Privacy Policy

1. Who we are and what this covers

Hidden Spend is an iOS app for tracking recurring subscriptions. It is made and published by Arda Demir Yıldız, an independent developer established in Türkiye, and "we" and "us" throughout this policy mean exactly that one person.

Under the GDPR and laws written in its shape, that is the data controller for anything this policy covers, and the contact address for it is support@hiddenspend.app. There is no company behind the app, no team, and no third party we share the role with.

This policy covers both:

• the Hidden Spend iOS app, and
• the Hidden Spend website (our marketing site).

Where the two behave differently, we say so. If anything here is unclear, write to us at support@hiddenspend.app and we'll explain it in plain terms.

Effective date: 4 August 2026.

2. The data you create in the app

Hidden Spend does not connect to your bank, your cards, or any payment account. There is no bank linking. You add each subscription yourself, by typing it in.

For each subscription you may enter things like:

• the service name
• the price
• the billing cycle (monthly, yearly, and so on)
• the next renewal date
• a category
• optional notes
• an optional icon

The app also stores things it works out from that — your running monthly and yearly totals, price-increase history, upcoming renewals for the calendar view, and anything you've moved to the archive.

All of it is stored locally on your device, in the app's own storage. It is not sent to us. We do not receive it, we cannot look it up, and we have no copy of it. If you're wondering how we handle your subscription data: we don't handle it at all.

CSV import and export

You can import a CSV into the app and export your data back out as a CSV at any time. Both happen on your device. When you export, the resulting file goes wherever you choose to send or save it — from that point it's under your control and whatever service you hand it to, not ours.

3. There is no account and no server

You don't create an account to use Hidden Spend. There's no email address to give us, no password, no username, no profile.

We don't operate a Hidden Spend server that stores your data, and we don't run a cloud sync service. There is no user database on our side, so there's no list of Hidden Spend users, no per-user records, and nothing for us to leak, sell, subpoena-produce, or lose in a breach of a database we don't have.

4. iCloud backup

If you have iCloud Backup turned on for your iPhone, iOS may include Hidden Spend's data in your device backup.

That backup is Apple's service, under your Apple Account. It's encrypted by Apple and governed by Apple's privacy policy, not this one. We can't access it, browse it, or restore from it. We have no visibility into whether it exists.

You control this in your iOS settings, under your Apple Account → iCloud.

5. Face ID and Touch ID

If you turn on the app lock, Hidden Spend uses Apple's LocalAuthentication framework, which runs entirely on your device.

The app asks iOS "is this the device owner?" and receives back a simple yes or no. That's it.

We never receive, see, store, or transmit biometric data. Apple does not share your face or fingerprint data with us — it never leaves the secure hardware on your device. There is no biometric information anywhere in Hidden Spend.

6. Notifications

Notifications are optional. You'll see the standard iOS permission prompt, and you can say no — the app still works.

If you allow them, reminders (a renewal coming up, a free trial about to convert, an occasional check-in on something you may no longer use) are scheduled locally on your device by iOS. There is no push server, so no notification content ever travels through us or anyone else.

You can turn notifications off at any time in iOS Settings, or in the app.

7. Photos

If you choose a photo from your library as a custom icon for a subscription, iOS asks your permission first, and the image is copied into the app's local storage.

That copy stays on your device. We never receive it. Hidden Spend does not read your photo library beyond the specific image you pick.

8. Purchases — Hidden Spend Pro

Pro is not yet available to buy, so none of what follows happens today — there are no purchases, and no purchase data of any kind reaches us. This describes how it will work when Pro launches.

Hidden Spend Pro is an optional one-time purchase that unlocks the paid features. It will be sold through Apple and the App Store.

• Apple processes the payment. We never see your card number, billing address, or payment details. They don't pass through us.
• What we receive is the anonymous receipt / entitlement status from Apple that tells the app whether the unlock has been bought. It doesn't identify you.
• Pro is a one-time purchase, not a subscription: charged once, with no renewal and nothing to cancel. Restoring it on another device is free.
• There is nothing to manage or cancel, because nothing recurs. (Yes, we noticed the irony of a subscription tracker selling a subscription. That is largely why it isn't one.)

Apple's handling of your purchase is governed by Apple's own privacy policy and terms.

9. The two things that leave your device

Hidden Spend is a local app, but it is not a completely offline one. Exactly two things go out to the internet. One happens in the background; the other only ever happens if you buy something.

Neither one sends your subscription list, your prices, your renewal dates, your notes or your totals.

Currency exchange rates. If you track subscriptions in more than one currency, the app fetches published exchange rates so your totals add up. It is a plain, keyless request — no account, no device identifier, no tracking parameter. It asks for the day's rates and nothing else, and sends no information about you, your subscriptions, or your device.

Purchases, if you buy Hidden Spend Pro. Payment itself is handled entirely by Apple; we never see a card number and there is no card number for us to see. What we use is a third-party payment processor to tell us whether a given install owns the Pro unlock — and to tell us that a sale happened.

Being precise about what that involves, because it is the one place a company other than Apple sees anything at all:

• It happens only when you buy Pro, restore a purchase, or the app checks whether this device already owns it. If you never buy, this request never happens.
• What the processor receives is the App Store transaction — the product bought, when, and an anonymous identifier for the install.
• It does not include your name, your subscriptions, your prices, your renewal dates, your categories, your notes or your totals. It sees a receipt. It has no idea what you track.
• The processor's handling of that data is governed by its own privacy policy, not this one. If you would like to know which company it is, write to support@hiddenspend.app and we'll tell you.

We use a processor for one honest reason: it tells us immediately when someone buys the app, which for an independent developer is the difference between knowing the thing works and finding out weeks later. The alternative was running our own server to receive Apple's notifications, and we would rather disclose a processor here than operate infrastructure we cannot keep as carefully.

That is the complete list. There is no telemetry, no crash reporting service, no analytics ping, and nothing that phones home when you open the app.

10. What we don't do

To be explicit, because most apps aren't:

• We do not sell your data. There's nothing to sell.
• We do not share data with data brokers.
• We run no advertising and have no ad SDKs in the app.
• We use no third-party analytics or tracking SDKs. We don't count your screen views, your taps, or your sessions. The payment processor described in section 9 is not an analytics one: it is told that a sale happened, never what you do in the app.
• We do not track you across other apps or websites.
• We do not build profiles, score you, or infer anything about you.
• We do not cancel subscriptions on your behalf, which also means we never act as you with any provider. Hidden Spend tracks and reminds; you do the cancelling yourself.

11. The website

Our website is static. It exists to explain the app.

• We set no cookies.
• We run no analytics and no trackers.
• There's no sign-up form, no newsletter, no pixel, no session tracking.

Honest caveat: like any website, ours is served by a hosting provider, and hosting providers keep standard server access logs — typically IP address, browser user agent, and timestamp — for security, abuse prevention, and keeping the site up. That's a normal part of how the web works, and it happens for every site you visit. We don't use those logs to build profiles, identify visitors, or link anything back to app users. We don't run analytics on top of them.

12. Children

Hidden Spend isn't directed at children under 13, and we don't market it to them.

We knowingly collect nothing from anyone, children included — there's no mechanism in the app by which we could. If you're a parent or guardian with a question, write to us at support@hiddenspend.app.

13. Keeping and deleting your data

Your data stays on your device for as long as you want it there. We don't have retention periods, because we don't have your data.

• Delete a single subscription: do it in the app. Note that "cancelled" subscriptions are moved to the archive rather than erased, so you keep the history of what you used to pay for. If you want an archived entry gone for good, delete it from the archive.
• Delete everything: delete the Hidden Spend app from your iPhone. iOS removes the app's local data with it.
• Remove the iCloud copy: if iCloud Backup included the app's data, that copy sits in your Apple Account backup. Manage or delete it in iOS Settings under your Apple Account → iCloud → Manage Account Storage → Backups. That's Apple's system, and only you can do it.

Before you delete the app, consider exporting a CSV. Once it's gone, it's gone — we have no copy to restore.

14. Your rights

Privacy law generally gives you the right to access your data, correct it, take a portable copy, and have it deleted — that's the shape of GDPR in Europe, the CCPA/CPRA in California, and similar laws elsewhere.

Here's the honest version of how that works with Hidden Spend: you already have all of it, directly, without asking us.

• Access — open the app. It's all there.
• Correction — edit any entry yourself.
• Portability — export a CSV, any time, no request needed.
• Deletion — delete entries or delete the app.
• Opting out of sale or sharing — there's nothing to opt out of. We don't sell or share your data, and we never have.

If you sent us a formal data subject request, our truthful answer would be that we hold no personal data about you to produce, correct, or erase. That's not a dodge — it's the direct consequence of the app never sending your data anywhere.

The one exception worth naming: if you email us at support@hiddenspend.app, we'll obviously have your email and whatever you wrote, for as long as it takes to help you. You can ask us to delete that correspondence.

If you're in the EU or the UK and think we've mishandled your data, you can complain to your local data protection authority — you don't have to come to us first. Given section 3, that email is about the only thing there is to complain about, but the right is yours either way and you should know it's there.

15. International users

Your subscription data stays on your device, wherever you and your device are. We don't transfer it anywhere, so there's no international transfer of your personal data by us — no cross-border data flows, no standard contractual clauses needed, nothing in transit.

If you use iCloud Backup or buy Pro, Apple may process data in accordance with its own policies and infrastructure. That relationship is between you and Apple.

16. Changes to this policy

If we change this policy, we'll update the effective date at the top of this page.

If a change is material — if we ever start doing something with your data that this page says we don't — we won't bury it. We'll note it in the app and in the release notes for the version that introduces it, so you find out before you use it, not after.

17. Contact

Questions, corrections, or you think something here is wrong? Write to us:

Arda Demir Yıldız — independent developer, Türkiye support@hiddenspend.app

A real person reads it, and it is the same person named at the top of this policy. We'd genuinely rather fix an unclear sentence than have you guess at what we meant.