push200 doesn't remove anything from your own GitHub repository, including the secrets and the separate build branch.

California residents

California residents can ask to know, correct or delete their personal information. We don't sell personal information or share it for cross-context advertising.

People who use your apps

Push200 builds your apps but doesn't collect information from the people who use them. You're responsible for your own apps' privacy policy and for how they handle their users' information. If you're in a place where data protection law treats us as your processor for information in your account, we'll only handle it to provide the service, under your instructions in these pages, using the providers listed above, and we'll tell you without undue delay about a breach that affects it.

Children

Push200 isn't for anyone under 18, and we don't knowingly collect their information. If you think a child has given us information, email contact@push200.com and we'll delete it.

Security

We encrypt the secrets we hold, protect passwords with a one-way hash, block all direct browser access to our database and use HTTPS throughout. No online service can guarantee complete security, so please use a unique password. If a data breach is likely to cause you serious harm, we'll tell you and the regulator as the law requires.

Complaints

If you have a privacy concern, email contact@push200.com first, and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner or your local data protection authority.

Changes

If we make important changes to this policy, we'll update this page and tell you by email before they apply.