Privacy Policy

DRAFT — not yet published. Content was resolved by the 2026-07-02 legal review (an AI-assisted multi-agent review directed by the owner — see the task 0025 record; not attorney work product). Bracketed [PLACEHOLDER: …] tokens (provider identity, effective dates, operational verifications) must be filled in before publication.

Effective date: [PLACEHOLDER: effective date] Provider: [PLACEHOLDER: legal entity] ("Drip Meter", "we", "us", "our") Contact: [email protected]

The short version

Drip Meter is a subscription tracker built so that your personal data stays with you.

What you type stays with you. Every subscription, amount, currency, budget, note, payment-method label, and trial date you enter lives on your device. If you choose to back up, it goes to your own iCloud Drive or Google Drive account — never to a Drip Meter server. We have no Drip Meter account system and no Drip Meter database that holds your personal data.
Diagnostics are optional and off by default. Crash reporting and aggregate analytics are each opt-in. If you never turn them on, no diagnostic data leaves your device for those services.
We never sell your data and never use it for advertising or cross-app tracking.

The rest of this policy is the complete, precise account of the limited operational data the app does handle.

What we never do

We never send the subscription data you enter to a Drip Meter server — we operate no such server.
We never broker bank credentials, card numbers, or transaction data.
We never read your email, calendar, contacts, or messages.
We never sell your personal data, and we never use or share any data — operational or otherwise — for advertising or cross-app tracking.

The only third parties that receive any operational data are the providers listed below, under written data-processing agreements, for the limited purposes described. (One nuance: for its own security and abuse-prevention purposes Cloudflare also acts as an independent controller — see section 1.)

The data we handle

This is the complete list of data the app transmits off your device or makes available to a third-party service. Data the app keeps strictly on your device (your local database, derived totals, and scheduled local reminders) never leaves it and is not covered here.

1. Content-delivery requests (always on)

To fetch the curated service catalog and currency-exchange rates that make the app useful, the app makes unauthenticated requests to cdn.dripmeter.me, served by Cloudflare.

What is sent: standard web request metadata — your IP address, your device's User-Agent, the time, and the requested path. No cookies, no query parameters, and no Drip Meter identifier. (Under the GDPR, an IP address is personal data even when it is not linked to an account.)
When: on app launch (at most once per hour) and when catalog or rate content changes.
Where it lives: at Cloudflare's edge, not with Drip Meter. Cloudflare does not give us its per-request access logs on the plan we use. At most we can see aggregate traffic statistics (request counts by country) and, when a request trips Cloudflare's security protections, a sampled security event that can include the requesting IP address. We do not use either to identify anyone, and we cannot connect them to you or your data. Cloudflare retains the request data on its own infrastructure under its published policies for routing and abuse-prevention; for those security purposes Cloudflare acts as an independent controller under its own privacy policy (https://www.cloudflare.com/privacypolicy/).
Your control: there is no in-app toggle, because these requests are how the app stays useful. You can block network access at the device or network level.
Legal basis (GDPR): our legitimate interest in delivering the service catalog and currency-rate content the app needs to function, and in keeping that delivery secure and reliable. Because these requests carry no Drip Meter identifier and happen at most hourly, the impact on you is minimal. Your right to object is described under "Your rights" below.

2. Cloud backup (your choice)

If you turn on backup, the app copies your data file to your own cloud account.

What is sent: the backup file (your subscription data, budgets, settings, and a currency-rate cache snapshot).
Where it lives: your own iCloud Drive (iOS) or Google Drive app folder (Android). The transfer is between your device and your cloud account. The file is never sent to Drip Meter. We hold no credentials to either cloud and keep no copy of the file.
When: after you change data (briefly debounced), when the app goes to the background, and once daily as a safety net.
Your control: Settings → Backup → off stops further uploads. Settings → "Delete cloud backup" removes the existing file from your cloud account. Uninstalling the app alone does not reliably remove the cloud-stored file — delete it via Settings before uninstall, or via your cloud provider afterwards.
Legal basis (GDPR): we do not need one, because we never process this data. Backup is a transfer you direct from your device to your own cloud account, using Apple's and Google's platform services; Drip Meter never receives, stores, or can access the file, so we are not a controller of your backup. You enable it with an explicit choice during onboarding and can turn it off at any time in Settings. To the extent the app's role in starting the upload from your device counts as processing by us at all, it happens because it is necessary to provide the backup feature you asked for (Article 6(1)(b) GDPR). Once the file is in your iCloud or Google Drive, your agreement with Apple or Google governs it.

3. Crash reports (opt-in, off by default)

If you turn on crash reporting, the app sends crash diagnostics to Sentry.

What is sent: stack traces, app version, operating-system version, device model, and sanitized breadcrumbs we control.
What is never included: subscription names, amounts, currencies, notes, payment-method labels, budgets, or any string you typed. Personally identifying data is disabled in the crash SDK and pinned by an automated test.
When: only on a crash, and only while crash reporting is enabled in Settings.
Where it lives: Sentry, EU region. The EU data region is fixed and built into the app; there is no setting that can move it elsewhere.
Retention: Sentry's standard retention — 90 days by default.
Identifier: crash reporting uses its own app-generated, per-install pseudonymous identifier, generated the first time you opt in. It is not derived from any operating-system or device identifier, and it is separate from the analytics identifier below.
Your control: Settings → Crash reports → off. Your current crash-reports install ID is shown in Settings (tap to copy). Settings → "Reset crash-reports ID" generates a new ID, after which prior reports become orphaned and expire on Sentry's standard 90-day retention. For deletion sooner than that, email [email protected] with the install ID(s) you want deleted, and we will delete them manually from Sentry. We deliberately do not delete from the app itself, because doing so would require embedding a privileged Sentry token in the app — a security risk. Settings also links a "What crash reports collect" page listing exactly these fields.
Legal basis (GDPR): your explicit opt-in consent.

4. Aggregate analytics (opt-in, off by default)

If you turn on analytics, the app sends a small set of fixed-schema usage events to PostHog.

What is sent: named events from a closed, code-defined list (for example: app launched, onboarding completed, a subscription was added, and the paywall/purchase funnel events). Each event carries only fixed, enumerated properties — for example a subscription's billing cycle bucketed to monthly/yearly/weekly/other and its currency code. Free-form payloads are forbidden, and an automated guard rejects any event whose property names look like personal data.
What is never included: subscription contents, amounts, currency values, names, notes, budgets, or any field you typed. Session recording is disabled at three independent layers. Automatic SDK events (app-opened, screen views, surveys) are disabled.
Also sent: when analytics starts, the PostHog SDK fetches its own configuration from the same EU service. That request carries the app's project token, standard web request metadata, and your analytics install ID (the same identifier your events carry) — no events and nothing you typed.
When: only when analytics is enabled in Settings.
Where it lives: PostHog Cloud EU. The EU host is built into the app as a constant; there is no setting that can move it elsewhere.
Retention: analytics events are deleted on PostHog's plan-level retention schedule; we do not extend it. [PLACEHOLDER: confirm the plan's concrete retention period in the PostHog project settings and state it here as: events are deleted after N months.]
Identifier: an app-generated, per-install pseudonymous identifier, generated the first time you opt in. It is not derived from, and not joined with, any operating-system or device identifier (no IDFA, no Android Advertising ID). It is independent of the crash-reports identifier; resetting one does not affect the other.
Your control: Settings → Analytics → off. Your current analytics install ID is shown in Settings (tap to copy). Settings → "Reset analytics ID" generates a new ID, after which prior events become orphaned and expire under the analytics retention stated above. For deletion sooner than that, email [email protected] with the install ID(s) you want deleted, and we will delete them manually from PostHog. As with crash reports, we do not delete from the app to avoid embedding a privileged key. Settings also links a "What analytics collect" page, generated from the code itself, that lists every event the app can send.
Legal basis (GDPR): your explicit opt-in consent.

The dripmeter.me website

This policy is also published at https://dripmeter.me, where the app stores link to it. The dripmeter.me website is a static site: it sets no cookies, runs no scripts, includes no analytics, no embedded fonts, and no forms — which is why you see no cookie banner. Its pages are served by Cloudflare, so visiting generates the same standard web request metadata described in section 1, handled the same way and under the same legal basis.

Deleting your data

Data	How to delete it
Your subscription data (on this device)	Settings → "Delete all my data" erases this device's subscriptions, budgets, and settings, clears both telemetry install IDs, and restarts onboarding. Your cloud backup is intentionally left intact so an accidental wipe is recoverable. The app also keeps its own record of when your free Pro trial started, so deleting your data does not restart the 30-day trial.
Your subscription data (in the cloud)	Settings → "Delete cloud backup" removes the file from your iCloud/Drive, then delete the app. Or delete the file via your cloud provider. Uninstalling alone does not reliably remove it.
Crash reports	Settings → "Reset crash-reports ID" rotates the install ID (future reports orphaned, expiring on Sentry's 90-day retention). For sooner deletion, email [email protected] with the install ID(s).
Analytics events	Settings → "Reset analytics ID" rotates the install ID (future events orphaned, expiring under the analytics retention in section 4). For sooner deletion, email [email protected] with the install ID(s).
Content-delivery logs	Nothing to delete on our side — Cloudflare does not give us its per-request access logs (see section 1). Cloudflare's retention follows Cloudflare's own policies.

"Delete all my data" is a local wipe, not a global account deletion — Drip Meter holds no account to delete. It does not delete vendor-side crash or analytics records; those follow the reset-and-email path above.

How this maps to the store privacy labels

The App Store "App Privacy" and Google Play "Data Safety" labels summarize the same facts described above. With both optional features turned on (the worst case), the labels reflect:

Diagnostics — crash data (via Sentry, EU): not linked to your identity, not used for tracking.
Usage data — product interaction (the analytics events via PostHog Cloud EU): not linked to your identity, not used for tracking.
Identifiers — an app-generated per-install identifier (one per opt-in feature): not an operating-system or device identifier, not linked to your identity, not used for tracking.
Purchases — whether a Pro purchase was started, succeeded, failed, or was restored, and whether the paywall was viewed or dismissed (opt-in analytics events via PostHog Cloud EU; no price, receipt, or store account): not linked to your identity, not used for tracking.

We do not use any data to track you across apps or websites, and we do not share data with data brokers. If both optional features are off, no data goes to the crash or analytics processors; the content-delivery requests in section 1 still occur. The exact category names on each store's form are finalized when the store privacy questionnaires are filed at submission.

Your rights

If you are in the European Economic Area, the UK, or another place with similar laws, you have the right to access, correct, and delete your personal data, to receive a copy of it in a portable format, and to restrict or object to its processing. For crash reports and analytics, you can withdraw your consent at any time — withdrawing is as easy as giving it: Settings → Crash reports / Analytics → off. Withdrawal stops future collection and does not affect the lawfulness of what happened before. We make no automated decisions about you and build no profiles.

Because the data you enter never reaches us, most of these rights you exercise directly on your device and in your own cloud account. For the crash reports and analytics events we do control, email [email protected] with your install ID(s) — copyable from Settings — and we will respond within one month.

You can also complain to a data-protection authority. Ours is the Spanish Agencia Española de Protección de Datos (AEPD), https://www.aepd.es; you may also complain to the authority where you live or work.

Where your data is processed

The opt-in crash reports and analytics events are stored in the EU (Sentry's EU data region and PostHog Cloud EU, both fixed in the app). The companies behind these services, and Cloudflare, are based in the United States, so limited access from outside the EU can occur — for example for vendor support or administration. Every such transfer is covered by our data-processing agreement with that provider, which relies on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses. The content-delivery requests in section 1 are answered by the Cloudflare data center nearest you, which may be outside the EU; those requests are covered by the same Cloudflare data-processing agreement and safeguards described above. You can ask us about these safeguards at [email protected]. [PLACEHOLDER: before publication, confirm each vendor's current DPF certification status (Cloudflare Inc., Functional Software Inc. d/b/a Sentry, PostHog Inc.) on the official DPF list and that the executed DPAs incorporate DPF and/or SCCs; keep only the mechanisms that are true.]

Roles under data-protection law

Our role differs by data category:

Category	Our role	Other parties
Your subscription data	Not a controller — we never receive it. The app initiates the transfer to your own cloud via platform APIs.	You have a direct relationship with Apple / Google for your iCloud / Drive account.
Content-delivery logs	Controller (for the delivery of your request)	Cloudflare processes them as our processor to route and serve content, and also independently — as its own controller — for the security and abuse-prevention purposes described in Cloudflare's privacy policy.
Crash reports (opt-in)	Controller	Sentry is our processor.
Analytics events (opt-in)	Controller	PostHog is our processor.

We maintain data-processing agreements with each processor.

Children

Drip Meter is not directed to children, and we do not knowingly collect personal data from children. What you type never leaves your device except to your own cloud backup, and both optional diagnostic features — crash reports and analytics — are off until someone turns them on in Settings. If you are below the age at which you can consent to data processing yourself (under 14 in Spain, where we are based; under 13 in the United Kingdom and the United States; between 13 and 16 elsewhere in the EEA, depending on the country), do not turn these features on — ask a parent or guardian. If a parent or guardian believes a child has turned them on: turn the feature off in Settings, use "Reset crash-reports ID" or "Reset analytics ID", or email [email protected] with the install ID(s) shown in Settings and we will delete the associated data.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected by an updated effective date, and the current version is always available in the app (Settings → About → Privacy policy) and at https://dripmeter.me/privacy.

Contact

Questions or requests: [email protected].

If you email us, we process your email address and the contents of your message (including any install IDs or store order numbers you include) solely to handle your request. Once a request is resolved we delete or minimise the correspondence, keeping only a record that the request was handled.