Privacy Policy

Apps by Jem Alvarez

• Version: 1.0
• Last updated: October 21, 2026
• Effective date: October 21, 2026

This policy explains what information my apps collect, why, who helps me process it, and what choices and rights you have. I've tried to write it in plain English. If anything is unclear, please contact me (section 1).

The short version

• Most of what you do in my apps stays on your device, or in your own iCloud account if the app syncs.
• I don't track you. I don't use the advertising identifier (IDFA), I don't show the App Tracking Transparency prompt, I don't include third-party advertising SDKs, and I don't sell or share your personal information for advertising.
• I use PostHog for usage analytics and error reports. The data is tied to a random ID, not to your name or email address. If your App Store country or your device's region is in the EEA, the UK or Switzerland, analytics only starts if you say yes. Everywhere else it's on by default, and you can turn it off at any time with "Share usage analytics" in Settings. Saying no doesn't change any feature.
• I use RevenueCat to handle in-app purchases and subscriptions. It always runs, because it's what gives you what you paid for. Apple processes the payment; I never receive your card or bank details.
• If you contact me through an app or by email, your email address, your name (if you give it), your message and, from the app, some technical details including your purchase ID, come to me.
• If an app offers an account (Sign in with Apple or Google), your account is stored with Supabase in the United States, and you can delete it from inside the app at any time.

Contents

1. Who I am and how to contact me
2. Which apps this policy covers
3. What I collect and why
4. Legal bases (EEA, UK and Switzerland)
5. Analytics, error reports and your choice
6. Purchases and subscriptions
7. Apple Ads measurement
8. The contact form
9. Information I receive from Apple
10. iCloud sync
11. Accounts and account deletion (if an app offers an account)
12. No tracking, no ad SDKs, no sale of personal information
13. Who processes your information
14. International transfers
15. How long information is kept
16. Your rights
17. How to make a privacy request
18. Children
19. Security
20. Changes to this policy and previous versions
21. Language

1. Who I am and how to contact me

My apps are published by Jem Alvarez, an individual developer based in Florida, USA (referred to as "I", "me" or "my" in this policy). For data protection law purposes, I am the controller of the personal information described here.

• Controller: Jem Alvarez, individual developer, Florida, USA
• Privacy contact: contact@jemalvarez.com
• In the app: Settings → Contact Us in any of my apps (choose the "Privacy / my data" topic for privacy requests)
• Support website: https://jemalvarez.com

I haven't appointed a data protection officer, and I haven't appointed a representative in the European Union or the United Kingdom. Wherever you are, including the EEA, the UK and Switzerland, please contact me directly using the details above. You can also complain to your local data protection authority (section 16).

The Terms of Use for every app are Apple's Standard Licensed Application End User License Agreement: https://www.apple.com/legal/internet-services/itunes/dev/stdeula/

2. Which apps this policy covers

This single policy covers all apps published by Jem Alvarez on the App Store, now and in the future, on iPhone and iPad (and, where available, on Mac and Apple Vision Pro), including the widgets, controls, Live Activities, Siri and Shortcuts actions and other extensions that come with them.

Not every app uses every feature described here. Where this policy says "if an app offers" a feature (such as iCloud sync, an account or a device permission), that part applies only to apps that have it. Each app's App Store page also shows Apple's privacy summary for that app.

This policy doesn't cover Apple's or Google's own services (such as the App Store, iCloud, your Apple Account, Apple Ads or your Google Account), or any website I link to. Those companies' own privacy policies apply (section 13).

3. What I collect and why

The random IDs. The Analytics ID (PostHog) and the RevenueCat ID are random IDs created for the app. They aren't your name, your email address or your Apple Account, and my analytics and purchase records aren't stored with your name or email address. But please note: if you contact me, your email address, your name (if you give it), your message and the technical details listed above, including your RevenueCat ID, come to me. So when you write to me, I can see your purchase records alongside your email address. If you choose the "Privacy / my data" topic, your Analytics ID is attached too, so that I can find and delete your analytics data. Analytics events themselves never contain names, email addresses, free text, contact-form contents or account identifiers.

Internet connections. Whenever an app connects to one of these services, the service receives your device's IP address as part of the connection. PostHog is set up not to store it and not to work out your location from it. RevenueCat uses it only to estimate your country and then discards it. SplitForms stores it with contact-form messages to block spam and abuse. If an app offers an account, Supabase may keep it in sign-in session records and in server logs kept for about a day.

Device permissions. If an app offers features that need access to things like your camera or photos, it asks only when it needs that access, and you can change it at any time in iOS Settings. Unless this policy says otherwise, what an app reads through these permissions stays on your device (or in your own iCloud account, if the app syncs).

Things my apps don't do. They don't use the advertising identifier (IDFA), don't ask for permission to track you (App Tracking Transparency), don't record your screen (no session replay), and don't include third-party advertising SDKs.

4. Legal bases (EEA, UK and Switzerland)

If you're in the European Economic Area (EEA) or the United Kingdom, the GDPR or UK GDPR requires me to have a legal basis for each use of your personal information. Swiss data protection law sets similar principles.

Some information, such as your analytics choice, is stored on your device because it's needed to respect your choice. Your app content and settings are stored on your device because they're needed for the app to work.

Using an app never depends on giving consent. If you say no, every feature works the same.

5. Analytics, error reports and your choice

How your region is decided. When an app starts, it first checks two things: the country of your App Store account (storefront) and your device's region setting. If either is in the EEA, the United Kingdom or Switzerland, the app asks for your permission before any analytics starts. Analytics and Apple Ads attribution don't start anywhere until the app knows your region.

If you decline, or turn the switch off:

• The app works exactly the same. No feature depends on analytics.
• Analytics and Apple Ads attribution stop immediately, in the same session (or never start). Nothing is sent to PostHog while analytics is off, and events are never saved up and sent later.
• The app resets your Analytics ID, so any data collected if you turn analytics on again can't be connected to earlier data. While analytics is off, Settings shows "Analytics off" instead of an ID.
• Data already sent before you turned the switch off is kept for the periods in section 15, unless you ask me to delete it (section 17).
• One exception: if a single Apple Ads attribution request was already queued at the moment you turned the switch off, that one request may still complete. Attribution isn't started again after that unless you turn the switch back on.
• Apple may still send me crash reports if you allow sharing with app developers in your device settings (section 9). That's controlled by your iOS settings, not by this switch.

Your Analytics ID. Each app's Settings shows your current Analytics ID, with a button to copy it. If you want me to find or delete your analytics data, send me this ID (section 17).

How PostHog is set up. I use PostHog's US Cloud, with one project for all my apps. It's set up to discard your IP address and not to look up your location from it. There's no session replay and no feature flags, experiments or surveys. I've opted out of PostHog using my data to develop or train its products or models.

6. Purchases and subscriptions

All purchases and subscriptions are made through the App Store. Apple is the merchant of record and processes the payment under its own terms and privacy policy. I never receive your card or bank details.

I use RevenueCat to confirm what you've bought, unlock paid features, restore purchases on a new device, and report revenue. RevenueCat identifies you only by a random ID that it creates; it isn't your name, your email address or your Apple Account. If an app offers an account, RevenueCat still uses its own random ID, not your account ID.

RevenueCat runs in every region, whatever your analytics choice, because without it the app can't deliver what you paid for.

To cancel or manage a subscription, use your Apple Account subscription settings (also reachable from Settings → Manage Subscription in the app). Refunds are handled by Apple at https://reportaproblem.apple.com.

7. Apple Ads measurement

Apple Ads is the only advertising I pay for. To learn whether an install came from one of my Apple Ads campaigns, the app can get an attribution token from Apple's AdServices framework and pass it to RevenueCat. RevenueCat exchanges it with Apple for the campaign, ad group and (where available) keyword. This shows me how much revenue each campaign brings in.

• This uses Apple's standard attribution, which doesn't identify you and doesn't involve tracking you across other companies' apps or websites. It doesn't use the advertising identifier (IDFA) and doesn't need tracking permission.
• If your App Store country or device region is in the EEA, UK or Switzerland, it's sent only if you've allowed analytics. Elsewhere it's sent at launch unless you turn off "Share usage analytics" (section 5).
• Apple handles its own advertising data as described in Apple's Advertising & Privacy page: https://www.apple.com/legal/privacy/data/en/apple-advertising/

8. The contact form

Each app has a contact form in Settings. When you send it:

• What you enter: your name (optional), your email address (so I can reply), a topic and your message.
• What's attached automatically: which app it is, the app version and build number, your iOS version, your device model, your language and region setting, and your RevenueCat ID. If you choose the "Privacy / my data" topic, your Analytics ID is attached too (when analytics is on). The form tells you that technical information is attached.
• Why: this helps me reproduce problems, sort out purchase issues and, for privacy requests, find and delete your data.
• What this means: your email address and your message come to me together with your RevenueCat ID (and, with the privacy topic, your Analytics ID). I use this connection only to answer your message and handle your request.
• Where it goes: the form is sent to SplitForms, a form-handling service, which stores the submission and emails it to contact@jemalvarez.com. Cloudflare Email Routing forwards that address to my Gmail inbox (Google); Cloudflare passes messages on in transit and doesn't store them in a mailbox. Messages are stored in Gmail, and I reply from there. Emails you send directly to contact@jemalvarez.com take the same path. SplitForms also stores the sender's IP address, user agent, referrer and the time of submission to prevent spam and abuse.
• I keep short summaries of feedback, without your name, email address or message text, to keep track of bugs and feature requests.

Please don't include sensitive information (such as health details or passwords) in your message.

9. Information I receive from Apple

• Crash reports and app-usage statistics: Apple shares these with me only if you've turned on Share With App Developers (Settings → Privacy & Security → Analytics & Improvements), and only in aggregated form or in a form that doesn't identify you. I use them to fix crashes and understand how the apps perform.
• App Store statistics: App Store Connect gives me aggregated statistics, such as product-page views, downloads and which campaign link led to a download.
• Ratings and reviews: the apps ask for a rating with Apple's standard rating prompt. Apple handles and publishes ratings and reviews; I read them in App Store Connect and may reply publicly.

Apple collects and handles this information as an independent company under its own privacy policy, including https://www.apple.com/legal/privacy/data/en/app-analytics/

10. iCloud sync

If an app offers sync across your own iPhone, iPad and Mac using iCloud, this applies:

• Your synced data is stored in the private database of your own iCloud account, under Apple's iCloud terms and privacy policy. Only you can see it; I can't access its contents. There's no separate sign-in: your Apple Account is the identity.
• Syncing follows your device's iCloud settings.
• To delete synced data, delete it in the app (it's removed from your other devices too), or go to Settings → your name → iCloud → Storage (or Manage Account Storage), choose the app if it's listed, and tap Delete Data from iCloud.

11. Accounts and account deletion (if an app offers an account)

Some apps may offer an account (with Sign in with Apple or Google Sign-In), for example to share data with other users or to use server features. If an app offers an account, this applies:

• Sign-in is offered only with Sign in with Apple or Google Sign-In. There's no email-and-password sign-in.
• Your account and account data are stored with Supabase, in its US East region (United States).
• The app receives from Apple or Google an account identifier, your email address (with Sign in with Apple you can choose to hide your real email and share a private relay address instead), and your name if you choose to share it. I don't request access to any other data in your Apple or Google account.
• You can link another sign-in method yourself, from Settings. Accounts are never linked automatically.

Deleting your account. You can delete your account at any time in the app, in the account section of its Settings. When you do:

• Your account and everything stored with it on Supabase are permanently deleted, including anything you shared with other users. Supabase keeps no backups of my projects; server logs expire after about a day.
• If you used Sign in with Apple, the app revokes its access to your Apple Account.
• If you used Google, the app disconnects itself from your Google Account.
• Deleting your account doesn't cancel an App Store subscription. Subscriptions are managed in your Apple Account subscription settings: the app reminds you to cancel there first, and billing continues through Apple until you do.
• Your purchase record stays with RevenueCat under its random ID, so purchases can still be restored on your device. Ask me if you want it deleted too (section 17).
• Data on your device stays until you delete the app.

12. No tracking, no ad SDKs, no sale of personal information

• No tracking. My apps don't track you across other companies' apps or websites, don't use the advertising identifier (IDFA), and don't show the App Tracking Transparency prompt.
• No third-party advertising. No ad networks, no third-party advertising SDKs and no mobile measurement partners. Apple Ads is the only paid advertising, measured as described in section 7.
• No sale or sharing for advertising. I don't sell your personal information or share it for cross-context behavioral advertising, and I don't use it for targeted advertising.
• No session replay, no feature flags, experiments or surveys. PostHog is used only for product analytics and error reports.

13. Who processes your information

Service providers and other recipients

These companies provide the services my apps and I use to handle your information. PostHog, RevenueCat, SplitForms, Cloudflare and Supabase process it only to provide their service to me, under their terms and data processing agreements. My Gmail inbox is a consumer Google account, which Google provides under its own terms and privacy policy.

Companies that process information under their own privacy policies

Apple and Google are independent companies. They aren't my service providers; they handle information under their own terms and privacy policies:

• Apple: the App Store and payments, Apple Ads and its attribution, iCloud, crash reports and App Store statistics, and Sign in with Apple (if an app offers an account). See https://www.apple.com/legal/privacy/, App Store & Privacy (https://www.apple.com/legal/privacy/data/en/app-store/), Apple Advertising & Privacy (https://www.apple.com/legal/privacy/data/en/apple-advertising/), Sign in with Apple & Privacy (https://www.apple.com/legal/privacy/data/en/sign-in-with-apple/) and the iCloud terms (https://www.apple.com/legal/internet-services/icloud/).
• Google: Google Sign-In (if an app offers an account). See https://policies.google.com/privacy

Legal requests and business transfers

I may disclose information if I'm required to by law, such as by a valid court order or subpoena, or if I believe in good faith it's necessary to protect my rights, your safety or the safety of others, or to investigate fraud. If I sell or transfer an app (or the business behind it), the information related to that app may be transferred to the new owner, who will have to respect this policy for information collected under it. I'll say so on this page before that happens.

14. International transfers

I'm based in the United States, and my service providers process information in the United States (SplitForms is operated from India and stores submissions in the United States; Cloudflare and Google are US companies; Supabase stores account data in its US East region). Apple and Google operate worldwide. This means your information may be processed outside your country, including outside the EEA, the UK and Switzerland.

Where the law requires safeguards for these transfers, they are:

• PostHog: the EU-US Data Privacy Framework, with its UK Extension and the Swiss-US Data Privacy Framework, and the European Commission's Standard Contractual Clauses.
• RevenueCat: the Standard Contractual Clauses, with the UK Addendum and Swiss terms.
• Supabase: the Standard Contractual Clauses, with the UK Addendum and Swiss terms.
• SplitForms: the Standard Contractual Clauses in SplitForms' data processing agreement.
• Cloudflare: the EU-US Data Privacy Framework, with its UK Extension and the Swiss-US Data Privacy Framework, and the Standard Contractual Clauses in Cloudflare's data processing addendum.
• Google (Gmail): Google LLC's certification under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework.

You can ask me for a copy of the relevant safeguards (section 1).

15. How long information is kept

16. Your rights

Everyone. Wherever you live, you can ask me what personal information I hold about you, ask me to correct it or delete it, and turn analytics off at any time in Settings. I won't treat you differently for using any of these rights.

EEA, UK and Switzerland. Under the GDPR, the UK GDPR and Swiss data protection law, you have the right to:

• access your personal information and get a copy;
• correct inaccurate information;
• delete your information;
• restrict how it's used;
• data portability: receive information you gave me in a commonly used, machine-readable format;
• object to uses based on legitimate interests, including analytics that runs without a prompt (the "Share usage analytics" switch does this instantly);
• withdraw consent at any time (for analytics and Apple Ads attribution: the "Share usage analytics" switch), without affecting what happened before;
• complain to a data protection authority: in the EEA, the authority where you live or work (list: https://www.edpb.europa.eu/about-edpb/our-members_en); in the UK, the Information Commissioner's Office (https://ico.org.uk/make-a-complaint/); in Switzerland, the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/en). I'd appreciate the chance to sort out your concern first.

I don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

US state privacy rights. Under the privacy laws of some US states, you may have the right to know what personal information I process about you, to correct it, to get a copy of it, and to have it deleted. I offer these rights to everyone, wherever you live. To use them, contact me as described in section 17; I'll need to confirm your request comes from you. I don't sell your personal information, and I don't share it for cross-context behavioral advertising or use it for targeted advertising. I don't process sensitive personal information, and I won't treat you differently for using your rights.

Other countries. You may have similar rights under your local law. Contact me and I'll help.

17. How to make a privacy request

• In the app (recommended): Settings → Contact Us, topic "Privacy / my data". The app automatically attaches your RevenueCat ID and, if analytics is on, your Analytics ID, so I can find your purchase records and your analytics data.
• By email: contact@jemalvarez.com. If you write by email, please include your Analytics ID (copy it from the app's Settings).

I'll respond within one month of receiving your request. If a request is complex, the law may allow up to two more months; if so, I'll tell you within the first month.

Verification and what I can find. I may ask for information to confirm a request really comes from you.

• On-device data: you control it; deleting the app deletes it.
• iCloud data: you control it through the app and your iCloud settings (section 10).
• Purchase data (RevenueCat): I can find it using the RevenueCat ID attached to messages sent from the app.
• Analytics data (PostHog): this is tied only to a random ID on your device, not to your name or email, so I can't find it from your email address alone. Send me the Analytics ID (the "Privacy / my data" topic attaches it automatically). If you want me to delete analytics data, send your request before turning analytics off, or copy your Analytics ID first: turning analytics off resets the ID, and I won't be able to match older data unless you kept the old one. In that case, under Article 11 GDPR, I'm not required to keep or collect extra information just to identify you.
• Contact-form messages and emails: I can find these by your email address.
• Accounts (if an app offers one): delete your account in the app (section 11), or ask me.

18. Children

My apps are meant for a general audience and aren't directed at children under 13 (or the minimum age for consent to online services where you live, which in the EU ranges from 13 to 16). I don't knowingly collect personal information from children. If you believe a child has sent me personal information, for example through the contact form, contact me and I'll delete it. Each app's age rating is shown on its App Store page.

If an app is ever designed for children or placed in the App Store's Kids category, it will follow the extra rules that apply, and this policy will be updated before it launches.

19. Security

I take reasonable steps to protect information, including:

• connections between the apps and my service providers use encryption (HTTPS);
• service keys are kept out of source code repositories;
• access to the analytics, purchase, form and account dashboards is limited to me;
• if an app offers an account, account data is protected with Supabase row-level security, so you can only access your own data and data shared with you.

No system is completely secure. If a data breach affects your personal information, I'll notify you and the relevant authorities as the applicable law requires.

20. Changes to this policy and previous versions

I'll update this policy when my apps or the services they use change. When I do, I'll change the "Last updated" date at the top and keep the previous version in the public archive: https://privacy.jemalvarez.com/archive

I don't show a notice in the apps or ask you to give your consent again when this policy changes, so please check this page from time to time.

21. Language

This policy is provided in English only.

Questions? Contact me at contact@jemalvarez.com or through Settings → Contact Us in any of my apps. Support: https://jemalvarez.com · Previous versions: https://privacy.jemalvarez.com/archive