Nikatru Subscription Tracker — what this app collects
This page lists, item by item, every category of personal data Nikatru Subscription Tracker collects, why it is collected, how long it is kept and who outside Nikatru touches it. It is generated from the declaration the app itself is built and audited against, so it cannot drift from what the code does without a build failing.
Nikatru Subscription Tracker collects 12 categories of personal data for 3 stated purposes, keeps each for a fixed period, shares none of it with anyone beyond the service providers named below, and keeps no network address with any of it.
1. What is collected
12 categories, in the vocabulary the Google Play Data safety form uses — the same words the sworn store declaration answers in, so the two cannot quietly disagree.
| Category | What it is | Why | Kept for | Needed to use the app? | Shared? |
|---|---|---|---|---|---|
| Location | Approximate location | Analytics | 400 days | No | No |
| Personal info | Email address | Account management, App functionality | 730 days | Yes | No |
| Personal info | Name | Account management | 730 days | No | No |
| Personal info | User IDs | Account management, App functionality | 730 days | Yes | No |
| Financial info | Purchase history | App functionality | 730 days | No | No |
| Financial info | Other financial info | App functionality | 730 days | Yes | No |
| App activity | App interactions | Analytics | 400 days | No | No |
| App activity | Other user-generated content | App functionality | 730 days | Yes | No |
| App info and performance | Crash logs | App functionality | 400 days | No | No |
| App info and performance | Diagnostics | App functionality | 400 days | No | No |
| App info and performance | Other app performance data | App functionality | 400 days | No | No |
| Device or other IDs | Device or other IDs | Analytics, App functionality | 400 days | Yes | No |
2. Why each of those answers is what it is
Every row above carries the reason it was decided on, the file that reason was read out of, and the date it was read. They are reproduced here in full rather than summarised, because a summary of a basis is a new claim.
Location — Approximate location
The device never provides a location. The only geography that exists anywhere is inferred at the Cloudflare edge from the connection, which is why the row is collected but not required and carries Analytics alone.
Personal info — Email address
Login is mandatory in the apps (ADR 058) and identity is one Supabase auth project for the whole portfolio (C-ONE-IDENTITY-PER-USER), so an address is the account. It is held for the account's life and erased by the schema-derived erasure route, identity last. On Pro, the account may also add up to three other email addresses to get a copy of its renewal reminders. Each address is kept with the time its owner confirmed it, is sent nothing but one confirmation request until it is confirmed, can stop its copy in one click, and is deleted when the account removes it or is erased.
Personal info — Name
Optional. The user can enter a name in Settings, and if the user chooses Sign in with Apple or Sign in with Google, optional ways to sign in, Apple or Google shares the name on that account as the user allows; an account needs no name. It sits on the identity record beside the address, is held for the account's life and is erased with the identity.
Personal info — User IDs
The one identity per user across every app is a user id issued by the auth project; every app row keys on it, which is what makes erasure reach derivable from the schema rather than from a hand-kept list of tables.
Financial info — Purchase history
Paddle is the merchant of record and will not replay a notification older than ninety days, so from day ninety-one ours is the sole surviving copy of the entitlement history a customer can be shown. A promotional code redeemed by the account is part of that history: which offer and campaign it redeemed, when, and the free months or the discount it gave, never the code itself (only its hash). Failed redeem attempts are kept for 400 days to stop guessing, and every one of these rows is erased with the account. An AI credit pack the account bought is part of it too: the store or rail and its transaction reference, the credits bought and left, when they were bought, and what each AI request cost in credits (never what was sent). Credits never expire.
Financial info — Other financial info
The subscriptions a person tracks in this app are financial facts about them, and they are the product itself. They sit in the app's own rows and are reached by the same erasure route as everything else keyed on the user id.
App activity — App interactions
The first-party events rail, consented per purpose and append-only, so a grant for analytics is never evidence of a grant for anything else. Swept at four hundred days by the events retention job.
App activity — Other user-generated content
The names, amounts and renewal dates a person enters. This is the content the app exists to hold, so it lives as long as the account does and goes with it. If you create a private calendar link, the same names, amounts and renewal dates are shown to whichever calendar you give that link to, until you turn the link off. If you choose to report a problem, what you write, and a screenshot only if you attach one (with text fields and private details blurred on your device first), is kept for 90 days and then deleted.
App info and performance — Crash logs
Crash reports reach the self-hosted GlitchTip in Mumbai, whose event retention is bounded rather than indefinite. The software is ours and no analytics company receives them; the machine it runs on is rented from Hostinger, which is listed below as infrastructure under the same rule that lists the vendor of the identity machine.
App info and performance — Diagnostics
Performance and error diagnostics on the same rail as the crash reports, bounded by the same retention and carrying nothing that identifies a connection. A problem report you send carries the diagnostics shown to you before you send it (app version, platform, device type, language and recent error codes; logs only if you tick that box), kept 90 days.
App info and performance — Other app performance data
Timing and resource measurements emitted by the same instrumentation as the diagnostics row above; they are one stream answered as three rows because the Play console asks three questions.
Device or other IDs — Device or other IDs
An install id generated on the device. It is what lets an analytics row exist at all with nothing about the connection in it, it is the identifier the consent trail is keyed on. It is not linked to the account, so deleting the account does not delete it; uninstalling the app (and, on a Mac, removing its data) discards it.
3. How long each period is, and why it is that number
There are three retention periods in this portfolio and no others. They are locked: a convenience change cannot quietly extend how long personal data is kept, because the declaration will not accept a fourth value.
- 400 days — raw, event-level data — the floor is one year, set by the DPDP Rules 2025, and the ceiling is the 425-day industry maximum.
- 730 days — the money rail — our copy has to outlive the payment provider’s own 90-day replay window and the outer card-dispute window.
4. Who else touches it
13 service providers. Services Nikatru runs on its own machines are deliberately not listed: they are infrastructure this company operates, not a party the data is disclosed to.
| Who | Role | What they do with it |
|---|---|---|
| Cloudflare | infrastructure | Serves the web app, runs the Workers and holds the D1 rows. |
| Oracle Cloud | infrastructure | Stores an encrypted copy of the backups; it runs none of the services. |
| Hostinger | infrastructure | Hosts the machines our own sign-in service and crash-report service run on, so it holds the account records (your email address and user id) and the crash reports those services store. |
| Supabase | identity | Ran the account and sign-in service until 27 September 2026, and still holds a fallback copy of the account and sign-in records from before that date until it is retired; the app no longer uses it. |
| Paddle | merchant of record | Takes the payment and is the seller of record for the web channel. |
| Apple App Store | store billing | Bills and delivers in-app purchases made through that store, under its own terms. |
| Google Play | store billing | Bills and delivers in-app purchases made through that store, under its own terms. |
| Razorpay | payment gateway | When you buy in India anywhere other than the Apple App Store or Google Play, Nikatru is the seller and Razorpay takes the payment as our payment gateway, processing your payment details on our behalf. |
| Google (Google Workspace and Google Drive) | infrastructure | Hosts our support mailbox, so it holds what you write to support, and stores our backups, which contain a copy of the account, subscription and usage records listed above. |
| Resend | email delivery | Delivers the transactional email an account needs to exist, and the renewal reminder emails you choose to receive, which list the subscriptions about to renew, including the copy sent to each extra address you add on Pro once that address has confirmed it wants them. |
| Anthropic | ai processor | Runs the AI model behind the in-app help assistant and the other AI features. What you write to one is sent to it to produce the answer; we do not keep it. Anthropic deletes it within 30 days of receiving or producing it, unless it must keep it longer to enforce its usage policy (up to 2 years for a request it flags) or to comply with the law. With your own Anthropic API key, the request goes from your device straight to Anthropic under your own account with it. |
| OpenAI | byok ai | Only if you add your own OpenAI API key to an AI feature, answers your request directly from your device under your own account with it; the request never passes through our servers and we are not a party to it. |
| Google Gemini | byok ai | Only if you add your own Google Gemini API key to an AI feature, answers your request directly from your device under your own account with it; the request never passes through our servers and we are not a party to it. |
5. What is never collected
Apart from a pending sign-in verification, described next, no network address is kept with any of the rows above, or with your account. Our sign-in service records the address a request comes from, and since 2 October 2026 the database it writes to empties that field on every write, so the account and sign-in records hold none.
A pending sign-in verification briefly holds the network address it was requested from: if you use a second sign-in step, the one-time code is accepted only from the address that asked for it, so that address is kept until the code is used. It is erased when the verification succeeds, or, if it is never completed, within a day of the code expiring, 5 minutes after it was requested.
Two things see the address a connection comes from, and neither keeps it with your data. Cloudflare, at the network edge, uses it to deliver the request, to stop abuse and to infer the approximate location in section 1, and then discards it, apart from Cloudflare’s own security logs. The request log of our sign-in service, on a server we run, records it for security and fault diagnosis and deletes it after 7 days.
Copies made before 2 October 2026 remain until they age out: a sign-in session opened before that date keeps the address it was opened from until it next refreshes, which the app does whenever it is used; the encrypted backups of the sign-in records taken before that date contain those addresses; and so does the fallback copy of the sign-in records Supabase holds from before 27 September 2026, until it is retired.
Nothing on this page is collected from anyone under 18. Nikatru does not offer any app, extension or site to children, and does not knowingly collect data from them.
6. Notice, consent and your rights
This section is the itemised notice: what is processed, for what purpose, how a consent is withdrawn, and how a complaint is made. It is generated from the same declaration as the table above, so the notice and the practice are one document.
What is processed, and for what purpose
Exactly the categories in section 1, each for exactly the purposes listed beside it, and for no other purpose. Consent is recorded separately for each purpose and the record is append-only: a consent given for one purpose is never treated as a consent for another, and withdrawing one leaves the others as they were.
Item by item, on our servers
Every kind of personal data our servers hold for Nikatru Subscription Tracker and for the services every Nikatru app shares, why, and for how long. It is rendered from the inventory our systems are checked against (tooling/legal/data-inventory.json).
| What we hold | Why | How long we keep it |
|---|---|---|
| What you bought and what it entitles you to | To give you what you paid for, handle refunds and cancellations, and keep the purchase records the law requires. | while your account exists; 730 days |
| Your AI credits and your AI opt-in, and a count of each AI request | To meter the AI features you pay for. We do not keep what you write to an AI feature. Anthropic, which answers it, deletes it within 30 days of receiving or producing it, unless it must keep it longer to enforce its usage policy (up to 2 years for a request it flags) or to comply with the law (section 4). | while your account exists |
| Your AI credit purchases, your credit balance and what each AI request cost in credits | To sell you AI credits, keep your balance and show your purchase history. We do not keep what you write to an AI feature. Anthropic, which answers it, deletes it within 30 days of receiving or producing it, unless it must keep it longer to enforce its usage policy (up to 2 years for a request it flags) or to comply with the law (section 4). | while your account exists |
| Your in-app purchases from the Apple App Store or Google Play: the store's purchase number, the product, and its state (active, renewed, refunded, expired), with dates | To work out, from the store's own signed records, what your purchase entitles you to. It never changes what you pay. | while your account exists; deleted when you delete your account |
| The signed messages the Apple App Store or Google Play sends us about your purchase: purchase number, event, product and dates | To keep each store message once, and to check your purchase against what the store itself says. | while your account exists; deleted when you delete your account |
| After you delete your account: a one-way fingerprint of your account number, which cannot be turned back into it | So that a later message from the store about an old purchase is never linked to anyone again. | as long as the store can still send messages about those purchases |
| A payment we could not yet match to an account (your email address only as a one-way fingerprint) | To give the purchase to its owner when they sign in, or refund it. | until it is claimed or refunded |
| Reports you make about AI-generated content | To review and act on the report. | 400 days |
| The link between your account and a browser extension | To let the extension check your plan, and to let you unlink it. | 1 day; 30 days; while your account exists |
| Your renewal reminder choices, the reminders we sent, and your private calendar link | To send the reminders you asked for, once each. | while your account exists; 400 days |
| An account deletion still in progress, and the Apple or Google sign-in link it must cancel | To finish deleting your account everywhere, including the sign-in link. | until the deletion is complete |
| Your email address and sign-up time, if you ask to hear when an app launches | To tell you once when the app launches. | 400 days |
| Usage statistics, only if you allow them: which features are used and when, with a random install identifier | To see what works in our apps and what does not. | 400 days; 1100 days |
| A record of each consent choice you make, and which version of this Policy you were shown | To show that the choice was yours. | as the record of your choice |
| Your problem reports: what you write, an optional screenshot, the diagnostics you saw, and your email address only if you ask us to reply | To fix the problem, and to tell you about it if you asked. | 90 days |
| Your privacy rights requests: what you asked and where our answer goes | To answer your request on time, and to show that we did. | 400 days |
| The name and email address of the person you nominate | So that they can use your rights if you die or cannot act yourself. | while your account exists |
| The offer codes you redeemed | To give you the free months a code offers, and only once. | while your account exists |
| Your invite code, kept scrambled | So that a friend you invite can name you. | while your account exists |
| Who invited whom, if you invite a friend or accept an invitation | To give one free month to both of you, once, and to stop the reward being abused. | while your account exists |
| How many times a day an offer code you typed was wrong | To stop offer codes being guessed, by pausing redemption after too many wrong codes. | 400 days |
| The devices you are signed in on: a label such as “Chrome on Windows”, when each sign-in started and was last used, and when you signed it out | To show you where you are signed in, and to let you sign a device out. | 183 days |
| What you keep in Subscription Tracker: your subscriptions, budgets, categories, payments, price changes and settings | To run the app for you and keep your data in step across your devices. | while your account exists |
| Which of your sign-in sessions you signed out | To keep a signed-out session signed out. | until the session would have ended anyway |
| A short-lived counter against abuse of the sign-up and leave-the-list forms (a one-way fingerprint of the network address, or of the email address entered in the leave form) | To stop the sign-up and leave-the-list forms being abused, and the leave form being used to flood someone's inbox. | one hour for the network-address counter; 24 hours for the email-address counter |
| Nightly backup copies of the records above | To recover from a failure. | 30 days |
| Addresses that asked for no more mail about their reports (as a one-way fingerprint) | So that we never mail them about a report again. | for as long as the request for no more mail stands |
| Our servers' operational logs: when each request ran, whether it succeeded, and the lines our code writes, which can include your account's identifier but never your network address or email address | To investigate faults and security incidents, and because Indian law requires us to keep such logs. | 400 days |
How to withdraw a consent
Every consent given in the app can be withdrawn in the app, at any time, with the same number of taps it took to give. Withdrawal stops the processing that depended on it; it does not undo processing that had already happened, and it does not affect the categories marked as needed to use the app, which are held for as long as the account exists.
How to use your other rights
In the app, open Settings, then “Your privacy rights”: download a copy of everything our servers hold about your account, ask for a correction, name a nominee to act for you if you die or cannot act yourself, withdraw a consent, or make a complaint. Signed out, use nikatru.com/privacy-rights. We acknowledge a request within 48 hours and resolve it within 30 days.
How to have your data erased
Deleting the account erases everything keyed to it. The reach of that deletion is derived from the database schema rather than from a list somebody keeps up to date by hand, so a new table cannot be silently missed. Start at nikatru.com/delete-account.
How to reach a person, and how to complain
The grievance contact is on nikatru.com/contact; a complaint is acknowledged within 24 hours and resolved within 15 days. A complaint that we do not resolve can be taken to the data-protection authority for your jurisdiction; for India that is the Data Protection Board of India, established under the Digital Personal Data Protection Act, 2023.