Costy
English
EnglishTürkçe
Home
Legal

Privacy Notice

Effective: September 26, 2026 · Version 1.0

This notice explains how the Costy iPhone app, website, and hosted AI service process personal data. The controller and service provider is Costy. Contact us at [email protected].

1. Eligibility

Costy is intended for people aged 18 or older. We do not knowingly seek data from anyone under 18.

2. Data on your device and in iCloud

Expenses, amounts, currencies, dates, notes, tags, payment source names, household instructions, imported receipts and statements, settings, and temporary AI results are stored on your device. Your 18+ confirmation and the accepted Terms version and timestamp are also stored only on the device. Expense and household records may sync to your private Apple iCloud area through CloudKit, depending on your Apple Account and iCloud settings. If you enable household sharing, invited people can access the shared records. Original receipt and PDF files remain on the device and are not part of the CloudKit household record.

We process this data to provide the service, sync across devices you select, and perform household sharing you request. In the EEA, the usual legal bases are performance of the service contract and legitimate interests in operating and securing the service. We request consent separately where applicable law requires it.

3. Data sent for AI processing

AI analysis starts only when you request it. In addition to the text, voice transcript, receipt image, or PDF pages you select, Costy may send your time zone, language, default currency, tag and payment source names, household instructions, and up to 20 prior expense examples per tag for classification context. Prior examples may include amount, date, payment source, tags, and expense notes. Costy does not request or send bank passwords.

  • Your own key: the request goes from your device to the OpenAI, Google Gemini, Vercel AI Gateway, or OpenRouter account you select. Retention and training follow your agreement with that provider. The key is stored in Apple Keychain.
  • Standard: Costy routes the request through a Cloudflare Worker to Vercel AI Gateway or OpenRouter and an underlying model provider. Standard does not enforce zero data retention so it can offer lower-cost processing. Providers may retain inputs or use them for model improvement under their terms.
  • Premium: Costy routes the request through a Cloudflare Worker to OpenRouter and requests endpoints that support zero data retention. This protection depends on the current ZDR commitments of OpenRouter and the routed provider.

4. Subscription and security data

RevenueCat processes a randomly generated app user identifier and purchase or subscription status. The hosted AI service uses that identifier to verify access. The Cloudflare Worker may process an IP address briefly for rate limiting, a hashed user identifier for quota accounting, and technical metadata such as model, token/cost totals, response status, and error code to operate and secure the service. The Worker is designed not to write AI prompt contents to its application logs.

5. Retention

  • Device and CloudKit expense records: until you delete them;
  • original documents: until you erase Costy app data or remove the app;
  • on-device AI result cache: up to 7 days;
  • 18+ and Terms acceptance record: until the app is removed or a new version is accepted;
  • Worker rate-limit records: about 2 minutes;
  • weekly usage records: up to 14 days;
  • Worker subscription cache: about 5 minutes.

Apple, RevenueCat, Cloudflare, and AI providers may keep security, billing, and legally required records under their own policies. Standard-plan AI content retention varies by provider. Costy technical logs are retained under the Cloudflare account settings only while reasonably needed for security and troubleshooting.

6. Recipients and international transfers

Depending on your choices, data may be processed by Apple, RevenueCat, Cloudflare, Vercel, OpenRouter, and the model provider serving a request. These providers may operate in the EEA, Türkiye, the United States, and locations disclosed for their subprocessors. Transfers are subject to the data terms active on the provider accounts and, where applicable, standard contractual clauses, adequacy decisions, or other lawful safeguards. Required transfer mechanisms must be completed before regular processing begins in a market.

7. Website storage and tracking

This static website does not use advertising, behavioral tracking, session replay, or an analytics SDK. It stores only a lang value in browser localStorage to remember the language you select. You can remove it through browser settings. The hosting provider may process ordinary security and access logs.

8. Your choices and rights

Use Settings → Privacy & Data in the app to erase Costy data from the device and CloudKit. Erasing a shared household may affect its other participants. Removing the app does not automatically cancel an Apple subscription.

Depending on your location, you may request access, correction, deletion, restriction, portability, objection, consent withdrawal, or an appeal. Email [email protected] and include enough information to verify the request, including your RevenueCat app user identifier when available. EEA users may complain to their local supervisory authority. Costy does not sell personal data or use it for cross-context behavioral advertising.

9. Security and changes

Costy uses reasonable measures such as data minimization, Apple Keychain for provider keys, and encrypted network connections. No system can guarantee absolute security. Material changes will update the version and effective date here and, when appropriate, be announced in the app.