WhiskerCheck Privacy Policy
Last updated: 10 October 2026.
This policy explains what WhiskerCheck does with your data. It is written from what the code actually does, not from what we would like it to do.
Who is responsible
Miguel Gamarra, an individual. Address: Proviv. Res. La Esperanza, Carabayllo, Lima 15121, Perú. Contact for anything to do with privacy: privacy@whiskercheck.com.
The most important part
- Your pet’s name, its photos and what you write in its diary never leave your phone. Never. Your history does not leave the phone as a list, although our server notes every scan and the metrics report what each one comes back with.
- When what you scan is not in our documented database, we ask the assistant and note down that word so we know what to document next.
- When you scan a label or take a photo, that photo is sent to our server and Google’s AI service (Gemini) reads it. It stays 30 days in our technical log and then deletes itself.
- Of your pet we only send species and weight, because that is what the verdict depends on.
- Our server stores every scan with the app identifier: which mode, what came back, the species and the weight, the app version, whether you are on free or Pro and, for 30 days, your IP address. It is used to know how the app is used, what fails and whether someone is abusing it. The identifier is let go after 14 months, and you can let it go sooner from Settings.
- If you subscribe, RevenueCat sees that purchase — from your phone, not from our server — tied to an anonymous identifier they generate and that is not ours.
- We measure how the app is used and when it breaks, with Firebase, from Google: which screens are opened, what each scan comes back with, what you search for and what fails. It comes switched on and you can turn it off whenever you like in Settings → Privacy. It does not include your pet’s name, its photos or your diary.
- There are no accounts, no advertising, no cross-app tracking, no advertising identifiers.
- We do not sell data to anyone, nor hand it over for commercial purposes.
What is kept on your phone
Almost all of this lives in the app’s normal storage, with no extra encryption. The last two rows are the exception and go in the phone’s Keychain, which is where iOS keeps what must not be lost or copied to another device:
| Data | What it is |
|---|---|
| Each pet’s profile | name, species, today’s weight and, if you fill them in, breed, sex and date of birth |
| Each pet’s photo | a copy of its own inside the app, not a link to your camera roll |
| Weight history | every weigh-in with its date, so the curve can be drawn |
| Vaccines, deworming, medication and visits | what, when it was done, when it is due and your notes |
| Diary | whatever you write, with its date |
| Home check | what you have marked as put out of reach |
| History | the last 100 scans: the whole verdict, with the pet and the weight it had that day, and how much it ate if you said so |
| Language, country and appearance | if you changed them by hand in settings |
| Whether you share metrics | what you chose in Settings → Privacy |
| Firebase identifiers | the ones their SDK generates for this installation. It is Firebase that puts them there, not us, and they are only sent if metrics are on |
| App identifier | see the next section |
| How many free scans you have used up | a number from 0 to 5, and nothing else: neither what you scanned nor when. In the Keychain |
| RevenueCat identifier | the one their SDK generates if you ever open the paywall. In the Keychain, and it is RevenueCat that puts it there, not us |
The reminders for a vaccine or medication are not a piece of data in this table: your phone schedules them, not our server. When you delete a record or delete everything, the app cancels them.
Of this table, what reaches our server with every scan is the app identifier, your pet’s species and weight, your language, the country if you chose it by hand and the amount if you enter one, and with every request whether you are on free or Pro, which the app knows from the subscription. They are stored with the scan. The section “What is sent to our server” tells that story. Some rows do go out to others. The RevenueCat identifier goes to RevenueCat. And if metrics are on, the app identifier, the Firebase ones, your language, your appearance, the country if you chose it by hand and how many free scans you have used go to Google. The sections “The metrics” and “Who else sees anything” tell that story.
You can delete every row above from Settings → “Erase everything on this phone”, or by uninstalling the app, except the last two. Those two live in the Keychain, and the Keychain survives both.
“Erase everything” also respects your choice about metrics, on purpose: erasing your data should not switch back on what you turned off. Uninstalling the app does erase it. That button does change the Analytics identifier, so that at Google what came before and what comes after are not linked; the Crashlytics one is managed by its own SDK and there is no way to change it from the app. Without a connection neither one changes: if the server does not answer, the app identifier is kept so that the erasure can be repeated, and with it everything would still be linked. It is unlinked when you repeat it with a connection.
And that is on purpose, so we will say it without dressing it up: if the counter were erased, reinstalling would hand out five free scans every time, and the paywall would not exist. Checked on an iPhone on 7 September 2026 — on reinstalling, the same counter and the same subscription came back, without tapping “Restore purchases”.
Bear in mind that, if you have iCloud or Google backups switched on, this data may end up in them. That copy is in your account and is governed by Apple’s or Google’s terms, not by ours. The scan counter is the exception: it is marked not to be copied to another phone, not even in a backup.
The two identifiers
There are two that matter, and we do not pass either of them to the other. That is the important part and that is why it comes first: RevenueCat does not receive ours, so it cannot know what an installation scanned.
What changed in September 2026, and it is worth saying here: if metrics are on, ours travels to Google with them, and with it whether you are on free or Pro, the steps through the paywall and what each scan comes back with. We, on the other hand, can put that together with the reports you send and with the scans our server stores, which carry the same identifier: that is what we use it for. The section “The metrics” tells that story.
Ours
The first time you open the app, a random number (a UUID) is generated. We do not get it from your phone or from your account: the app makes it up. It is used for four things: holding back abuse — how many scans you have done in the current hour —, knowing that a report of an incorrect result comes from the same installation, knowing how each installation uses the app and what fails for it — our server stores every scan with it — and, if you share metrics, linking what happened on that installation with its failures, its reports and our server’s logs.
That “how many scans” has nothing to do with the five free ones: they are two different counters, in two different places. The one here is kept by our server, goes by the hour and deletes itself. The five-free one is kept by your phone and lasts for life; it never reaches our server, and reaches Google only as a metric, if you have metrics on.
We treat it as personal data. It does not carry your name and we only share it with Google, for the metrics and only if they are on, but it is stable and it identifies your installation, and under the GDPR that is enough.
If you erase everything from settings, the app tells the server first so that it lets go of whatever it has tied to that identifier, and only then deletes it from your phone and starts using a new one. That order matters: the other way round we would lose the only key for finding your data. If there is no connection at that moment, the app tells you instead of taking the erasure for granted.
Uninstalling the app without going through settings does not tell the server. If that happens to you, write to us at privacy@whiskercheck.com and we will do it — we will need you to tell us when and what you scanned or reported, because without the identifier we cannot find it for you. And if you do not write to us, it is let go on its own after 14 months.
RevenueCat’s
RevenueCat is who handles the subscription, and their SDK generates its own identifier
— it starts with $RCAnonymousID — the first time the app starts up with purchases
enabled.
We do not pass them ours, and that is a decision, not an oversight: the SDK accepts that we give it a user identifier and we deliberately do not. Nor do we give it your email, your name, or any attribute of yours, even though the SDK allows that too. So RevenueCat receives nothing of what we send to Google, and Google does not receive RevenueCat’s identifier. What stops anyone putting together what each of them knows is that nobody passes it to the other, and we say it that way because that is the accurate way: we have already removed from Firebase the identifier Apple gives your iPhone for our app, which was the only thing they both received alike.
We never read that identifier at any point: of everything RevenueCat answers, the app looks at one thing only, whether the subscription is active or not. A yes or a no.
This one also lives in the Keychain, so it survives uninstalling the app and “Erase everything on this phone”. That is what makes your subscription come back when you reinstall without having to restore it, and also what makes “Erase everything” not reach RevenueCat: that button cleans your phone and our server, not theirs. For that, write to us.
What is sent to our server
Our server runs on Cloudflare Workers.
When you scan a barcode: the code, the app identifier, the pet’s species and weight, and the language. If you then say how much it ate, that amount too.
When you scan a label or a photo: the same, plus the photograph. The photo is resized to 1280 pixels wide before being sent; that reprocessing also strips the original image’s metadata, including the location if it had one.
When you report an incorrect result: the app identifier, what you scanned, the verdict you got and the reason you chose.
If a scan fails inside the app — the connection drops, no answer arrives —: what failed, at which step and how long it had been going, with the app identifier.
And with every one of those requests, the app says about itself: its version, the native version it runs on and the update package it has, the phone’s system — “ios 26.1” — and whether you are on free or Pro.
If you are Pro, our server knows, but decides nothing with it. The app says so that we can tell apart how paying users and everyone else use the app. The paywall is still resolved entirely inside your phone, and nothing about the purchase reaches us: not the receipt, not the price, not the RevenueCat identifier.
As with any internet connection, Cloudflare also sees your IP address. Our server stores it with every scan and every failure for 30 days, together with the network you connect from — your carrier’s number, not your location —. That is what lets us see that a spike of requests comes from a program and not from people, and block it. It also reads the country that Cloudflare infers from it — two letters, “PE”, “ES” — or the one you chose by hand in settings if you changed it.
That country is used for four things: choosing the poison control phone number you are shown in an emergency, asking the model for the name used where you are — “palta” and not “aguacate” —, storing the answer separated by country, so that nobody is served the name from somewhere else, and noting it with every scan, to know where the app is used from. It is a whole country, not a location.
What we store on the server, and for how long
We are not going to dress anything up here.
| What | For how long | What deletes it today |
|---|---|---|
| Every scan: which mode, the species and the weight, what came back, the barcode or what was identified, how long it took, the country, the network, the app version and whether you are on free or Pro, with the app identifier | The identifier, 14 months. The rest, indefinitely | A daily automatic process |
| Your IP address, with every scan and every failure | 30 days | A daily automatic process |
| Scan failures inside the app, with the identifier | 90 days, entirely | A daily automatic process |
| Reports of an incorrect result | The identifier and the comment, 14 months. The rest, indefinitely | A daily automatic process |
| Barcodes scanned, with the date | Indefinitely | Nothing |
| Anti-abuse counter, per hour (not the five-free one, which lives on your phone) | A little over an hour | It deletes itself |
| Product cache | 30 days (7 if the product does not exist) | It deletes itself |
| Names of what you look up that we do not have documented, with the country | Indefinitely | Nothing |
| The answer stored for those names | 14 days if it said it is not listed as dangerous, 30 if it flagged something | A daily automatic process |
| The photos | 30 days, in the technical log of the calls to the model | Cloudflare, when the period is up |
About the barcodes: we store which products someone has looked up at some point, with the date, so that we do not have to ask Open Food Facts again. That table does not store who scanned them; the scan log does, and the paragraph after next tells that story.
About what you look up that we do not have documented: our database does not cover everything you can scan, so sometimes what you scan is not there. When that happens we ask the assistant and we note down the name of the thing you asked about — “banana”, “mango” — along with the species and a counter of how many times we have been asked about it. It is used to decide what to document next with a real veterinary source, instead of picking by eye.
Along with the name we also store the answer, so as not to pay again for the same question with the wait it costs: the explanation, the signs, the severity and which model produced it. It is the same answer you saw on screen, and it serves the next person who asks the same thing.
Along with all of that we store the country the question came from. It is there because language is not enough to name things: “palta” and “aguacate” are the same fruit and the same language, and if the answer were not separated by country, the first one stored would be served to everyone else with the wrong name.
That table does not store who asked. There is no phone identifier, no photo, and neither the name nor the weight of your pet: the word, the species, the language, the country, a counter and the answer. Who scanned what is kept by the scan log, which comes next.
About the scan log: since September 2026, our server notes every scan with the app identifier, whether it goes well or fails. It stores the mode, the species and the weight, which level came back and which substance decided it, the barcode or the name of what was identified in the photo — never the photo —, how long it took, the country, the network, the app version and whether you are on free or Pro. It is used to know how the app is used, which installation uses it most, what fails and where, and what we are missing in the database; and to see when an odd volume is abuse. Without the identifier we would have the numbers but could not tell who each thing happens to.
After 30 days the IP is stripped from it, and after 14 months the identifier; the row stays, because without them it no longer says whose it is and it still shows trends. It is the same period Google’s metrics already keep with the same identifier: our server does not hold it longer than they do. And “Erase everything on this phone” lets it go on the spot.
About the photos: they are not stored in any database of ours — there is no photo table, no folder, no way to search for yours — but neither do they vanish into thin air. The call to the model goes through Cloudflare’s AI Gateway, which logs every request with its content, and the content of a photo request is the photo. That log is kept for 30 days and then deleted.
It is on deliberately and we are not going to turn it off: it is what lets us work out why a scan failed, returned something absurd or took twenty seconds. Without it, a failure that happens to only one person is a failure that cannot be fixed. We look at it for that and only for that, nobody from outside looks at it, and it is not associated with your name or your pet.
On your phone a temporary copy stays in the app’s internal storage, which the app deletes when each scan finishes.
About the reports: after 14 months the app identifier and the comment are stripped from them, and an automatic process that runs every day does it. What is left — which product, which verdict, which reason — no longer says who it came from, and it still helps us correct the data. Until September 2026 it was ninety days; it was extended so that a report can be linked to the scans of the same installation for as long as those are.
The metrics
Since September 2026 the app measures how it is used and when it breaks, with Firebase Analytics and Firebase Crashlytics, from Google. Without that we would not know where the app gets stuck, what fails or which parts actually help, and a failure that only happens to a few people could not be fixed.
They come switched on, and you can turn them off in Settings → Privacy whenever you like. With them off, the app works exactly the same and stops sending usage metrics straight away. With crashes there is a nuance: if the app shuts down suddenly in the same session in which you turn them off, that crash can still be sent the next time you open it. The ones that happen with metrics already off are deleted without being sent.
What is sent, broadly:
- What you do in the app. Which screens you open and how long you use it. For each scan, the mode, which level came out, which substance in our database decided it, how long it took and how many free scans you have left, or why it failed. Whether you recalculate by amount, whether you report a result — the reason, not the comment — and whether you open the emergency card or the vet search. The steps through onboarding and the paywall. That you tick off a routine task and the achievements you earn; that you log a weight and whether its trend went outside the normal range, not the weight; that you write in the diary and how long it is, not the text; that you add or share album photos and of which category, not the photos; the records you open, the seasons and the rooms of the home you check, and whether you export or restore a backup.
- What you type into a search box, exactly as you type it and up to 100 characters: the catalogue one and the history one. If you search for a product or a code in your history, that reaches Google.
- What your installation is like. Language, appearance, the country if you chose it by hand, whether you are on free or Pro and how many free scans you have used, how many pets you have and of which species, and for the one you have selected, the weight and age range — “10 to 25 kg”, “3 to 7 years” —, not the exact weight or date. If you use the ration calculator, its life stage, whether it is pregnant or nursing and whether you are aiming for it to lose or gain weight. Also whether you allowed alerts, how many photos you have in the album (in ranges) and whether you have a backup.
- The failures. Which error, on which screen, the phone model, the iOS version, the most recent usage events described above, which the SDK attaches to each report on its own, and the screens you opened just before.
- The app identifier, the same one used for reports and for the scans our server stores, so that a failure can be linked to what happened before on that installation.
The app never sends on its own your pet’s name, its photos, what you write in the diary, the comment on a report, or the barcode or the photo of a scan. The only thing you type that goes out is what you put in the search box, described above.
For a purchase, Google’s SDK may record the product, the price and the currency on its own. Your payment method is seen by nobody but Apple.
Google’s SDK also generates its own identifiers for this installation. It does not collect the advertising identifier — the app is built without it — nor the one Apple gives your iPhone for our app (the IDFV), which we have switched off. Because it talks directly from your phone, Google also sees your IP address and infers your approximate country and city from it.
Google does not use this for advertising: we have “Google signals” and ad personalisation switched off. Google Analytics keeps what is tied to your installation for 14 months, and Crashlytics keeps the crashes for 90 days; after that it is deleted. The overall counts, which no longer say whose they are, remain.
On top of that, a copy of those events and crashes goes to BigQuery every day, in our Google Cloud account, so that we can query them in more detail than Google’s reports allow. That copy deletes itself after 60 days.
Who else sees anything
| Who | What they get | What for |
|---|---|---|
| Cloudflare | Everything you send, plus your IP. It also keeps, for 30 days, the log of every call to the model — with the photo inside | It hosts the server, the database and the cache, and lets us see what failed when something fails |
| Google (Firebase) | If metrics are on, what the section “The metrics” describes, with the app identifier. Because it talks from your phone, it also sees your IP | Knowing what gets used and what fails in the app |
| Google (Gemini) | The photo; in photo mode, also the list of what we have documented and can be recognised in an image; and when we have no record for what was scanned, the name of it with the species and, if there was one, the ingredient list. In both cases your country goes too, as two letters | Read the label, identify what is in the photo, or answer for what we do not have documented — and call it what it is called where you are |
| Open Food Facts | Only the barcode | Find out which product it is |
| Expo (EAS Update) | On every start-up, from your phone: your IP, an installation identifier of its own, the app version and the system | Check whether there is a new version of the app and download it |
| RevenueCat | Their anonymous identifier, the purchase, renewal and restore events, and Apple’s receipt with the product, the price and the currency. Because it talks from your phone, it also sees your IP, the model, the iOS version, your language and your App Store country | Check the receipt against Apple, decide whether your subscription is active and give it back to you when you restore |
| Apple | The whole payment: who you are to them, your payment method and the transaction | Charging. We see none of that |
Three services talk directly to your phone, and that is why they see your IP address: RevenueCat; Firebase, if metrics are on; and Expo, which checks on every start-up whether there is a new version of the app. They do it by themselves, without you touching anything, not like the two links at the end of this section, which only open if you tap them. None of those calls go through our server.
RevenueCat’s SDK also sends, on its own account, the identifier Apple gives your iPhone for our app (the IDFV). We do not ask for it and we do not see it, but it goes, and we would rather tell you than have you find out. It is not the advertising identifier: nobody here collects that one, and that is why the app never asks you for permission to track you.
Neither Gemini nor Open Food Facts see your IP address. Those queries go out from our server, not from your phone. (The button for finding a vet nearby is a different thing and goes separately, further down.) Nor do they receive the app identifier or your pet’s weight. The species does reach Gemini in two cases, because the answer depends on it: in photo mode, the list of candidates is filtered by species; and when we ask about something we do not have documented, the question is literally “is this dangerous for a dog?”.
The country reaches Gemini for one reason and only that one: so that it gives you back the name used where you are. It is two letters of a whole country, not a location, and they travel on their own — with no identifier, no IP and nothing about your pet — so they get nobody any closer to knowing who asked.
Of your pet, nothing but the species reaches Gemini. Firebase, if metrics are on, also gets how many pets you have, the weight and age range of the selected one and what the section “The metrics” describes about the ration and the weight. Its exact weight reaches our server — the verdict comes out of it —, is stored with the scan and goes no further. Its name, its photo, its breed and its diary reach nobody.
We do not use advertising, advertising identifiers, push notifications, location or contacts.
There are two kinds of measurement, and we will name them: the Firebase metrics, described in their own section, and the count of subscriptions that RevenueCat keeps — how many are bought, how many renew, how many are cancelled —, tied to its anonymous identifier. We do not use RevenueCat’s for anything else, and it is not combined with what you scan because we cannot combine it.
The vaccine or medication alerts you can schedule are not push notifications: they do not come out of any server. Your own phone schedules them with what you wrote, and we never find out that they have gone off.
The cases where you do leave here
The two in this section have something in common and it is worth saying first: neither opens by itself. (RevenueCat, Firebase and Expo do talk by themselves, and that is covered further up.)
On the verdict screen there is a link to the source of the data (ASPCA, the Merck Veterinary Manual and the like). If you tap it, you open that website and it does see your IP address, like any normal visit. We do not control that. The link does not open by itself: only if you tap it.
And on a red or orange verdict there is a button to find an emergency vet nearby. If you tap it, your phone opens Google Maps — or Apple Maps, if that is what you have — with the search already typed in. From there on you are in their app and under their terms: they see your IP address and, if you give them permission, your location. We do not give it to them: the app does not ask for the location permission and no data of yours travels in the search, only the words “emergency vet”. This does not open by itself either.
The website
whiskercheck.com is a static site: pages already written that are served as they are.
- There are no cookies. None, not even technical ones.
- There is no analytics of any kind, neither ours nor anyone else’s. We do not know how many people come in or where they come from.
- There are no forms. To write to us there is an email address, and nothing else.
- The fonts are served from our own domain, not from Google’s, so that your visit does not reach anyone else.
As on any website, Cloudflare sees the request and your IP address because it is the one serving the pages, and it keeps them in its logs in line with its own policy. We do not read those logs or cross-reference them with anything: the site does not know who you are, and it has no way of connecting you to the app.
Minors
WhiskerCheck is not aimed at anyone under 16 and they should not use it without permission from whoever is their guardian. We do not ask for age and we have no way of checking it.
Your rights
You can ask us for access to your data, its rectification, its erasure, the restriction of or objection to processing, and its portability. Write to privacy@whiskercheck.com.
On our server, what is associated with your installation is your scans, the app’s failures and the reports you have sent, and you can let it go yourself from Settings → “Erase everything on this phone”, without writing to us or waiting: the failures are deleted entirely, and the identifier, the IP and the comment are stripped from the scans and reports. What is left afterwards — which product, which verdict, which reason — no longer says who it came from and still helps us see trends and correct the data.
If you want a copy of what your installation has on our server, write to us at privacy@whiskercheck.com with the app identifier, which is at the bottom of Settings → Privacy.
What the metrics sent to Google is not erased by that button either. What it does is stop linking it to anything new, because it changes the identifiers. It deletes itself after 14 months (crashes, after 90 days, and the BigQuery copy, after 60). If you want it gone sooner, write to us at privacy@whiskercheck.com with the app identifier, which is at the bottom of Settings → Privacy, and do it before erasing everything, because afterwards it will have changed.
RevenueCat’s side goes separately and that button does not touch it. If you have ever subscribed, they have a record tied to their anonymous identifier with your purchases and renewals. To have it deleted, write to us at privacy@whiskercheck.com and we will ask them. Two honest warnings about that:
- We will need you to help us find you. Since we do not cross their identifier with ours, we cannot locate your record for you: it would take the approximate date of the purchase, or for you to write to us from your Apple account’s email address.
- A record of a purchase stays that we cannot delete, because a sale has its accounting and tax obligations. What does disappear is everything tying it to your installation.
And your subscription as such lives in your Apple account: cancelling it or asking for a refund is done there, not here.
- European Union: you can complain to the supervisory authority in your country; in Spain, the Spanish Data Protection Agency.
- Peru: you can complain to the National Authority for the Protection of Personal Data.
- Brazil: you can complain to the Autoridade Nacional de Proteção de Dados (ANPD). The LGPD also gives you the right to have data that is unnecessary, or processed outside the law, anonymised, blocked or deleted.
- California: we do not sell or share personal information in the sense of the CCPA/CPRA, and we have not done so in the last twelve months. RevenueCat processes the subscription data on our behalf and only for that, which is what the CCPA calls a service provider and not a sale.
On what basis we process each thing
For anyone living in the European Union, this is the legal basis for each processing operation:
| What | Why we may |
|---|---|
| The verdict: what you scan, the species and the weight | Performance of the contract — it is literally what you are asking us to do |
| The app identifier and the hourly quota | Legitimate interest in the service not being eaten up by a single client and the bill not blowing up |
| The scan and failure log, with the identifier, the IP and whether you are on free or Pro | Legitimate interest in knowing how the service is used, what fails and who abuses it, to improve and protect it. You let it go whenever you want from Settings |
| Reports of an incorrect result | Legitimate interest in correcting data that can do harm if it is wrong |
| The names of what we do not have documented | Legitimate interest in knowing what to document next |
| The usage and crash metrics | Legitimate interest in knowing what fails and what helps, so we can fix it and improve the app. They come switched on and you can object whenever you like by turning them off in Settings → Privacy |
| The subscription: the purchase, the receipt and knowing whether it is still active | Performance of the contract — without that there is no way to give you what you paid for |
| The five-free-scan counter, on your phone | Performance of the contract — it is the condition on which we offer you the free part. It only leaves your phone as a metric, if you have them on |
| The accounting record of a sale | Legal obligation — it survives an erasure request, and it is the only thing that survives |
We do not ask for consent before measuring, and that is a decision, not an oversight: the metrics come switched on and are turned off with one tap. There is no advertising, no cookies and no cross-app tracking, and what does not exist needs no permission.
The app does not ask you for the tracking permission iOS shows in other apps either, and that is not an oversight: that permission exists for the advertising identifier, and none is collected here, not in Firebase either. RevenueCat’s side does not run on consent but on contract: it is what it takes to give you the subscription you bought.
Your data leaves your country: Cloudflare, Google and RevenueCat, Inc. process outside the European Union and outside Brazil. All three offer the European Commission’s standard contractual clauses, which is the mechanism used for that transfer; for Brazil, the equivalent one the ANPD has approved for international transfers.
RevenueCat and Google, through Firebase, are the ones worth looking at twice: both receive data directly from your phone, without going through our server, and RevenueCat is in the United States. Expo, which also talks from your phone for the updates, likewise processes outside the European Union and Brazil. Apple is outside too, and with them there is no contract of ours that counts: the payment is theirs and is governed by their terms.
Changes
If this changes, the date at the top will change and we will say so inside the app before the new version applies.
Last updated October 9, 2026