Subscription Graveyard — Privacy Policy

1. Who We Are

Subscription Graveyard is a mobile app for iPhone, iPad, and Android published by Olaverse Labs ("we", "us", or "our"), which also maintains this website at olaverse.co.uk. This policy covers the app only. Our website privacy policy covers olaverse.co.uk separately.

Subscription Graveyard is an offline ledger for recurring payments. You enter a subscription by hand, or share a receipt into the app, and it shows what you spend per month and per year, what is due in the next seven days, and what you have saved by cancelling. Cancelled subscriptions move to a Graveyard list.

2. What Stays on Your Device

The app saves the following in its private storage on your device. None of it is ever sent to us or to any server. We do not have any servers for the app.

• Your ledger: for each subscription, the service name, amount, currency, billing cycle, next billing date, category, an optional web link for cancelling, whether you have flagged it as one you are considering cancelling, the date you cancelled it, and a history of charge dates and amounts.
• Your settings: whether reminders are on, how many days' notice you want, your chosen currency and any currency codes you added, whether you have finished onboarding, whether you have read a receipt, and which entries are the built-in demo ones.
• A receipt hand-off area, on iPhone and iPad only. When you share a receipt from another app, the five fields read from it are written to a shared container so the main app can pick them up, and are deleted as soon as it does.

Service names are text you type, so they contain whatever you choose to put there. No email address, phone number, contact, photo, location, or payment card is ever written to this storage. Other apps cannot read it. Because there is no account and no copy on our side, we cannot see your ledger and cannot recover it if you delete the app or lose your device.

3. What Leaves Your Device

The app's own code makes no network requests of any kind. Your ledger never leaves your device. Everything described below is sent by a third-party component built into the app, not by us:

• Google AdMob, which shows ads on the free version. See section 6.
• Google's User Messaging Platform, which shows the ad consent form where the law requires one. See section 6.
• RevenueCat, together with the App Store or Google Play, which handles Premium subscriptions. See section 7.
• Google ML Kit, on Android only, which may send Google diagnostic data about the text recognition feature. See section 4.

We never give any of them your subscriptions, amounts, or receipts.

4. Reading Receipts

You can share a confirmation email, a screenshot, or a PDF receipt into the app from another app, or pick a screenshot or PDF from inside it. Reading it happens on your device:

• iPhone and iPad: the app uses Apple's Vision framework, which is built into iOS.
• Android: the app uses Google's ML Kit text recognition, with the model bundled inside the app so it runs on your phone.

The email text, screenshot, or PDF is never uploaded, and never written to the app's storage. It is read in memory and dropped. Only five fields are kept: service name, amount, currency, date, and billing cycle. You see them in a form and confirm before anything is saved.

The app reads only what you hand it. It has no connection to any mailbox and cannot browse your photo library: you pick one item at a time through the system picker.

On Android, ML Kit may send Google basic diagnostic and usage information, such as device and app details and how well the feature performs, so that Google can maintain and improve it. This does not include your receipts or the text read from them. Google handles it under the ML Kit terms and the Google Privacy Policy.

5. Renewal Reminders

Reminders before a subscription renews are local notifications, scheduled and delivered by your device itself. There is no push service, no device token, and no server. A reminder shows the subscription name and amount, and is only ever displayed on that device. Notifications are optional: if you turn them off, the app works fully but cannot remind you.

6. Advertising on the Free Version

The free version shows banner and interstitial ads supplied by Google AdMob. To show and measure those ads, Google's SDK collects:

• your IP address;
• device and app information, such as device model, operating system, and app version; and
• ad interactions, such as which ads were shown and tapped.

Google handles this data as its own controller, under the Google Privacy Policy. Google explains how it uses data from apps like this one in How Google uses information from sites or apps that use its services. We do not receive this data about you as an individual. We see only totals, such as how many ads were shown and what they earned.

• The ads are non-personalised. Every ad request the app makes is marked as non-personalised, so Google does not use a profile of your interests to choose what you are shown. Ads are selected from general context, such as the app and your rough location from your IP address.
• No advertising ID is collected by the app. On Android, the advertising-ID permission is explicitly removed from the app, so the ad SDK cannot read your Android advertising ID. On iPhone and iPad, the app does not show a tracking prompt and never asks for tracking permission, so it does not receive your advertising identifier (IDFA) and cannot track you across other companies' apps and websites.
• Install measurement on iPhone and iPad. The app includes Apple's SKAdNetwork identifiers. SKAdNetwork lets Apple tell an advertiser that an install happened, without identifying you, and is operated by Apple rather than by us.
• Consent: where the law requires it, including in the UK and EEA, Google's consent form asks for your choice before any ads load. You can reopen it at any time from Ad privacy choices in Settings. Your choice is recorded on your device.
• Premium subscribers: while Premium is active, the app loads no ads and makes no ad requests, so the ad SDK sends nothing to Google.

We never send Google your subscriptions, amounts, receipts, or anything that identifies you by name. If we ever switch to personalised advertising, we will update this policy and the app's store privacy disclosures before that version ships, not after.

7. Premium

The free version is supported by ads. Premium is an optional subscription that removes them.

• Plans: Monthly at US$1.99 or Yearly at US$12.99, with a 7-day free trial on the yearly plan. Prices in other countries are shown in local currency in the App Store or Google Play before you buy.
• Renewal: the subscription renews automatically until you cancel. Cancel in your Apple ID subscription settings or in Google Play subscriptions. Deleting the app does not cancel your subscription.

How your data is handled when you subscribe:

• Apple or Google takes the payment, not us. Your card number, billing address, and payment details go to the App Store or Google Play under their own privacy policies. Neither we nor RevenueCat ever see them. See Apple's privacy policy and the Google Privacy Policy.
• RevenueCat records the subscription. RevenueCat, Inc. checks whether your subscription is active, including after you reinstall or change devices, and acts as our data processor. It receives an anonymous user ID that the SDK generates, your purchase receipt or token and subscription history from Apple or Google, and device and app information. The app has no sign-in, so RevenueCat never receives your name or email address. See RevenueCat's privacy policy.
• What we see: subscription counts, revenue, and renewal events tied to those random IDs. We cannot work out who you are from it, and we do not try.

Restoring purchases. If you reinstall or move to a new device, use Restore Purchases to get Premium back. This restores the subscription only, not your ledger, which was stored on your old device.

Refunds are handled by the store you paid. For the App Store, go to reportaproblem.apple.com. For Google Play, request a refund from your order history in Google Play.

8. What the App Cannot Do

• It cannot read your email. There is no inbox connection, no forwarding address, and no mail account access. It only sees a receipt you share into it.
• It cannot see your bank accounts, card transactions, or any financial institution. Every figure is one you typed or confirmed from a receipt you handed over.
• It cannot browse your photos. You pick one item at a time through the system picker.
• There are no user profiles, no sync, and no sharing. There is no way for one person's ledger to reach anyone else.

9. What We Never Collect

• No account. No sign-up, sign-in, name, email address, phone number, or password. Subscribing does not create an account.
• No analytics or crash reporting. There is no Firebase, Mixpanel, Sentry, or similar tool in the app, and no attribution or install-tracking SDK beyond Apple's SKAdNetwork. We do not know what you track or how often you open the app.
• No ledger of yours. The subscriptions, amounts, dates, and receipts you enter stay on your device.
• No advertising identifier collected by the app. See section 6.
• No other permissions. Beyond notifications, which are optional, the app does not ask for the camera, your location, contacts, microphone, or storage. On Android it also declares internet access, which shows no prompt.
• No payment details. Apple and Google handle all payments.
• No selling or sharing. We do not sell your personal information, and because ads are requested as non-personalised, there is no sharing for cross-context behavioural advertising. See Appendix D.

If we ever change what the app sends off your device, we will update this policy and the app's store privacy disclosures before that version ships, not after.

10. Your Choices

• Ad consent: open Ad privacy choices in Settings to review or change your choice.
• Tracking on iPhone and iPad: the app never asks to track you, so there is nothing to allow. You can confirm this under Settings → Privacy & Security → Tracking.
• Advertising ID on Android: the app cannot read it, but you can still delete or reset it in your device settings. On most phones this is under Settings → Privacy → Ads, or Settings → Security & privacy → More privacy settings → Ads.
• No ads at all: subscribe to Premium.
• Notifications: turn them on or off in the app or in your device settings.
• Your ledger: edit or delete entries in the app, use Delete everything in Settings, or delete the app. See section 12.
• Data held by Google or RevenueCat: use those companies' controls through the links in sections 6 and 7, or email us and we will help.

11. Device Backups

The ledger file lives in the app's normal storage, so it is included in your own device backups: iCloud or Mac backups on iPhone and iPad, and Google's backup on Android, which the app leaves enabled. When backups are on, your backup may include the app's data along with everything else on the device, and restoring it may bring your ledger back. The backup is created and held by Apple or Google under their own privacy policies and encryption. We have no access to it and no involvement in it. You can turn backups off in your device settings.

12. Deleting Your Data

For anything the app stores, you do not need to ask us:

• Delete a subscription in the app to remove it and its charge history.
• Use Delete everything in Settings to erase the whole ledger and its charge history immediately.
• Delete the app to remove everything it stores, settings included, at once.
• Cancel an active subscription in your App Store or Google Play settings. Uninstalling alone does not do this.

There is nothing to delete on a server of ours, because we do not have one. Some records can persist after you uninstall. RevenueCat and Apple or Google keep the subscription record, and Google keeps the ad data it holds under its own policy. You can ask us to erase our side of the subscription record, including asking us to pass the request to RevenueCat, by emailing us. It is held under a random ID, so you may need to send us that ID or your store receipt for us to find it, and we may need to keep the underlying transaction record where tax or accounting law requires. Copies in your device backup are removed through Apple or Google, not us.

13. If You Email Us

The one case where we receive personal information directly is when you choose to contact us. If you email us for support, we receive your email address and whatever you write. We use it only to reply, keep it only as long as needed to resolve the matter and for basic records, and do not add you to a mailing list.

14. Children

Subscription Graveyard is a general-audience tool for managing your own money. It is not directed at children under 13, or under 16 in countries that set a higher age for consent to data processing, and it is not registered as a child-directed app in the App Store or Google Play. It has no content shared between users, no messaging, no social features, and no open web browsing. We do not knowingly collect personal information from children. If you believe a child has used the app in a way that caused their data to be collected, contact us and we will help. Subscriptions should only be bought by the holder of the App Store or Google Play account, or with the account holder's permission. Both stores provide parental controls for purchases.

15. App Stores

Downloading the app and subscribing are transactions between you and Apple or Google. They collect their own data about downloads, purchases, renewals, and crashes under their own policies, which we do not control. Any crash reports Apple or Google share with us are aggregated and provided by the platform, not gathered by the app.

16. Changes to This Policy

If we change this policy, we will update the date at the top of this page. We will do so before shipping any version of the app that changes what data is handled.

17. Contact

Questions about this policy: contact@olaverse.co.uk

Appendix: Legal Detail

The sections above are the whole picture in plain English. This appendix restates the same facts in the formal terms that data protection law uses, for anyone who needs them.

A. Controller, Processors, and Scope

For the purposes of the UK GDPR and EU GDPR, the controller is Olaverse Labs, contactable at contact@olaverse.co.uk. Your ledger and the receipts you share are processed entirely on your own device and are never transmitted to us, so they are not personal data under our control.

For subscription data we are the controller, and RevenueCat, Inc. acts as our processor under a data processing agreement. Apple and Google act as their own controllers for the payment itself.

For advertising, Google acts as an independent controller for the data its AdMob SDK collects from your device, and for the consent record gathered through its User Messaging Platform. On Android, Google also acts as its own controller for any diagnostic data ML Kit sends. We do not receive any of it at the individual level.

We are also the controller for correspondence you send us directly.

B. Lawful Basis for Processing

• Your ledger and receipts: no lawful basis is required of us, as we carry out no processing. Processing on your own device, under your sole control, is not processing by us.
• Subscription and entitlement data: performance of a contract (Article 6(1)(b)), to provide and restore the subscription you bought. For the underlying transaction records, compliance with a legal obligation (Article 6(1)(c)) under tax and accounting law.
• Advertising in the UK and EEA: consent (Article 6(1)(a)), and consent under the UK PECR and the EU ePrivacy Directive for storing or accessing information on your device, collected through Google's consent form before any ad loads. You can withdraw consent at any time from Ad privacy choices in Settings. Ads are requested as non-personalised in all regions, so no profile of your interests is built for them.
• Email correspondence: legitimate interests (Article 6(1)(f)), to respond to a request you chose to send us.

C. Your Rights Under UK and EU GDPR

You have the right to request access to your personal data, and its rectification, erasure, restriction, or portability, and to object to processing. For your ledger and receipts these rights are exercised directly on your device, since we hold no copy: you already have full access, you can edit anything, and deleting an entry, using Delete everything, or deleting the app is immediate erasure.

For subscription records and any email correspondence you have sent us, you can exercise all of these rights by writing to contact@olaverse.co.uk. We respond within one month, as required. Subscription records are keyed to a random identifier rather than to you, so we may need you to supply that identifier or your store receipt to locate them. For advertising data, Google is the controller, and you can exercise your rights with Google directly.

If you believe we have handled your personal data unlawfully, you may complain to the UK Information Commissioner's Office at ico.org.uk, or to your national supervisory authority if you are in the EEA.

D. United States State Privacy Rights

Under laws including the California Consumer Privacy Act as amended by the CPRA, and the comprehensive privacy laws of states such as Virginia, Colorado, Connecticut, Utah, and Texas, we disclose the following:

• Categories of personal information collected through the app: identifiers, limited to a random, app-generated subscriber identifier; commercial information, being your subscription history; and device and app information accompanying subscription requests. All of these reach us only through RevenueCat. Your ledger and receipts remain on your device and are not collected by us.
• Advertising: on the free version, Google's AdMob SDK collects your IP address, device and app information, and ad interactions. The app requests non-personalised ads only and does not make your advertising identifier available, so we do not sell or share personal information for cross-context behavioural advertising or targeted advertising as those laws define it. You can also decline through the consent form in Ad privacy choices, and subscribing to Premium stops ads from loading.
• Sensitive personal information: none. Neither we nor the app collect precise geolocation.
• Sold: we do not sell personal information.
• Sources: your device, via RevenueCat, for subscription data; and you directly, when you email us.
• Retention: subscription records for as long as the subscription is active and thereafter only as long as tax and accounting law requires; email correspondence for as long as needed to handle your enquiry.

You may exercise your rights of access, correction, deletion, opt-out, and appeal by emailing contact@olaverse.co.uk. We will not discriminate against you for doing so. Because we hold none of your ledger or receipts, a request about them will be answered by confirming that we hold none.

E. International Transfers

Your ledger and receipts are not transferred anywhere by us: they stay on your device. Subscription data is processed by RevenueCat, Inc. in the United States, and advertising, consent, and ML Kit diagnostic data are processed by Google in the United States and elsewhere. Both rely on the Standard Contractual Clauses, with the UK International Data Transfer Addendum where applicable. Email you send us is handled by our email provider in the course of ordinary email delivery.

F. Security

Your ledger is protected by your device's own security: the app's private storage, your passcode, biometrics, and platform encryption. We recommend keeping a device passcode enabled, since anyone who can unlock your device can open the app. Subscription data travels over encrypted connections to RevenueCat and to the app stores, and ad requests travel over encrypted connections to Google. No system is perfectly secure, but because we hold none of your ledger or receipts, a breach of our systems could not expose them.

G. Automated Decision-Making

The app reads receipts and calculates monthly, yearly, and saved totals on your device. We make no automated decisions producing legal or similarly significant effects and do not profile you. Ads are requested as non-personalised, so Google does not profile you for advertising in this app either.