Deleted the moment analysis ends
Removal happens in a finally block, so it runs whether the scan succeeded, failed, or timed out. What persists is the report: the score, the findings, and the app name and version.
You are uploading an unreleased app. We treat it that way.
Your build is the most sensitive artifact you own before a release, so the handling rules are worth stating plainly rather than burying in a policy page. Here is exactly what happens to the file you upload, and what does not.
Never executed, anywhere
Verdict reads bytes. It does not run your app in a simulator, on a device, or in a sandbox. There is no environment where your code executes on our infrastructure.
Findings are deterministic
Every check is a rule with an explicit condition, written by hand and covered by tests. Two scans of the same build always agree, and a finding cannot be invented.
Rules tracked against policy
A scheduled job reads Apple and Google's published policy pages every morning and flags changes, and every report records the engine version that produced it.
The formal terms are written up in the privacy policy and the data processing agreement.