Privacy Policy

1. What we collect

From version 1.3, the free version may show a small Google AdMob banner. Google may process IP addresses, device identifiers, approximate location, ad interactions and diagnostics to serve and measure ads. Ad requests are non-personalized, with restricted data processing enabled. Pro is ad-free. Item details and attachments are not sent to Google. The website host may process ordinary request data such as IP address, path and time. Hosting log retention has not been audited.

New links use https://runs-out.vercel.app/share#CODE. The fragment is not sent in the HTTP request. Older /r/CODE links remain accepted, but opening them in a browser sends the code in the request path. Keep all codes private.

2. What the app stores, and where

Items, photos and PDF attachments are stored on your device and can sync through your own private iCloud database.

• Items: title, category, expiry date, emoji and colour, notes.
• Optional details: purchase or issue date, price and currency, retailer or issuer, serial / policy / reference number, country.
• Attachments: up to three photos and one PDF per item.
• Settings: your reminder hour, the "hide titles in notifications" switch, app-lock preference, and widget preferences.

Items, photos and PDF attachments are stored on your device and can sync through your own private iCloud database. You choose which item to share. Creating a code publishes an encrypted snapshot, not your whole list.

3. iCloud sync

Items, photos and PDF attachments are stored on your device and can sync through your own private iCloud database.

Local items and reminders work offline. iCloud sync, creating or accepting shares and checking shared updates need a connection.

4. Sharing an item with a code

With Pro, send a link, QR or twelve-character code so someone can add their own copy of one item in Runs Out.

• You choose which item to share. Creating a code publishes an encrypted snapshot, not your whole list.
• Shared snapshots use AES-GCM encryption with a key derived from the code. Anyone who has the code can decrypt the shared item.
• Photos and PDFs are never included. Neither is the reference, serial or policy number, unless you switch that on before creating the code.
• Codes expire after 14 days, or stop allowing new acceptances when the chosen recipient limit is reached. Stop sharing queues deletion of the shared snapshot. Offline or failed deletion is retried when the app can connect. The code may remain usable until deletion succeeds. Recipients keep copies they already saved.
• The owner can publish updated details. When the app checks, recipients can choose an update or enable automatic updates. Updates are not guaranteed to arrive instantly.

The public CloudKit database holds encrypted snapshots. Expiry and version metadata, acceptance timestamps and opaque record creator identifiers are not encrypted. New links use https://runs-out.vercel.app/share#CODE. The fragment is not sent in the HTTP request. Older /r/CODE links remain accepted, but opening them in a browser sends the code in the request path. Keep all codes private.

5. Photos, scans and PDFs

Items, photos and PDF attachments are stored on your device and can sync through your own private iCloud database.

Expiry date recognition from photos and PDFs runs on your device. Saved content and attachments can sync privately through iCloud. Photos and PDFs are excluded from shared snapshots.

6. Notifications

All reminders are local notifications scheduled on your device by iOS. There is no push server, so no reminder ever leaves your iPhone or iPad. Notification text contains the item's name and how many days remain. It never contains a reference, policy or serial number. If you switch on "hide titles in notifications", alerts fall back to a neutral wording such as "1 item expires in 7 days".

7. Permissions the app may ask for

• Notifications: asked the first time you save an item, so reminders can be scheduled. Decline and the rest of the app still works.
• Runs Out uses the camera to scan documents such as receipts and suggest expiry dates, and to scan item-sharing QR codes. Date recognition happens on your device. Saved attachments can sync through your iCloud account.
• Photo library: only when you pick a photo, via Apple's picker. The app receives the picture you chose and no access to the rest of your library.
• Face ID / Touch ID: only if you turn on the app lock. Authentication happens through iOS; the app is told "yes" or "no" and never sees biometric data.
• Calendars: write-only, and only if you switch on "Mirror to Calendar". Runs Out creates its own "Runs Out" calendar and adds your expiry dates to it; it never reads your own calendars.

Runs Out never requests your location, contacts, microphone, health data or advertising identifier.

8. Purchases

Runs Out Pro is a one-time in-app purchase processed entirely by Apple through the App Store. Apple tells the app whether the purchase is active; that is the whole of the exchange. We never receive or see your name, payment card, billing address or Apple Account details. Refunds, receipts and purchase history are handled by Apple under Apple's terms.

9. Advertising

• From version 1.3, the free version may show a small Google AdMob banner.
• Google may process IP addresses, device identifiers, approximate location, ad interactions and diagnostics to serve and measure ads. Ad requests are non-personalized, with restricted data processing enabled.
• Privacy choices are requested where required. You can reopen the available choices in Settings. No advertising identifier permission is requested.
• No app sign-up, email address or profile is required. Public CloudKit sharing records have opaque creator identifiers.
• We do not sell, rent or trade your data. Sharing is initiated by you for the item you choose.
• Pro is ad-free. Item details and attachments are not sent to Google.

10. Keeping and deleting your data

Local data remains until you delete it. Private iCloud data can remain after uninstalling the app. Share expiry blocks new acceptance; it does not guarantee immediate record deletion.

• Deleting an item removes it from the device and from your iCloud copy.
• Erase all data removes local items and requests deletion of private iCloud data and created shares. Cloud deletion may wait for a connection. Recipients' saved copies remain.
• Deleting the app removes its on-device storage. If you had iCloud sync on, the synced copy can remain in your Apple Account. Use Erase all data before deleting the app.

Stop sharing queues deletion of the shared snapshot. Offline or failed deletion is retried when the app can connect. The code may remain usable until deletion succeeds. Recipients keep copies they already saved. The website host may process ordinary request data such as IP address, path and time. Hosting log retention has not been audited.

11. Children's privacy

Runs Out is a general-audience utility, not directed at children. There is no chat, public feed or way to contact someone through the app. Sharing uses encrypted copies and the metadata described above.

12. Your rights

You can edit or delete your items and use Pro to export them. Stop sharing requests deletion of a shared snapshot, with the connection and saved-copy limits described above. For privacy questions, contact the developer.

13. Changes to this policy

If this policy changes, the effective date at the top changes with it and the current version always lives at this address. Material changes will also be noted in the app's What's New. We will never quietly start collecting data under an unchanged policy.

14. Contact

Questions about privacy, or anything else:

jyl.iosapp@gmail.com