Data Security

Credentials are stored only by choice

• AI and translation API keys are kept in the active tab state and sent to the inScreen server only when you request an operation.
• The App Store Connect .p8 private key never leaves your browser. It is imported as a non-exportable WebCrypto key and used locally to sign tokens that expire within 20 minutes; only those tokens are sent to the server.
• App Store Connect credentials are saved in this browser's IndexedDB only after you explicitly select Save in this browser. The key is stored in non-exportable form, so scripts can use it for signing but cannot read it. Forget saved credentials removes it.
• Keys are never included in exported projects or ZIP files and are not stored in the application database.

Server-side provider calls

AI and translation requests run through server routes so credentials are not embedded in public JavaScript. App Store Connect requests carry only the short-lived signed JWT created in your browser. Asset upload URLs supplied by Apple are time-limited.

Google Play service account JSON keys are sent to the inScreen server only for a requested check or upload. The server uses the key to obtain a short-lived Google access token and does not save the key or token.

Operational safeguards

• Use inScreen over HTTPS outside local development.
• Create dedicated, least-privilege keys and rotate them regularly.
• Do not save App Store credentials on a shared computer. Use Forget saved credentials to remove a saved local copy.
• Close or reload the editor tab to clear credentials that were not explicitly saved.
• Revoke a key immediately if you suspect it has been disclosed.

Contact form

Contact-form messages are sent through Resend to LOVIGIN LTD. They do not contain editor credentials unless you choose to include them. Never send private keys through the contact form.

Report a concern

Report security concerns to support@lovigin.com. Include enough detail to reproduce the issue, but do not include live secrets.