Privacy Policy

This policy explains what Alan: Subscription Tracker (“the app”) does with your data. The app is made by Josh Mustafa, an individual developer in the United Kingdom. I decide how your data is used. If you have a question, email me@joshmustafa.com.

The short version

Your list of subscriptions is saved on your iPhone. If you share it with your household, it is saved in iCloud, not on my server.
When you scan a statement, the file goes to my server and to OpenAI so AI can read it. The file and its transactions are not kept, and they are not used to train AI. The one exception is Help Alan get better, which is off unless you turn it on: then I may keep a redacted copy.
My server keeps a small account: your Apple sign in ID, the email address Apple gives me, your plan and a record of each scan.
There are no ads, no tracking and no analytics tools in the app. I don’t sell your data.

What my server keeps

Your account

You sign in with Apple. My server keeps:

The ID Apple gives the app for you, and an account ID for you on my server.
The email address Apple shares. If you choose Hide My Email, this is a private relay address from Apple. The app doesn’t ask for your name.
A token from Apple, stored encrypted. It is only used to remove Sign in with Apple when you delete your account.
Sign in tokens for your devices. These are stored only as a one way hash.

Your scan settings

The day your monthly scan cycle starts and your time zone. These make your cycle start on your own day.

Your plan and purchases

Apple takes your payment. I never see your card details. When you buy, restore or renew, the app sends my server Apple’s signed record of the purchase. My server keeps the plan you have (Pro, Family or Lifetime), when it ends, and whether it is in a free trial. For scan packs it keeps Apple’s transaction ID, the product and how many scans you have left.

A record of each scan

For each scan, my server keeps the kind of scan, how many files it had, when it started and finished, and what the AI reading cost. It keeps nothing from the statement itself.

Subscriptions you confirm, for the shared list

When you confirm a subscription from a statement, or add one by hand, the app sends a short merchant name (for example “NETFLIX”), the service it matched or the name you gave it, whether it is a subscription or a bill, and your country. My server stores this with your account ID, so each person only counts once. When three people confirm the same merchant, the app learns to recognise it for everyone. No amounts, dates or other statement lines are sent.

Logo lookups

When you add a subscription that isn’t in the app’s list, the app sends its name and your country so my server can find an icon. This is stored without any link to you. To find the icon, my server may search the App Store and the service’s website, and ask OpenAI to check the image is the right logo.

Statements you scan

You choose a PDF, a CSV file or a screenshot. Here is what happens to it.

The app sends the file to my server over an encrypted connection.
My server sends its contents to OpenAI. OpenAI reads the transactions and sends them back.
My server sends the transactions to your iPhone. The app finds your subscriptions on your iPhone.
My server keeps nothing from the file, unless you turned on Help Alan get better (see below). Not the file, not its name and not the transactions. Any temporary copy is deleted as soon as reading ends. Statement data is kept out of my server logs and error reports.

I ask OpenAI not to store these requests. OpenAI does not use data sent through its API to train its models. OpenAI may keep API data for up to 30 days to check for abuse, and then deletes it. You can read OpenAI’s privacy policy.

If you turn on Help Alan get better

Help Alan get better is off unless you turn it on. The app asks once when you set it up, and you can change it any time in Settings. While it is on, I may keep a redacted copy of each statement you scan, with the choices you make when you review it. Names, addresses, account numbers, sort codes and card numbers are blacked out before anything is kept, and I check every copy before I use it. I use these copies only to make the app read statements more accurately, which can mean sending a redacted copy to OpenAI to read again. They are never used to train AI, for ads or to make decisions about you, and only I can see them. Each copy is deleted 24 months after the scan, or sooner if you delete your account or ask me. Turning the setting off stops new copies at once. My server also keeps whether the setting is on, the version of the wording you agreed to, and when you turned it on or off.

What stays on your iPhone

Your subscriptions. Names, prices, dates, reminders, payment history and settings are saved on your iPhone. Exports and backups go where you choose.
Scan memory. The app remembers what past scans found and what you chose, so the next scan knows. This stays on your iPhone only. It is kept for 13 months, left out of device backups and never sent to me.
Reminders. Renewal and trial reminders are scheduled on your iPhone. I don’t send you push messages.
Widgets. Widgets read a small summary the app saves on your iPhone.

If you share your list with your household, the app uses Apple’s iCloud. Shared subscriptions and member names are saved in the iCloud account of the person who set up the household, and shared with the people they invite. I can’t see this data. Apple’s privacy policy covers it.

What I don’t do

No ads and no tracking across other apps or websites.
No analytics or crash reporting tools in the app.
I don’t sell your data or share it for marketing.
Your statements are never used to train AI.

Who else handles your data

Apple for Sign in with Apple, payments and iCloud.
OpenAI to read statements and check logos.
Fly.io hosts my server and database in London.

These companies may handle data outside the UK and Japan, including in the United States. They only use it to provide their service to me.

Why I use your data

I use your data to run the app for you, as you asked when you signed up. I use the shared list and the limits on scans because they keep the app useful and fair, which is my legitimate interest. If you turn on Help Alan get better, I keep and use redacted copies because you agreed to it, and you can withdraw by turning it off. I don’t use your data for anything else.

How long I keep it

Statement files and transactions: not kept. While Help Alan get better is on, redacted copies: up to 24 months from each scan.
Your account, plan, scan records, confirmations and the history of your Help Alan get better setting: until you delete your account.
Sign in tokens: until you sign out or delete your account.
Scan memory on your iPhone: 13 months, or until you delete your account or the app.

Deleting your account

In the app, go to Settings, then Account, then Delete account. This:

Deletes your account from my server, with your email address, sign in tokens, scan records, purchase records, confirmations, any redacted copies you shared and the history of your Help Alan get better setting.
Removes Sign in with Apple for the app.
Clears the scan memory on your iPhone.

Your subscriptions on your iPhone stay until you delete them or the app. To remove household data from iCloud, leave the household or stop sharing. Deleting your account doesn’t cancel an App Store subscription. Cancel that in your iPhone’s Settings. You can also email me to delete your account.

Once enough people confirm a merchant, the shared list may keep the fact that this merchant name belongs to a service. That fact holds nothing about you.

Your rights

You can ask to see, correct or delete your data, or object to how I use it. Email me@joshmustafa.com. I will reply within one month. In the UK, you can also complain to the Information Commissioner’s Office. In Japan, you can ask me to disclose, correct or stop using your personal information under the Act on the Protection of Personal Information.