Privacy Notice

Effective: October 10, 2026 · Version 1.2

This notice explains how the Costy iPhone app, website, and hosted AI service process personal data. The controller and service provider is Costy. Contact us at [email protected].

1. Eligibility

Costy is intended for people aged 18 or older. We do not knowingly seek data from anyone under 18.

2. Data on your device and in iCloud

Expenses, amounts, currencies, dates, notes, tags, payment source names, household instructions, imported receipts and statements, settings, and temporary AI results are stored on your device. Your 18+ confirmation, accepted Terms version and timestamp, and optional debugging preference, consent version and timestamp are also stored only on the device. This recording preference does not sync through iCloud. Expense and household records may sync to your private Apple iCloud area through CloudKit, depending on your Apple Account and iCloud settings. If you enable household sharing, invited people can access the shared records. Original receipt and PDF files remain on the device and are not part of the CloudKit household record.

We process this data to provide the service, sync across devices you select, and perform household sharing you request. In the EEA, the usual legal bases are performance of the service contract and legitimate interests in operating and securing the service. We request consent separately where applicable law requires it.

3. Data sent for AI processing

AI analysis starts only when you request it. In addition to the text, voice transcript, receipt image, or PDF pages you select, Costy may send your time zone, language, default currency, tag and payment source names, household instructions, and up to 20 prior expense examples per tag for classification context. Prior examples may include amount, date, payment source, tags, and expense notes. Costy does not request or send bank passwords.

• Your own key: the request goes from your device to the OpenAI, Google Gemini, Vercel AI Gateway, or OpenRouter account you select. Retention and training follow your agreement with that provider. The key is stored in Apple Keychain.
• Standard: Costy routes the request through its servers to Vercel AI Gateway or OpenRouter and an underlying model provider. Standard does not enforce zero data retention so it can offer lower-cost processing. Providers may retain inputs or use them for model improvement under their terms.
• Premium: Costy routes the request through its servers to OpenRouter and requests endpoints that support zero data retention. This protection depends on the current ZDR commitments of OpenRouter and the routed provider.

4. Subscription and security data

RevenueCat processes a randomly generated app user identifier and purchase or subscription status. The hosted AI service uses that identifier to verify access. Costy servers may process an IP address briefly for rate limiting, a hashed user identifier for quota accounting, and technical metadata such as model, token/cost totals, response status, and error code to operate and secure the service. Costy is designed not to write AI prompt contents to application logs unless you separately consent to the optional recording described below.

Optional debugging records

With your separate consent, Costy may retain the content and household information you submit for hosted AI analysis, provider requests and responses, analysis results, and processing records for up to 30 days for debugging and evaluation. These records are kept on Costy servers and, for developer-mode diagnostics, also exported through our analytics processor Langfuse Cloud (EU), where Costy developers can review them. Langfuse records are linked only to hashed subscription or device identifiers, not raw IDs, and carry subscription tier, input method, timing, token usage, and cost metadata. Recording is off by default; declining does not affect normal use. Only information already sent for analysis is recorded; API keys are excluded. Requests sent directly to a provider with your own key are outside this scope. A provider’s zero-data-retention policy does not cover these records.

You can withdraw consent and stop future recording in Settings → Privacy & Data. Operations already started finish with your previous preference. Turning recording off or erasing device/iCloud data does not delete existing server records; they remain for up to 30 days. To request earlier deletion, email [email protected] with your Subscription ID.

5. Retention

• Device and CloudKit expense records: until you delete them;
• original documents: until you erase Costy app data or remove the app;
• on-device AI result cache: up to 7 days;
• server-side AI result cache: up to 1 hour;
• 18+ and Terms acceptance record: until the app is removed or a new version is accepted;
• rate-limit records: about 2 minutes;
• weekly usage records: up to 14 days;
• subscription cache: about 5 minutes;
• usage metadata on Costy servers: up to 90 days;
• optional debugging records, including the Langfuse (EU) diagnostic export: up to 30 days; the local recording preference remains until you turn it off, erase Costy data, or remove the app.

Apple, RevenueCat, Cloudflare, and AI providers may keep security, billing, and legally required records under their own policies. Standard-plan AI content retention varies by provider. Infrastructure providers’ technical logs are retained under the relevant account settings only while reasonably needed for security and troubleshooting.

6. Recipients and international transfers

Depending on your choices, data may be processed by Costy servers, Apple, RevenueCat, Cloudflare, Vercel, OpenRouter, the model provider serving a request, and, for optional developer-mode diagnostics, our analytics processor Langfuse (EU-hosted). These providers may operate in the EEA, Türkiye, the United States, and locations disclosed for their subprocessors. Transfers are subject to the data terms active on the provider accounts and, where applicable, standard contractual clauses, adequacy decisions, or other lawful safeguards. Required transfer mechanisms must be completed before regular processing begins in a market.

7. Website storage and tracking

This static website does not use advertising, behavioral tracking, session replay, or an analytics SDK. It stores only a lang value in browser localStorage to remember the language you select. You can remove it through browser settings. The hosting provider may process ordinary security and access logs.

8. Your choices and rights

Use Settings → Privacy & Data in the app to erase Costy data from the device and CloudKit. Erasing a shared household may affect its other participants. Removing the app does not automatically cancel an Apple subscription.

Depending on your location, you may request access, correction, deletion, restriction, portability, objection, consent withdrawal, or an appeal. Email [email protected] and include enough information to verify the request, including your RevenueCat app user identifier when available. EEA users may complain to their local supervisory authority. Costy does not sell personal data or use it for cross-context behavioral advertising.

9. Security and changes

Costy uses reasonable measures such as data minimization, Apple Keychain for provider keys, and encrypted network connections. No system can guarantee absolute security. Material changes will update the version and effective date here and, when appropriate, be announced in the app.