Privacy policy

5 October 2026

EarnHub shows the revenue your own apps and sites already earn, by connecting to the reporting APIs of the providers that pay you. This policy says what is stored, where, for how long, and how to remove it.

Current status

EarnHub is in private review and is not generally available. Free access shows Google AdMob banner ads once the Google consent form allows it. An optional monthly Pro subscription is sold through the App Store and Google Play; it removes ads from real reports and unlocks a home-screen income widget.

This policy describes the app as it is built today. It will be updated before general release.

What is stored about you

Account: the email address and identifier from the Google account you sign in with. Sign-in is handled by Firebase Authentication; EarnHub never sees or stores your Google password.

Connection credentials: for each source you connect, the credential needed to read your reports — an AdMob or AdSense OAuth refresh token, an App Store Connect API key (issuer ID, key ID, vendor number and the .p8 private key), a Google Play service account key, or a RevenueCat secret key. These are encrypted with AES-256-GCM before they are written down, and the encryption is bound to your account and to that specific connection, so a stored credential cannot be moved to another account.

Revenue data from App Store Connect, Google Play and RevenueCat: the figures those providers report to us for your own properties — daily and monthly amounts and their currency, and where a provider supplies it, the breakdown by app or product.

AdMob and AdSense: reports are read by your device directly from Google and are not sent to or stored on our servers. Our servers keep only the connection — the encrypted authorisation above, and the ID and name of each publisher account you choose.

Subscription status: whether the ad-free subscription is active is checked on this device with the App Store or Google Play, and is not stored on our servers.

Crash diagnostics: Firebase Crashlytics collects crash reports to help fix faults. Revenue figures, publisher identifiers, credentials and your email are not added to crash reports.

On this device: your display preferences — language, appearance, chosen currency, source filter and calendar state — and a copy of the report figures shown, including your AdMob and AdSense figures (amounts, currency, the breakdown by app or ad unit, ad requests, matched requests, impressions and clicks). These stay on the device.

What is never done with it

Your revenue figures, publisher identifiers, credentials and email are never used to target advertising, and are never sold, rented or shared for anyone else's marketing.

You are never asked for the password of a provider account. Every connection uses an authorisation or an API key you issue, and asks only for permission to read reports.

Where it is stored

Data is held in Google Firebase — Firestore and Firebase Authentication — with the database and the API in the asia-east2 region (Hong Kong). Google processes it on our behalf as our provider.

AdMob and AdSense reports are fetched over HTTPS by your device directly from Google, using your Google sign-in. App Store Connect, Google Play and RevenueCat reports are fetched over HTTPS by our servers directly from Apple, Google Play and RevenueCat, using the credential you supplied.

How long it is kept

On our servers, day-level detail — the per-app and per-product breakdown — is kept for 75 days and then deleted, so that last month's detail is still available throughout this month.

Monthly and daily totals are kept until you delete your account, because the app shows several years of history and providers do not serve that history quickly enough to fetch it each time.

Figures kept on your device stay until you choose Remove cache in Settings, sign out, or delete your account.

Crash diagnostics are kept under Firebase Crashlytics' own retention.

Deleting your account removes all of the above.

Advertising

Free access shows a Google AdMob banner, requested only after the Google consent form allows it. Ad requests carry no revenue figures, publisher identifiers or other report data. An ad-free subscription removes the banner. The iOS app does not request App Tracking Transparency permission. On Android, the Google Mobile Ads SDK collects and shares IP addresses (which can indicate approximate location), app/ad interactions, performance diagnostics, and advertising or device identifiers for advertising, analytics and fraud prevention, using TLS encryption in transit. You can reset or delete the advertising ID in Android settings. Android demo mode does not request ads.

Exchange rates

To show one currency, amounts are converted using published reference rates from the European Central Bank, and for currencies the ECB does not publish, from the currency-api dataset. Only a date and a currency code are requested. No information about you or your revenue is sent to either source.

Your choices

Disconnect a source at any time in Connections. That stops collection for it and removes the stored credential.

Delete your account in Settings. This removes your account record, every connection, and all stored revenue history, and deletes your sign-in identity.

Revoking at the provider is a separate step you control: an App Store Connect key, a Google Play service account key or a RevenueCat secret key should also be revoked in that provider's console. Google OAuth access is revoked automatically when you disconnect or delete, where Google accepts the request.

Request EarnHub account deletion outside the app

Email info@1001.com.hk from the Google email address you use to sign in to EarnHub, with the subject “Delete EarnHub account”. Do not send passwords, API keys or reports. We will verify account ownership before processing your request and confirm the result by email.

Deletion covers your EarnHub account record, sign-in identity, all source connections and stored revenue history. Clear device caches in the app’s Settings or uninstall the app. Revoke provider keys separately. If you have a subscription, cancel it separately in the App Store or Google Play; deleting your EarnHub account does not automatically cancel a store subscription. You can also continue to delete your account from Settings in the app.

Others involved

Google — Firebase (authentication, database, crash reporting), AdMob and AdSense reporting, and AdMob advertising.

Apple — App Store Connect reporting, and the App Store for the ad-free subscription on iPhone.

Google Play — reporting when you connect it, and the ad-free subscription on Android.

RevenueCat — reporting, when you connect it.

European Central Bank and the currency-api dataset — published exchange rates only.

Children

EarnHub is a tool for people who publish apps and sites. It is not directed at children and is not intended for them.

Changes and contact

If this policy changes in a way that affects what is collected or how long it is kept, the app will be updated and the date above will change.

Questions, or a request about your data, can go to the contact address below.