Privacy Policy

Effective date: 9 September 2026
Applies to: the Midos iOS app and the website at https://midos.online

Midos is a personal bookkeeping app. You record what you earn and what you spend, and Midos does the arithmetic. That is financial data about you, so we have tried to write this policy the way we built the app: keep as little as possible, keep it in as few places as possible, and tell you plainly where the rest goes.

Short version

• Midos works completely offline and with no account. If you never sign in, your transactions, accounts, categories, budgets and streaks stay on your iPhone and never reach us.
• Signing in (Sign in with Apple only) turns on cloud sync and unlocks the AI features. Only then does your data leave the device.
• The AI features — voice entry and receipt scanning — send data to OpenAI, a company in the United States. We ask you for explicit permission in the app before that ever happens, and you can withdraw it at any time in Settings.
• Receipt photos are never stored by us. The image passes through our server in memory and is discarded.
• Speech is transcribed on your device. The raw audio never leaves your iPhone.
• We do not run ads, do not use tracking SDKs, do not collect the IDFA, do not track you across other companies' apps or websites, and do not sell or share your personal information.
• You can delete your account and your server-side data from inside the app, without emailing anyone.

1. Who is responsible for your data

The controller of the personal data described in this policy is:

Individual Entrepreneur Akhan Iskak, trading as "AT&S"
Registered in the Republic of Kazakhstan
221 Zhambyl Street, apt. 41, Almaty 050009, Kazakhstan
Email: akhanizkak@gmail.com

If you have any question about this policy or want to exercise a privacy right, write to akhanizkak@gmail.com.

2. Using Midos without an account

You can install Midos and use essentially all of its bookkeeping features without creating an account and without a network connection. In that mode:

• Your transactions, accounts, categories, budget norms, savings targets, recurring payments and streak history are stored only in the app's local storage on your device.
• We cannot see them, cannot recover them, and cannot delete them for you. If you delete the app, that data is gone.
• The only data that may still leave the device is described in section 4.6 (crash reports) and 4.7 (product analytics), and neither of those contains your financial figures.

Cloud sync is a separate switch. It requires an account and can be turned off again at any time in Settings → Sync, and the server-side copy can be wiped from the same screen.

3. How you sign in

Midos supports Sign in with Apple only. There is no password, no email/password form, no Google or Facebook login.

When you sign in, Apple gives the app an identity token, which the app exchanges with Supabase (our authentication and database provider) for a session. From that we receive:

• a Supabase user id (a random UUID) — this is the identifier we use everywhere internally;
• the email address Apple gives us, which is a private relay address (…@privaterelay.appleid.com) if you chose "Hide My Email";
• the name on your Apple Account, if Apple provided one. Apple discloses it on the very first sign-in and never again. We store it with your account and use it only to address you in the app.

We never receive your Apple ID password, and Apple tells us nothing else about your Apple Account.

4. What we collect, why, and on what legal basis

The legal-basis column refers to Article 6(1) of the GDPR. It applies to you if you are in the EU/EEA, the UK or Switzerland; the rest of the table describes our practice everywhere.

4.1 Account identity

What: Supabase user id; the Apple-provided (usually relay) email address; the name on your Apple Account, if Apple provided one at first sign-in; the date the account was created.
Why: to identify your data on the server, to sync it to your other devices, and to contact you about the service if we have to.
Legal basis: Article 6(1)(b) — necessary to provide the service you asked for.

4.2 The financial data you enter

What: transactions (amount, currency, converted base-currency amount, exchange rate, date, category, account, and any note you type), accounts and balances, your own categories, budget norms, savings targets, recurring payments, and streak/gamification records.
Why: this is the app. On the server it exists so that it survives losing your phone and appears on your other devices.
When: only if you are signed in and sync is enabled. Otherwise it stays on the device.
Legal basis: Article 6(1)(b) — necessary to provide sync and backup.

4.3 Voice entry

What: the text transcript of what you said — not the audio, see section 6 — together with your base currency and the names of your accounts and categories, so that the result can be matched to them.
Why: to turn "coffee three fifty and forty for the bus" into draft transactions you then review.
Who sees it: our backend, and then OpenAI. See section 5.
Legal basis: Article 6(1)(a) — your consent, given through the in-app AI permission screen. You can withdraw it at any time.

4.4 Receipt scanning

What: the image bytes of the receipt you photograph or pick from your library, together with your base currency and the names of your accounts and categories.
Why: to read the total, the date, the merchant and, in list mode, the line items, and to propose draft transactions.
Who sees it: our backend (in memory only) and then OpenAI. See section 5.
Storage: we do not store the image. It is held in server memory for the duration of the request and then discarded. It is not written to disk, not written to object storage, and not written to the database. The photo you took stays in your own photo library, under your control.
Legal basis: Article 6(1)(a) — your consent, given through the in-app AI permission screen.

4.5 Subscription status and usage counters

What: whether you have an active Midos Pro entitlement, which product you bought, renewal/expiry dates, and a counter of how many AI requests you have made this day and this month. Also the raw subscription events RevenueCat sends us, kept as an audit trail.
Why: to unlock Pro features, to enforce the free-tier and Pro quotas, and to resolve billing disputes.
What we never see: your payment card, your Apple Account balance, or your billing address. Apple handles payment; we only learn that a purchase happened.
Legal basis: Article 6(1)(b) — necessary to perform the subscription contract; Article 6(1)(f) — our legitimate interest in preventing abuse of the AI quotas.

4.6 Crash and error diagnostics

What: stack traces, the app version, the iOS version, the device model, a random installation id, and — only when you are signed in — your Supabase user id.
Why: so that when Midos crashes we can find out why.
How we limit it: the Sentry SDK is configured with sendDefaultPii off; the user object is reduced to the id alone; request bodies, headers and cookies are stripped before sending; console breadcrumbs are dropped; session replay is off; only a fraction of performance traces is sampled. Your amounts, notes and merchant names are not attached to error reports.
Legal basis: Article 6(1)(f) — our legitimate interest in a stable, secure app.

4.7 Product analytics

What: which screens you open (route names such as analytics or settings), which features you use, and coarse technical context (app version, platform, locale). Every event property passes through a strict allow-list before it is sent.
What is deliberately excluded: amounts, balances, notes, merchant names, category names you typed yourself, account names, your name, your email address.
Why: to understand which parts of the app are used and which are broken, so we can improve them.
Where: PostHog's EU cloud (eu.i.posthog.com).
Legal basis: Article 6(1)(f) — our legitimate interest in improving the app. You can object at any time; write to akhanizkak@gmail.com and we will exclude you.

4.8 Ordinary server logs

What: timestamp, request path, response status and a request id, written by our application logger; our web server additionally records the IP address the request came from.
Why: security, abuse prevention and debugging.
Legal basis: Article 6(1)(f) — legitimate interest in the security and integrity of the service.

5. The AI features: exactly what leaves your device

This is the only place where your data reaches a company whose business is artificial intelligence, so we want to be precise about it.

What we send

The request goes from the app to our own backend at midos.online, and our backend calls OpenAI's API. We do not send your Supabase user id, your email address or any authentication token to OpenAI.

One caveat worth stating plainly: account and category names are text you wrote yourself. If you call an account "Anna's salary card", that string is part of what we send. If you would rather it were not, rename the account.

We ask first

Before the first voice capture and before the first receipt scan, Midos shows a full-screen disclosure that names OpenAI, states what is sent, states that we do not keep the image, and states that speech is recognised on the device. Nothing is sent until you tap accept. If you decline, manual entry keeps working exactly as before, and the camera is never even opened.

You can withdraw this permission at any time in Settings. After you withdraw it, the disclosure is shown again the next time you tap voice or scan, and nothing is sent unless you accept again. We will also show the disclosure again if we ever materially change what is sent or who receives it.

This is how we comply with App Store Review Guideline 5.1.2(i), which requires developers to "clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so."

What OpenAI does with it

OpenAI is our processor for this step: it processes the transcript or the image in order to return a structured result to us, and for no other purpose of ours.

As of 9 September 2026, OpenAI's published policy for its API states that data sent to the OpenAI API is not used to train or improve OpenAI models unless the customer explicitly opts in, and that API inputs and outputs may be retained for abuse monitoring for a limited period — up to 30 days at the time of writing, and longer only where the law requires it or where it is reasonably necessary to protect OpenAI's services or a third party from harm — before deletion. We have not opted in to any model-training programme. OpenAI's own terms govern its handling of the data; you can read them at https://openai.com/policies/.

Results are drafts

Whatever the model returns is shown to you as an editable draft. Nothing is written into your books until you review it and save it. AI output can be wrong — see the Terms of Use.

6. Speech recognition: the audio stays on your phone

Midos uses Apple's speech framework with on-device recognition required. The recording is converted to text by iOS, on your iPhone, without a network round-trip. The audio is not uploaded to Apple, not uploaded to us, and not stored by us.

To be equally clear about the other half: the transcript that results from it does leave the device when you use voice entry, exactly as described in section 5. "On-device speech recognition" describes the audio, not the text.

7. Who else receives data

We use a small number of service providers ("processors" under the GDPR). Each one gets only what it needs for its job. We enter into a data-processing agreement with each of them, and we require them to protect your data to a standard at least equal to this policy, as required by App Store Review Guideline 5.1.1(i).

We do not give your data to anyone else, except where we are legally required to (a valid court order or a lawful request from an authority), or where it is necessary to establish, exercise or defend a legal claim. If we are ever forced to hand over data, we will tell you unless the law forbids us from doing so.

If we are ever acquired or merge with another company, your data may be transferred as part of that transaction. We would notify you before that happens and before this policy changes.

8. What we do not do

We want to state this plainly, because it is unusual enough to be worth saying:

• No advertising. There are no ads in Midos and no advertising SDK in the app.
• No advertising identifier. We do not read the IDFA and there is no AdSupport code in the app.
• No App Tracking Transparency prompt, because we do nothing that requires one. We do not track you across apps or websites owned by other companies. In the App Store privacy declaration, Midos declares that it does not use data for tracking.
• No data brokers, no ad networks, no third-party SDK that exists to monetise your behaviour.
• No selling and no sharing of personal information in the sense the California Consumer Privacy Act gives those words. We have never sold or shared personal information, and we do not do it now.
• No profiling with legal effects and no automated decision-making within the meaning of Article 22 GDPR. The AI features suggest drafts; they do not decide anything about you.
• No credit checks, no bank-account connection, no access to your bank. Midos does not connect to any financial institution.

9. Sending data outside the EEA

Our backend, our database, our error monitoring and our analytics run in the EU. Two categories of processing involve a transfer to the United States: OpenAI, when you use an AI feature, and RevenueCat, for your subscription status. Depending on your App Store account, some Apple processing also takes place in the United States.

Where a transfer to a country outside the EEA is not covered by a European Commission adequacy decision under Article 45 GDPR, we rely on the European Commission's Standard Contractual Clauses under Article 46(2)(c) GDPR, combined with technical and organisational measures such as encryption in transit and data minimisation — in particular, the requests we send to OpenAI carry no user id, no email and no authentication token — though they do include the internal ids of your own accounts and categories, which stay the same from request to request and are meaningless outside Midos. You can request a copy of the safeguards we rely on by writing to akhanizkak@gmail.com.

If a recipient is certified under the EU–US Data Privacy Framework, we may rely on the Commission's adequacy decision for that recipient instead.

10. How long we keep things

11. Deleting your data, and withdrawing consent

You have four separate controls, and they do different things.

Turn off sync — Settings → Sync. New changes stop going to the server. What is already there stays until you wipe it.

Wipe the server copy — Settings → Sync → delete my data from the server. Clears your synced books: your transactions, accounts, your own custom categories, recurring payments, savings targets, budget norms and streak history are marked as deleted and stop being served to any device, and the weekly earning snapshots we derive from them are erased outright. The built-in categories that every user shares are not affected. Two things worth stating plainly. First, the marked rows physically stay in our database as deletion markers — that is how your other devices learn to drop their copies on the next sync — so if you want them gone from our servers entirely, delete your account instead. Second, the wipe also clears the same data from the device you ran it on, keeping only your app preferences such as language and base currency. Your account, your subscription entitlement and your AI usage counters all survive, so you can turn sync back on later.

Withdraw AI permission — Settings. Nothing further is sent to OpenAI. Voice and receipt scanning stop working until you grant permission again. Withdrawing does not affect the lawfulness of what was processed before you withdrew.

Delete your account — Settings → Danger zone → Delete account. This is self-service; you do not need to contact us. It runs immediately and it is not reversible. It:

1. permanently removes your transactions, accounts, your own custom categories, recurring payments, savings targets, budget norms, streak history, weekly earning snapshots, AI usage quotas and subscription entitlements, and hard-deletes your user in Supabase's authentication system — this time the rows go for good, including anything you had previously only marked as deleted by wiping the server copy;
2. keeps the RevenueCat webhook event rows for accounting purposes, but strips them of everything that identifies you: the user reference and the RevenueCat app user id are cleared and the raw webhook body is erased. What survives is an anonymous stub — the event's own id, its type, whether it came from the sandbox or production, and the time it arrived. We keep the id because it is what stops the same webhook from being processed twice;
3. asks RevenueCat to delete your subscriber record. This one is best effort and runs last, after your account is already gone: if RevenueCat is unreachable or slow we stop waiting and finish anyway, which can leave an orphaned subscriber record on RevenueCat's side.

Two things it does not do, on purpose:

• It does not delete the copy of your data on your own device. Your local books keep working offline. Delete the app, or use Settings → Reset data, if you want that gone too.
• It does not cancel your Apple subscription. Apple, not us, controls billing. Cancel the subscription yourself in your Apple Account subscription settings before or after deleting the account — otherwise Apple may keep charging you. See the Terms of Use.

Backups of our database may retain a copy for a short period after deletion before they roll over. We do not restore deleted accounts from backups.

12. Your rights

If the GDPR applies to you

You have the right to:

• access the personal data we hold about you and get a copy of it (Article 15);
• rectify data that is inaccurate or incomplete (Article 16);
• erase your data (Article 17) — the in-app account deletion does this immediately;
• restrict processing in certain circumstances (Article 18);
• portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible (Article 20). The app can export your data to CSV or JSON at any time from Settings → Data, with no request needed;
• object to processing based on our legitimate interests, including the analytics described in section 4.7 (Article 21);
• withdraw consent at any time where processing is based on consent, which for us means the AI features (Article 7(3)).

To exercise any of these, write to akhanizkak@gmail.com. We will respond within one month, and will tell you if we need to extend that under Article 12(3).

You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live, where you work, or where you think the problem happened (Article 77).

If you are in California

Under the California Consumer Privacy Act as amended by the CPRA, you have the right to know what personal information we collect and why, the right to access the specific pieces we hold, the right to delete it, the right to correct it, the right to opt out of its sale or sharing, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising any of these.

Two of those are simple for us to answer. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of and we do not display a "Do Not Sell or Share My Personal Information" link. Your financial account information is treated as sensitive; we use it only to provide the app to you, which is a use the statute does not permit you to limit, and we do not use it to infer characteristics about you.

The categories of personal information we collect are set out in section 4, the purposes in the same section, our service providers in section 7, and our retention periods in section 10. To exercise a right, write to akhanizkak@gmail.com. We will verify your request by asking you to send it from the address associated with your account or to confirm details only the account holder would know. You may use an authorised agent; we will ask for proof of authorisation.

If you are somewhere else

Other privacy laws — in the UK, Switzerland, Brazil, Canada and elsewhere — give similar rights. Write to akhanizkak@gmail.com and we will honour them on the same terms.

13. Security

Everything travels over TLS. Passwords do not exist here, because authentication is delegated to Apple and Supabase and we never handle a credential. Access to the production database and to the server is limited to the people who operate the service, over authenticated channels; the server sits behind a firewall that exposes only what it must. Server-side quota data lives in a password-protected cache reachable only from the server itself.

No system is perfect. If we ever suffer a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as Article 33 GDPR requires, and we will tell you directly where Article 34 requires it.

14. Children

Midos is a tool for adults managing their own money. It is not directed to children, we do not market it to children, and we do not knowingly collect personal data from a child under 16 — the minimum age to use Midos under our Terms of Use.

The app carries an expected App Store age rating of 4+, which reflects that it contains no objectionable content. It does not mean the app is designed for young children.

If you believe a child has given us personal data, write to akhanizkak@gmail.com and we will delete it.

15. Changes to this policy

If we change what we collect, who receives it, or why, we will update this page and change the effective date at the top. For material changes — a new recipient, a new category of data leaving your device, a change in retention — we will also tell you inside the app, and where the change concerns the AI features we will ask for your permission again before anything new is sent.

The current version always lives at https://midos.online/privacy.

16. Contact

Individual Entrepreneur Akhan Iskak, trading as "AT&S"
Registered in the Republic of Kazakhstan
221 Zhambyl Street, apt. 41, Almaty 050009, Kazakhstan
Email: akhanizkak@gmail.com

Related: Terms of Use.