how to buy an app safely.

before you talk money

ask the founder why they are selling, what takes their time each week, and what they would do next with the app. the answers tell you what you are taking on as much as the numbers do.

make a list of everything that should come with it: the code, the domain, the app in the store, the payment account or its customers, the email list, social profiles, the brand and design files. anything not on the list is easy to forget at handover.

check the numbers

on ShipDesk, revenue marked as connected is read from the founder's payment provider with a read-only key, once a day. numbers a founder only types in, or shows as a screenshot, are their word.

• ask for a screen share of the payment dashboard, analytics and the store console, live, rather than exported files
• look at revenue month by month for as long as the app has had it, not only the last 30 days
• for subscriptions, look at how many people cancel each month and how many ask for refunds
• ask what it costs to run each month: hosting, email, APIs, paid tools
• check where visitors and users come from, and whether that depends on the founder personally

agree in writing

write down the price, what is included, how the handover works and in what order, and how long the founder helps afterwards (a few weeks of answering questions is common to ask for). both of you sign it before any money moves. for a larger sale, have a lawyer look at it.

pay through escrow

an escrow service holds your payment while the app changes hands. you pay the escrow service, the founder moves everything to you, you check that it all arrived and works, and only then does the money go to the founder. if the handover never happens, the money comes back to you.

use a known escrow service, such as Escrow.com, that you open yourself from its own website, never from a link the seller sends. agree up front who pays its fee and how many days you have to check what you received.

moving the domain

• before anything moves, copy the domain's DNS records, so the site and its email keep working after the transfer
• the founder unlocks the domain at their registrar and sends you its transfer code (also called the auth or EPP code)
• you start the transfer at your own registrar with that code; it usually finishes within a week
• a domain registered or moved in the last 60 days usually can not change registrar yet. then the founder can move it into your account at the same registrar instead
• check that you are now the registrant, with your own name and email, not only the account holder

moving an App Store app

Apple has an app transfer in App Store Connect: the founder starts it, and you accept it in your own Apple developer account. the app keeps its App Store listing, and people who already have it keep getting your updates.

• you need your own paid Apple developer account, in good standing
• not every app can be moved: Apple lists its conditions in its help for app transfers, so check them before you agree on a price
• ask for the code and everything needed to build it, and build it yourself before the last payment
• check how in-app purchases and subscriptions carry on after the move

moving a Google Play app

Google Play also moves an app from one developer account to another, from the Play Console. you need your own Play developer account, and the founder starts the transfer to it.

• agree how app signing moves, so you can keep shipping updates under the same app
• check the app's ratings, installs over time and any policy warnings in the Play Console during the screen share
• check how in-app purchases and subscriptions carry on after the move

moving Stripe and other payments

payment accounts are tied to a person or a company, so they do not change hands as simply as a domain. there are two usual ways, and the payment provider's support can tell you which fits your sale:

• if you buy the founder's company, the payment account can stay, and the owner and bank details change to yours
• if you buy only the app, you open your own account, and the provider may be able to copy customers and their saved cards across, after which subscriptions are set up again in your account
• with a merchant of record, such as Paddle, Lemon Squeezy, Polar, Creem or Dodo Payments, ask their support how products and subscribers move to your account

until payments arrive in your account, agree how the founder passes on what still arrives in theirs.

moving the code and the accounts

• have the repository moved to your GitHub (or other) account, or pushed to one you own, with its history
• deploy it yourself, from your own accounts, before the last payment
• change every password, API key, database password and secret once it is yours: the founder knew all of them
• move hosting, email sending, analytics and any other service into your name, or open your own and switch over
• check the licenses of fonts, images and paid code it uses, and that they can pass to you
• change the email and phone number on every account to yours, including the ones used for logging in

warning signs

• pressure to pay quickly, or to pay outside escrow
• a seller who will not share their screen, and offers only screenshots
• payment asked in gift cards or crypto, or to an account in someone else's name
• a link to an escrow service sent by the seller
• details that change after you show interest: the price, the numbers or what is included

if something feels off, stop. a real seller will wait while you check.

what ShipDesk does and does not do

ShipDesk.dev introduces buyers and founders. before a listing goes up, its founder proves they own the app with a code on the site or in the store listing, and a person looks at it. revenue marked as connected comes from the founder's payment provider.

ShipDesk does not take part in the sale, hold money, run escrow or check anything else a listing says. this page is general guidance, not legal or financial advice.