Privacy Policy

Last updated: September 28, 2026

This page explains what Store Watcher (ストア在庫ウォッチャー) stores on your device, what it sends to other services, and how you can have it deleted. Store Watcher is not an official Apple app, and is not provided, endorsed or sponsored by Apple Inc.

On your device

The app stores product names and part numbers, country or region, postal code or city, selected stores, alert preferences and the last availability results. A random installation identifier and an authentication credential are stored in the iOS Keychain or in Android no-backup storage encrypted using Android Keystore.

When you upgrade from an older version, the app reads the previous version's saved products on the device. The original file is preserved.

Availability checks

The app sends the country or region, product part number and postal code or city to Apple, either directly or through our API, to retrieve in-store pickup availability. Connections to Apple include the ordinary network information that comes with any internet request, such as the source IP address. No name, email address or precise GPS location is required.

Apple's handling of this information is described in the Apple Privacy Policy.

Adding products from a URL

When you paste an Apple product page URL, it is sent to Apple directly or to our API. Tracking query parameters and the fragment are removed. The product name, part number, sales region and source URL are retrieved and saved in your device catalog and, when the API is used, in the shared server product catalog. The shared product catalog is shown to other users as common data. Importing a product URL alone does not enable restock alerts.

On the web, Android, and iOS releases starting with version 3.1.0, a Google Store product URL is sent to our API. The server stores the product name, configuration identifier, country or region and official URL with the selected configuration. Our API retrieves the public Google Store page to check online listing availability for the chosen color and storage. Google receives the country, product page and ordinary connection information such as the source IP address. Google watches do not send a postal code or address. See the Google Privacy Policy. Older Android bookmarks remain on the device until you convert them to watches.

Restock alerts

When you enable restock alerts, the notification server stores the random installation identifier, the Apple push token, the products you watch, the country or region, the postal code or city, the selected stores and your alert preferences. The same part number and region are sent to Apple in order to monitor availability.

The notification server keeps records of availability transitions and of delivery processing. Alerts are delivered through the Apple Push Notification service. Notification permission can be changed in your device settings. In the app you can stop monitoring for a single product or for all products.

Android uses Firebase Cloud Messaging (FCM). When notifications are enabled, Google issues a Firebase Installation ID and FCM token and processes connection and device information. Our server stores the FCM token and display language and sends notification content through Google. Apple and Google watches, configurations, regions, Apple pickup locations and authentication records are stored on our server even when alerts are paused. Deleting a watch removes it from the list and stops monitoring but retains server records, including delivery history. Stop notifications or delete watches before uninstalling. Android notification permission is separate from analytics consent. Ad-enabled Android releases starting with version 1.0.1 use Google AdMob as described below.

Browser notifications

When you use the web notification page, a necessary cookie identifies this browser with a random identifier and authentication secret. The cookie is restricted to HTTPS and cannot be read by page JavaScript. The server stores a hash of the secret. It expires 180 days after the last visit and is not used for advertising or tracking across sites.

Saving a watch stores the product name and part number, country or region, postal code or city, selected stores and alert preferences on our API server. Allowing notifications also stores the browser's push endpoint, public encryption key, authentication value and display language. Notifications are encrypted using Web Push and sent through Apple, Google or Mozilla's push service, depending on the browser. These providers process delivery information such as the destination and transmission time.

Permission is requested only when you press the notification button. Stopping alerts stops monitoring and pending delivery on the server. Notifications already sent to a push service cannot be recalled. Monitoring stops after 180 days without a visit; this expiry does not automatically erase server records.

Deleting a product removes it from the list and stops monitoring, while retaining records such as delivery history. The delete-all button under Registration and data for this browser removes its subscription, products, monitoring preferences, delivery history and authentication from the live server database, and clears the cookie. Use this before clearing cookies, otherwise you cannot manage the old registration. Copies in backups are subject to their retention period and are not erased by this screen. Backups currently have no automatic deletion deadline. We will update this page if a retention period is set.

Purposes

Data supports availability checks, restock monitoring, notification delivery, saved preferences, abuse prevention and troubleshooting. The API uses source IP addresses to limit the number of requests over short periods.

Advertising

The iOS watch list and stock details, and the watch list in ad-enabled Android releases starting with version 1.0.1, display Google AdMob banner ads. Banner ads are the only ad format used. Google may process IP addresses, device identifiers, ad interactions and diagnostic information for ad delivery, measurement and fraud prevention. We do not pass your watched products, postal code or selected stores to ad requests as targeting information.

Before ads are displayed, consent status is checked with the Google User Messaging Platform (UMP), and a choice screen is presented in regions where one is required. Where applicable, the app's Settings screen includes an ad privacy options entry so you can change your choices later. Use of the iOS advertising identifier (IDFA) requires iOS tracking permission. Declining tracking permission does not prevent you from using the core availability features.

Android does not request permission to access the Advertising ID. Advertising choices and usage analytics consent are separate.

Google's handling and retention of this information are described in the Google Privacy Policy and in How Google uses information from sites or apps that use our services.

The web app displays Google AdSense display ads. Google and its advertising partners may process cookies and advertising identifiers, IP addresses, browser and device information, browsing information and ad interactions for ad delivery, measurement and fraud prevention. We do not add watched products, postcodes, selected stores, notification destinations or authentication data as ad-targeting parameters. See the Google Privacy Policy and the explanation of Google's partner services linked above for details.

Where consent is required, Google's consent message is shown and ads are served according to your choices. In applicable European regions, use “Ad privacy choices” to change your selection. In applicable US regions, use Google's displayed Do Not Sell or Share My Personal Information link. Inventory checks and notifications remain available regardless of your advertising choices. Changing your choice does not automatically erase information already sent or cookies held by advertising providers. Advertising choices are separate from consent to this service's Google Analytics.

From September 28, 2026, web advertising changes from Ninja AdMax to Google AdSense. Previous permission for Ninja AdMax is not carried over as consent to Google. For information processed through the previous advertising provider, see Ninja Tools' cookie policy and advertising partner list.

Usage analytics (Google Analytics)

After you allow analytics, the web app measures ad-tag loading, slot requests, filled or unfilled slots, loading errors, and ad positions on the page. Errors may result from ad blocking or connection problems and do not prove that a blocker is in use. Measurement is unavailable when GA itself is blocked. We do not bypass browser blocking settings to send these events.

With your permission, Google Analytics (GA4 / Firebase Analytics) measures users, screens, watch creation and deletion, notification setting changes, and purchase-button actions. Events may include product codes, categories and store markets. They exclude entered product names, product URLs, postal codes, selected stores, notification destinations and tokens, and API credentials. A purchase-button action does not mean a completed purchase.

Google processes an analytics app-instance or cookie identifier, device and browser information, and connection information such as IP addresses, which may be used to infer approximate location. This feature does not enable advertising identifiers or personalized advertising. The app's advertising choices are separate.

Analytics is off until you allow it. Change your choice in app Settings or Analytics preferences at the bottom of the website. All features work without analytics. Turning it off stops future collection and resets local analytics data or clears web analytics cookies. It does not automatically erase data or aggregates already sent to Google. Web consent choices are stored for 180 days.

For operations, the notification server also aggregates registered devices and browsers, watches by product and market, monitoring counts, and delivery states. These counts have different coverage from consenting GA users and exclude products stored only on a device.

This website

This website is served through Google's Firebase Hosting. Firebase Hosting processes visitors' IP addresses to detect abuse and analyze usage. Google states that Hosting retains IP data for a few months. See Privacy and Security in Firebase for details. This website uses Google Analytics according to the choices described above. The web watch page is served through Amazon Web Services (AWS) and uses the advertising choices described above. The introduction pages and this privacy policy do not contain ads.

Storage and deletion

You can delete saved products from within the app. Stopping alerts stops the corresponding monitoring and any pending notifications. Removing a local product or stopping alerts does not erase all server records. The product catalog remains as shared product metadata that is not linked to an individual user.

No single retention period has been fixed for server-side records at this time. This page will be updated once one is set.

To request deletion of information stored on the server, contact us at the address below. After confirming which records are yours, we delete the device notification registration, the monitoring settings and the delivery processing records. Do not include private keys or authentication secrets in email.

Contact

For questions about Store Watcher data: info@cavemen.jp

For deletion requests, please tell us your country or region and what you would like removed, so that we can identify the records.

Changes

We update this page, and its last-updated date, whenever the app's features or data handling change.