Privacy policy

Last updated 26 August 2026.

Cancelo is a subscription tracker. It keeps a list of what you pay for and warns you before you are charged. This policy describes exactly what the app does with information, and it is written to be checkable against the app’s behaviour rather than to be reassuring.

The short version

• There is no account. You never give us an email address or a name, because there is nowhere to give one to.
• We never connect to your bank. Cancelo holds no credentials and has no access to any account. It cannot cancel, negotiate or withdraw anything.
• Your subscriptions never leave your device. Not the names, not the prices, not your notes, not the statements you import.
• Anonymous diagnostics are off unless you turn them on, and can never include any of the above.
• Nothing is ever sold or shared. There are no advertising trackers.

What stays on your device

Everything you put into Cancelo:

• the subscriptions you track — names, prices, currencies, billing cycles, renewal dates, categories and notes;
• the price history the app records when a price changes;
• any bank or card statement you import;
• your reminders and their delivery log;
• your settings.

This is stored in an encrypted database on your device. The encryption key is held in the iOS Keychain / Android Keystore. It is not uploaded anywhere, there is no server holding a copy, and we have no way to read it.

Statements you import

If you import a CSV statement, the file is read, analysed and discarded on your device. It is never uploaded. Cancelo never asks for a bank login and has no facility to use one.

Optional diagnostics

Cancelo can send anonymous crash reports and a count of which features get used. This is off until you say yes. The app asks once, both answers are equally weighted, and declining changes nothing about how the app works. You can turn it off again at any time in Settings, and it takes effect immediately.

If you turn it on, this is what is sent

• which screens are opened, by screen name;
• that an import ran, and how many recurring charges it found;
• whether reminders scheduled successfully;
• which billing-cycle class a subscription uses (monthly, yearly);
• for a crash: the error type and where in the code it happened.

What can never be sent, even with it on

• the name of anything you pay for, or any merchant;
• any price, total or currency amount;
• anything from a statement you import;
• any note or anything else you type;
• the text of a crash message — it is replaced before the report leaves the device, because an error message can quote the data that caused it;
• your name, email or any account identifier — there are none;
• any advertising or device identifier.

This is enforced by an allow-list in the app’s source: a piece of information that has not been explicitly declared as sendable is dropped rather than transmitted. It is not a promise to remember to redact things.

Who processes it

• Sentry (crash reports) — sentry.io
• PostHog (feature counts), hosted in the European Union — eu.i.posthog.com

Both act as processors on our behalf. Neither receives anything from the list above. Data is retained for up to 90 days and is not sold, shared or used for advertising.

What Cancelo does not do

• No advertising, and no advertising identifiers.
• No profiling and no automated decision-making.
• No exchange-rate lookups over the network. Rates are bundled with the app at build time, so converting currencies cannot reveal which services you track.
• No third-party sign-in.
• No sale or sharing of personal information, under any definition, ever.

Your rights

Because your data is on your device and we hold no copy:

• Access and portability — Settings → Export everything, as CSV or JSON, free and without an account.
• Erasure — Settings → Delete everything. One tap, one confirmation. There is no account to close and nothing for us to delete on our side.
• Withdrawing consent — Settings → Send anonymous diagnostics, off. It stops immediately.

If you are in the EU, UK, or a US state with a privacy statute, these rights apply to you and are satisfied by the controls above. If you want to exercise them against the diagnostics processors, contact us and we will action it.

Children

Cancelo is not directed at children and collects nothing that would identify anyone, of any age.

Changes

If this policy changes, the date at the top changes with it. A change that affects what is collected will also be described in the app before it takes effect.

Contact

marwansamir688@gmail.com