money drip

Privacy Policy

Last updated: 8 June 2026

Money Drip is an app that helps you take control of your fixed expenses. Privacy matters to us, and we designed the app to collect as little data as possible. This policy explains in plain language what data we use, why, and what your rights are.

1. Who we are

Money Drip is offered by A.Y.V. Hubers Beheer B.V., established in Rotterdam, the Netherlands. A.Y.V. Hubers Beheer B.V. is the data controller for all personal data processed through the app.

2. What the app does

Money Drip helps you gain insight into your fixed expenses, subscriptions, and daily spending. You can scan bank statements or credit card overviews using AI, add bills manually, and optionally compare your spending with people similar to you (Peek over the fence). That comparison happens at group level and is not directly identifying.

3. What data we collect

3.1. Data that stays on your device

The following data is stored locally on your iPhone or iPad and syncs through your own iCloud account. We have no access to it:

• Bills and subscriptions you add (name, amount, date, category)
• Sneaky Habits and donations you record
• Your income sources and what you have available to spend each month (the Income feature). This detailed income stays entirely on your device.
• Preferences such as language and sound settings

You also create your Peek profile (household size, children, housing type, age bracket, country, and an optional income bracket) locally. As soon as you take part in Peek over the fence, a copy of it is sent to our server; see 3.2.

3.2. Data sent to our servers

For specific functionality, we send limited data to our server at Cloudflare. Per function we explain what data this is.

Scan function (Money Drip AI):

• The photo, PDF file, or CSV export of the statement you scan. We do not retain it; it is processed immediately.
• A random device identifier to prevent abuse and track your monthly scan quota.

A statement may also show sensitive information, for example a payment to a doctor, a pharmacy, or a political party. By starting a scan you give your explicit consent for that image to be processed for recognition. You can crop your screenshot before scanning so that only the lines you want recognized are visible.

Peek over the fence (group-level comparison):

When you take part in Peek over the fence, we send — linked to your random device identifier — your profile attributes (household size, children, housing type, age bracket, country, and an optional income bracket) and your category totals (total fixed costs and the totals for bills, Sneaky Habits, and donations) to our server. We keep this submission linked to that device identifier so we can show you a comparison and so you can withdraw your participation at any time. Because the data is tied to a device identifier, it is not directly identifying, but it is not fully anonymous either. The comparisons you see in the app are averages across groups of similar households.

Idea function (feedback):

• The idea or feedback you voluntarily submit
• Language and app version (technical context)
• Submission timestamp

We do not ask for an email address or any other identification with idea submissions.

Purchase of a Pro subscription:

Pro subscriptions are sold by Apple on our behalf (Apple is the seller). Apple receives your payment details; we do not. From Apple we only receive whether your subscription is active and which type (Solo, Plus, or Family).

3.3. What we do NOT collect

Money Drip is intentionally designed without tracking. We do not collect:

• Cookies or similar tracking technology
• Analytics about how you use the app
• Advertising IDs from Apple or third parties
• Location data
• Contact information from your address book
• Your real name, email, or phone number (unless you enter it yourself in an idea submission, which we don't ask for in v1.0)
• Third-party data such as from Facebook, Google, or ad networks

4. Why we process this data

Under GDPR, we need a legal basis for each processing activity. For Money Drip we use:

• Scan function: your explicit consent. Before a scan you confirm a consent screen explaining what is sent. This consent also covers any sensitive data that may be visible on your statement (GDPR art. 9(2)(a)).
• Device ID for abuse prevention: our legitimate interest in keeping the service available and affordable.
• Peek over the fence: your consent. You agree via the consent screen before we send anything, and you can withdraw that consent at any time.
• Idea function: your consent. You voluntarily fill in and submit.
• Purchase of a Pro subscription: performance of the contract and a statutory tax retention obligation.

5. Who we share data with

We share data with the following parties, and no one else. We never sell or rent your data to third parties.

Anthropic (United States):

Anthropic processes the scan using AI: the statement is recognized and the result returned. Anthropic retains the scan for up to 30 days to detect misuse and then deletes it automatically, and never uses your scans to train AI models. Anthropic is based in the United States and certified under the EU-US Data Privacy Framework (DPF).

Cloudflare (primarily EU, sometimes US under DPF):

Cloudflare hosts our server (Worker), handles the forwarding of the scan, and stores the Peek submissions and aggregates. Cloudflare automatically selects the nearest data center, usually within the EU. For any processing outside the EU, Cloudflare is certified under the DPF.

Apple (United States):

Apple handles the sale of Pro subscriptions via the App Store (StoreKit), the optional iCloud synchronization of your data, Family Sharing, and, if you enable it in your iOS settings, anonymized crash and performance reports. Apple processes this under its own terms and is certified under the DPF.

6. How long we retain data

• Scan photos, PDF and CSV files: not retained by us. At Anthropic for up to 30 days for abuse detection, then deleted automatically.
• Device ID for scan quota: until the end of each month, then automatically reset.
• Your Peek submission (profile and totals, linked to your device ID): until you delete it, or up to 12 months of inactivity, then automatically deleted.
• Peek aggregates (group averages): indefinitely, as they cannot be traced to an individual.
• Idea submissions: maximum 12 months, then deleted.
• Purchase data held by us: 7 years for the statutory tax obligation, at report level without linkage to an individual customer.

7. International data transfers

Some data is processed outside the EU, particularly by Anthropic and Apple in the United States. For these transfers we rely on the EU-US Data Privacy Framework as an appropriate safeguard, as recognized by the European Commission. Cloudflare processes primarily within the EU.

8. Your rights

Under GDPR you have the following rights:

• Right of access: you can ask what data we hold about you.
• Right to rectification: you can have incorrect data corrected.
• Right to erasure: you can request deletion of your data. For Peek you can do this directly in the app via Settings → Peek over the fence → Delete my profile.
• Right to restriction: you can request that processing be limited.
• Right to data portability: you can request your data in a common format.
• Right to object: you can object to processing based on legitimate interest.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.

Send a request to [email protected]. We respond within 30 days.

9. Minimum age

Money Drip is intended for users aged 16 and older. We intentionally do not collect data from children under 16. For the Peek feature, the lowest age bracket is 18-25 years.

10. Changes to this privacy policy

We may update this policy. For significant changes, we will display a notice in the app. The date at the top of this document shows when it was last updated.

11. Complaints and contact

Questions or complaints? Contact us at [email protected]. We're happy to help. If we cannot resolve your concern, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

12. Region-specific rights

United Kingdom (UK-GDPR):

Users from the UK have similar rights as under GDPR. Complaints can be filed with the Information Commissioner's Office (ICO) at ico.org.uk.

Turkey (KVKK):

Users from Turkey are covered by the Kişisel Verilerin Korunması Kanunu (KVKK). You have rights similar to those under GDPR. Complaints can be filed with Kişisel Verileri Koruma Kurumu (KVKK) at kvkk.gov.tr.

California (CCPA/CPRA):

California residents have additional rights under the California Consumer Privacy Act. You have the right to know what data we collect, the right to deletion, and the right to non-discrimination when exercising your rights. We do not sell your data to third parties.