AdMob Earnings · Last updated 21 September 2026
AdMob Earnings (“the app”) shows you your own Google AdMob revenue on your iPhone. This policy explains exactly what the app touches, what is kept, where it is kept, and how to make it all go away.
The app is operated by PXLBORN (“we”). You can reach us at apps@pxlborn.com.
The short version. Your AdMob earnings data is fetched by your phone directly from Google and is never sent to us or stored on our servers. What we store is the permission slip that lets your phone ask Google — encrypted, tied to a one-way hash of your Google account, and deletable by you at any time from inside the app. We do not use analytics, advertising or tracking of any kind, and we sell nothing to anybody.
When you sign in with Google, the app requests a single, read-only permission:
https://www.googleapis.com/auth/admob.readonly — permission to
read your AdMob reports. It cannot change your AdMob account, your ad units,
your payment details or anything else.openid — so our server can confirm which Google account granted
the permission. Without it we could not tell one user's permission from another's.That is the complete list. The app asks for no contacts, no location, no photos, no files, no microphone and no camera.
This is the part worth being clear about. Your reports — revenue, impressions, clicks, eCPM, per-app and per-country figures — travel directly from Google’s servers to your device. They do not pass through our server, and we have no copy of them, no ability to read them, and no record that a particular figure ever existed.
A cached copy of the most recent figures is kept on your device so the app opens instantly instead of showing a spinner. It lives in the app's private storage, protected by iOS, and is destroyed when you sign out or delete the app.
Our server exists for one reason: to hold the credential that lets your phone obtain short-lived access tokens from Google without you signing in repeatedly. It stores the following and nothing else.
| What | Form it is stored in | Why |
|---|---|---|
| Your Google account identifier | HMAC-SHA256 hash, keyed with a secret. The raw identifier is never written. | To recognise a returning user without being able to enumerate who our users are. |
| Google refresh token | Encrypted (XChaCha20-Poly1305 authenticated encryption), key held outside the database. | The permission slip itself. This is what lets the app work without re-consenting. |
| Short-lived Google access token | Encrypted, expires within an hour. | Cached so we do not have to bother Google on every request. |
| Device session token | SHA-256 hash only. The token itself is never stored. | So your device can prove it is the one we issued the session to. |
| Rate-limit counters | A truncated hash of the request source, plus a count. | To keep automated abuse off our Google API quota. |
| Timestamps | When an account or device was created and last used. | So unused data can be deleted automatically. See section 5. |
The app's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs is used only to display your own AdMob reporting inside the app. It is not transferred to anyone else except as necessary to provide that feature, it is never used for advertising, and it is never sold. No human reads it — we could not, as it never reaches us.
| Data | Deleted automatically after |
|---|---|
| A device session that stops being used | 90 days |
| An account whose permission stops being used | 365 days, and the permission is revoked at Google at the same time |
| Rate-limit counters | 1 day |
You do not have to wait for any of these. See the next section.
You can remove everything yourself, immediately, from inside the app:
Settings → Disconnect Google account.
This asks Google to revoke the permission, deletes the stored credential from our server along with every device session attached to it, and clears the data held on your device. It is immediate and cannot be undone — you would need to sign in and grant permission again. The app also disappears from the Third-party apps with account access list in your Google account.
You can also revoke access at any time, without using the app, from myaccount.google.com/permissions. Deleting the app from your phone removes everything held on the device.
If you would rather we did it, email apps@pxlborn.com and we will action it within 30 days.
Google is the only third party involved, and only because it is the source of your data and the authority that issues the permission. Their handling is covered by the Google Privacy Policy.
There is no analytics provider, no crash reporter, no advertising network, no marketing tool and no data broker. We share nothing, sell nothing, and have nothing to share or sell.
No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please email us rather than disclosing it publicly.
The app is a tool for people who run an AdMob publisher account and is not directed at children under 13. We do not knowingly collect information from them.
Depending on where you live, you may have rights to access, correct, export or erase your personal data, and to object to its processing. Because the only personal data we hold is an irreversible hash and an encrypted credential, the practical form these take is deletion — see section 6. For anything else, email us.
If this policy changes materially we will update the date at the top and, where the change affects how your data is handled, note it in the app.