Apple subscription retention

Stop losing subscribers without writing a line of code.

Apple's Retention Messaging API gives you a window to keep cancelling subscribers — if you can host the callback. RetainKit is that callback, plus the marketer-shaped UI to run it.

Get started → Connect App Store Connect Try the demo →

Two-minute look around · no signup · no Apple key · No SDK integration

Runtime: Cloudflare Workers
Edge p50: ~80ms globally
Setup: One .p8 + one URL

RetainKit rule builder showing a sentence-shaped retention rule alongside a live iOS cancel-sheet preview — Rule builder + live iOS preview

Apple prerequisite

Apple Retention Messaging is new and requires access.

Apple Retention Messaging lets eligible subscription apps show a retention message or promotional offer when a subscriber starts to cancel. Apple currently requires developers to request access before using the API in production.

Official Apple docs developer.apple.com/documentation/retentionmessaging Request API access developer.apple.com/contact/request/retention-messaging-api

What's special

Three things make RetainKit different.

No code to integrate

Apple calls one URL when a user tries to cancel. We host that URL. You paste it into App Store Connect once.

Hosted endpoint per app and environment: runtime.retainkit.dev/apple/retention/<appId>/<environment>
Apple's strict <1s response budget met from Cloudflare's edge (p50 ≈ 80ms globally measured)
One-time setup: drop your .p8 key, paste the runtime URL into App Store Connect, you're live
Optional: route requests to your own backend instead if you want — we won't get in your way

Built for marketers, not engineers

Configure rules in three sentences. Build A/B tests with two clicks. No JIRA tickets.

Sentence builder: "When someone on Monthly tries to cancel, show them 50% off 3 months with message Welcome Back."
Drag-reorder priority, draft-state indicators, single Publish action
Iterations don't require an engineer or a deploy
Real iOS preview of the cancel sheet, live as you edit

Real outcome measurement, not vanity counts

We poll Apple's Subscription Status API for every offer served. Save rate, redemption rate, revenue retained — not "impressions".

Per-flow / per-offer / per-A/B-variant KPI tiles
Frequentist A/B significance (z-test + p-value), winner detection, "samples to significance" estimate
30-day sparklines on every metric
Outcome polling silently runs every 5 min on Cloudflare Cron; data accumulates without you doing anything

How it works

Three steps from signup to live retention.

Connect Apple

Paste your .p8 key and key IDs on /integrations. One-time, takes a few minutes per app.

RetainKit Integrations page showing App Store Connect .p8 key upload — Integrations setup

Configure flows

Build sentence rules in a few clicks. Author messages, group offers, split traffic for A/B.

RetainKit Flow page with the sentence-shaped rule builder — Flow builder

Apple calls us

Customer hits cancel. Apple POSTs the realtime URL. We pick the rule, sign the offer, respond in ~80ms.

RetainKit Runtime page showing the hosted endpoint URL that Apple calls — Runtime endpoint

Security & infrastructure

Built on Cloudflare, designed for controlled operations.

Hosted on Cloudflare

Workers at the edge, D1 (SQLite at edge), KV for runtime config
Global p50 latency well under Apple's response-time budget
DDoS protection, WAF, and edge rate-limiting baked in
No servers to run on your side; no scaling concerns

Your Apple key, your data

Apple .p8 private keys are encrypted at rest with AES-256-GCM (per-org KMS-equivalent secret)
Never readable in plaintext outside the runtime path that signs requests to Apple
We don't have access to your StoreKit transactions beyond what Apple's API exposes
All other PII (original transaction IDs in logs) is SHA-256-hashed; raw IDs only stored encrypted for outcome polling and decrypted just-in-time

Operational hardening

Every config mutation is captured in an immutable audit log, viewable as a timeline per org
Role-based access: owner / admin / editor / viewer
Email verification gates production publish
Single sign-out option revokes every device at once
Each app's config is environment-aware: sandbox vs production are separate KV namespaces, never mix

Controlled runtime

Runtime behavior is driven by published configs, not ad hoc backend changes
No client SDK to import, no app code to ship — Apple is the only thing calling the endpoint

Use cases

What teams actually do with it.

Win-back at scale

Run "50% off 3 months" for users canceling Monthly, "1 month free" for Annual cancellers. Different offers per product without separate codepaths.

Localized retention

Different copy and offer mix per storefront, no extra deploys.

A/B everything

Test offers, copy, alternate-product suggestions. Get a p-value, not a hunch.

Existing backend? Use it.

If you'd rather Apple call your server, set your URL on the Runtime page. RetainKit becomes the config and analytics layer.

Technical articles

Implementation notes for Apple Retention Messaging.

Guide

Pricing

Start free. Scale when it pays for itself.

Free

Indie

forever

1 app
1,000 retention events / month
1 active flow
Basic outcome dashboard
Community support

Get started free

Small Team

$49/mo

$39/mo billed annually

Up to 3 apps
15,000 retention events / month
Unlimited flows
A/B testing + significance stats
Up to 5 team members
Email support

Start 14-day free trial

Cancel anytime before day 14

Growth

$149/mo

$119/mo billed annually

Unlimited apps
150,000 retention events / month
Unlimited flows + multi-variant A/B
Unlimited team members
SSO + multi-org
Priority support

Start Growth