Privacy Policy
Here’s the honest version, in plain words: your subscription list lives on your device, there’s no account behind any of it, and the few moments the app does use the internet — reading a voice note or a photographed bill — are listed below, with exactly what travels and why.
The short version. Recury keeps your subscriptions, amounts and reminders on your iPhone. It has no user accounts and no analytics. When you add an entry by voice or by photo, that one clip or image is processed in the cloud through our relay and immediately discarded — nothing is stored, and your list itself never leaves the device. The app asks your explicit permission before the first cloud read, and you can withdraw it anytime in Settings → Privacy & Data. We never sell your data or share it with advertisers. You can export everything, and delete everything, whenever you like.
Your data stays with you
Recury stores the subscriptions you add (their names, amounts, billing cycles, dates and any reminders) in a file on your device. When an entry was read from a photo, the original picture is kept on your device too, so the card can show you where it came from. Those files are written with iOS file protection, so they sit encrypted whenever the device is locked. There is no Recury account, no cloud profile, and no server that holds a copy of your list. If you delete the app, that data goes with it.
Device backups. Because the data lives in the app’s own storage, it is included when you back your iPhone up — to iCloud or to an encrypted local backup — under the backup settings you control and Apple’s encryption. That is your copy, made by your device; Recury still runs no server that holds one.
Where the reading happens
When you type a subscription, Recury understands it on your iPhone: Apple’s on-device Foundation Models read the text where the hardware supports them, alongside Recury’s own built-in parsing. Only if the on-device models can’t run or decline does that one line of text go to the cloud instead.
When you speak or photograph a bill, the reading happens in the cloud: the audio clip or the image is sent away to be understood, because today’s on-device models aren’t reliable enough at reading receipts or mixed-language speech. If the photo can’t reach the network, an on-device fallback reads what it can. Either way, what comes back is the same short set of facts — a name, a price, a rhythm — and the clip or image is not stored along the way.
Nothing goes to the cloud without your say-so. The first time a voice note, a photo, or a typed line would need cloud reading, Recury asks you first — naming who does the reading — and remembers your answer. You can change it anytime in Settings → Privacy & Data → Cloud reading. If you decline, voice input stays off, photos are read by the on-device fallback, and typed text is only ever read on your iPhone.
What leaves your device, and what doesn’t
Every network request Recury makes goes through our own relay server (api.recury.app, run on Cloudflare) — the app carries no keys to any third-party service, and the relay holds no storage: it forwards a single request, returns the answer, and keeps no copy of what you sent. Here is the complete list of what can travel:
- A voice note. When you add by voice, the audio clip goes through the relay to a speech-recognition provider (currently Groq, Inc., under its zero-data-retention setting) to be turned into text, then the text is understood as described above. The clip is processed for that one request, is not retained, and is not used to train models.
- A photographed bill. When you add by photo, the image goes through the relay to a document-reading model (routed via OpenRouter, Inc.) solely to extract the subscription’s details. The relay pins that routing to endpoints on OpenRouter’s zero-data-retention list, so whichever provider serves the request may not keep a copy. The original photo stays on your device; the copy sent for reading is not retained or used for training.
- Typed text, as a fallback. If Apple’s on-device models aren’t available, the single line you typed may be sent through the relay to the same document-reading provider, for that one entry only.
- A brand name. To match what you added to a real service, Recury may look the name up (for example, “Superlist”) via the relay against a brand directory (logo.dev). The lookup carries the name you typed — never a price, a date, or anything else from your list.
- Logos. To show a service’s mark, Recury fetches an image from logo.dev using the service’s public web domain, for example netflix.com. That request carries the domain, and nothing about you or your finances.
- What never leaves. Your subscription list, totals, reminders and history are not uploaded anywhere. There is no tracking SDK, no advertising identifier, and no analytics pipeline in Recury. Like any internet service, the relay sees your IP address while handling a request — it uses it only to throttle abuse. It doesn’t log the content of what you send; its infrastructure (Cloudflare) briefly keeps standard technical records of requests — timing, status, path — for reliability and abuse protection, and brand-name lookups deliberately travel inside the request body so even those records never contain a name you typed.
Reminders
Charge reminders are scheduled locally by iOS. Recury asks the system to notify you before a renewal; the content of those reminders never travels to us, because there is no “us” server to travel to. And if you keep the app behind the Face ID lock, reminders go discreet: the banner names no service and no amount — it just points you into the app.
Face ID & Touch ID
If you turn on the biometric lock, authentication is handled entirely by Apple’s system. Recury only ever learns whether you passed. It never sees your face, your fingerprint, or any biometric data. If your device can’t evaluate biometrics or a passcode, Recury lets you in rather than trapping you out.
Recury Plus & payments
Recury Plus is an optional in-app purchase handled by Apple through your Apple Account. Apple processes the payment; Recury never sees your card number or billing details. We only learn that a valid purchase exists, so the app can unlock the extra features.
Exporting & deleting
You can export your full history at any time as a file you keep. You can also permanently delete all of your data from the device in Settings → Privacy & Data. Deletion is immediate and cannot be undone. Because the data was only ever on your device, there is no other copy for us to remove.
This website
The app has no analytics. The website counts its readers, and here is exactly how. Each page you open is recorded on our own server: the path, the response, where you arrived from, your country, and whether the request came from a browser or a robot. No cookie is set, no script runs on the page for it, and nobody else is involved. So that one reader is not counted twice, we store a hash of your IP address and browser, salted with a secret that changes every day. The address itself is never stored, query strings are dropped before anything is written, and after a day the hash matches nothing.
Joining the waitlist stores your email address and the date you gave it, and nothing else. You confirm by clicking a link in the mail, so an address entered by mistake never stays on the list. We write once, on the day Recury reaches the App Store. Every email has a one-click unsubscribe that deletes your address rather than flagging it, and the whole list is deleted once the launch email has gone out. To leave sooner, write to hello@recury.app.
Children
Recury is a general-audience app for tracking your own subscriptions. It is not directed to children under 13 and does not knowingly collect their data.
Changes to this policy
If the app changes in a way that affects this policy, we’ll update this page and its “last updated” date. Because Recury has no account, we can’t email you, so the current version here is always the one that applies.
Contact
Questions about privacy? You can reach us from Help → Contact support inside the app, or at hello@recury.app.