Privacy

Nothing you log in the app is ever readable by us, including any reduced or anonymized version of it.

The app has no analytics and no telemetry of any kind. Nothing you log, no amount, no label, no goal, no photo, is ever sent anywhere we can read it. If the app crashes, it asks you before it sends anything about the crash; see Crash reports and problem reports. You never need an account to use it. If you choose to sign in, so Premium works on more than one device, we hold your email address and the few things listed under Signing in, and nothing more.

This website is a separate thing, and since September 2, 2026 it is measured. The measurement is described under This website below. Measuring the website changes nothing about the app: the two do not share anything, and nothing you log in the app is visible to this site or to anyone running it.

The app talks to the internet in four situations, and only because you chose them: sending a crash report or a problem report, described under Crash reports and problem reports; signing in with an email, Apple or Google, described under Signing in; unlocking Premium on a Mac or a PC with a code from your phone, described under Unlocking Premium on a computer; and Premium sync between your own devices, described under Sync between your devices. The first carries your email address and a six digit code, or the sign-in Apple or Google hands back. The second carries a short code and a receipt number. The third carries a copy of your log that is encrypted before it leaves the device, with a key we never have.

What the app stores

Everything you log, the amounts, the labels you write, your categories, your goals and their photos, is written to a file in the app's own private storage on the device you logged it on. It is not uploaded to us unless you turn on sync, and even then what reaches us is sealed on your device first, so we hold a copy we cannot open.

If your device backs itself up through iCloud, Google, or Windows, that file is included in that backup, the same as any other app's data. That backup belongs to you and your device maker, and is governed by their terms. Our terms do not apply to it, and we cannot see inside it.

What we do not do

• No account needed. Logging never asks for one, and there is never a password to create. Signing in, with an email, Apple or Google, is optional and only for using Premium on more devices.
• No bank connection. The app never asks for banking credentials and cannot read your transactions. You type two numbers; that is the entire input.
• No analytics in the app. No usage tracking, no third-party crash reporting SDK, no session recording and no heat maps, on any platform. A crash report goes only when you say so, and only to us. This website is measured and the app is not; see This website.
• No advertising and no advertising identifiers. Nothing in the app is sold, shared, or brokered, because nothing is collected to sell.
• No third-party SDKs that phone home.
• No location, contacts, microphone, or camera roll access beyond the single photo you choose yourself for a goal, which stays on the device.

Purchases

Premium is sold through the App Store and Google Play, and on this website through Stripe. The store or Stripe handles the payment and tells the app one thing: whether this device is entitled to Premium. We never see your card, your billing address, or your name. For a purchase on this website we keep the email address you gave Stripe, stored as a one-way hash, beside the subscription, so you can sign in with that address on your other devices.

Signing in

Signing in is optional. It lets one Premium subscription work on every device you sign in to, wherever you bought it. There are three ways in, and they all open the same account.

With an email. You type your email address, we email you a six digit code, and you type the code back in. The code is sent by our email provider, Resend, and it expires after fifteen minutes.

With Apple or Google. Apple or Google confirms who you are and tells us two things: an identifier for your Apple or Google account that stays the same, which we store only as a one-way hash, and the email address you let them share. If you choose Apple's Hide My Email, that address is a private relay address Apple made for Keep the Diff, and we never learn your real one. We do not receive your name, your photo, your contacts, or anything else from your Apple or Google account. On a computer, and for Google on an iPhone or Apple on an Android phone, the sign-in opens in your browser and returns to the app when you finish. Signing in with Apple or Google is covered by their privacy policies as well as this one.

Signing in never gives you Premium on its own. Premium comes only from a subscription the App Store, Google Play or Stripe confirms is active.

What we keep for an account: your email address, and any other address an Apple or Google sign-in added to it; the hashed Apple or Google identifiers that sign in to it; the subscriptions attached to it, which is a receipt number from the App Store or Google Play, or a subscription number from Stripe, and when each one runs to; and the devices signed in with it, each with a random identifier, a plain name such as "iPhone" or "Mac", and the date it was last used. We use these for one thing, answering whether your devices should have Premium. Nothing you log in the app is part of an account.

You can see your devices and remove any of them in Settings, under Account. Deleting your account there removes all of it from our server at once. You can also delete it without the app, on Delete your account, with a code sent to its email address. Your subscription itself keeps running until you cancel it where you bought it.

What those stores collect while processing a purchase is covered by Apple, Google, and Microsoft's own policies.

Unlocking Premium on a computer

One subscription covers every device you use, but the Mac and Windows downloads from this site have no store of their own to ask. So the phone or tablet that holds your subscription is what proves it: the computer shows a short code, you type that code into the app on your phone, and your phone sends us two things: the code, and the opaque receipt number the App Store or Google Play issued for your subscription.

We hand that receipt number straight back to Apple or Google to ask one question: is this subscription still active? We store the receipt number and a random token for the computer, so the computer can ask again later and lose Premium if the subscription ends. Those two items are the whole record for this route. There is no email address, no name, no password, no payment detail, and nothing you have logged in the app. None of those details are needed to answer the question.

You never have to use this unlock route.

Sync between your devices

Premium can keep your log the same on your iPhone, iPad, Mac, Android devices and PC. Sync is off until you turn it on. When it is on, each device encrypts the whole log with AES-256-GCM before sending it, using a key that is created on your device and kept in its secure storage (the Keychain, or the Android Keystore). When you add another device, the key travels to it sealed for that device alone, alongside the unlock code. We never receive the key in a form we can use.

What we store is one sealed file per subscription, filed under a one-way hash of the receipt number. We can see how large that file is and when it last changed. We cannot see anything inside it, including how many things you have logged.

Turning sync off stops your devices sending anything more. The last sealed copy stays on our server until you ask us to delete it at the address below, and without the key it is unreadable to us or to anyone who ever got hold of it.

If you never unlock a computer, never turn on sync and never send a report, the app does not use the network.

Crash reports and problem reports

After a crash, the next time the app opens it asks whether to send a report. The report says which device and system you use, which version of the app, and where in the app's code the crash happened. You can add a note and a screenshot you pick, and you see the screenshot before anything is sent. Nothing goes unless you press Send. If you choose Always send, later crash reports go without asking, and without a note or screenshot; you can change that in Settings.

Report a problem, in Settings, sends a note you write, a screenshot if you add one, and your email address only if you type it so we can reply.

Neither includes anything you logged. The one way an amount could reach us is a screenshot you chose to attach. Reports go to our server on this domain and are emailed to us; a screenshot is deleted from the server once it is emailed. We use reports only to fix the app.

This website

keepthediff.com uses Microsoft Clarity. It records how people move through the site: clicks, scrolling, pointer movement, and a replay of the pages as they looked. It is there to show which pages are read and where people give up, and it started on September 2, 2026.

Microsoft receives that recording and holds it. What they do with it is covered by their own privacy statement. Clarity sets cookies in your browser to recognize one visit from the next.

What is deliberately not recorded. The contact form is masked before anything is sent, so the recording shows that it was used and never your name, email address or message. The two pages involved in buying Premium on this site, /unlock and the page Stripe returns you to, do not load Clarity at all.

The demo and the savings goal calculator are not masked. They are try-it-here widgets with example amounts already filled in, nothing typed into them is stored or sent anywhere, and whether people use them is most of what this measurement is for.

If you would rather not be recorded, turn on Do Not Track in your browser. This site checks it and will not load Clarity at all. Nothing on the site stops working.

Store link and download counts. When you click a link to the App Store, Google Play or the Microsoft Store, or start a Mac or Windows download, this site adds one to a daily number for that link. Nothing else is sent with it: no cookie, no address, nothing about you or your browser. It is a count, and it runs whether or not Do Not Track is on.

Visits that start in the app. A link opened from inside Keep the Diff, or from a milestone someone shared, carries which app and which screen it came from, for example "Windows, tray" or "iPhone, Settings". No personal data travels with it. We use it to count how many people arrive this way, and, if that visit leads to buying Premium, to see which app screen the purchase started from.

None of this touches the app. The app has no analytics of any kind, and there is no link between a visit here and anything you have logged there.

Children

The app is not directed at children and collects no information from anyone, including children.

Your rights

Rules like the GDPR and the CCPA give you the right to see, correct, export, and delete the personal information a company holds about you.

From the app, we hold nothing that identifies you. If you unlocked a computer, we hold a receipt number and a random token for that computer. If you use sync, we hold a sealed copy of your log that we cannot open. Either can be deleted on request. From this website, Microsoft Clarity holds the recording of your visit, described above. To have that deleted, write to hello@littlebirdtrading.com with the rough date and time you visited and we will ask Microsoft to remove it. You can also avoid it being recorded in the first place by turning on Do Not Track in your browser, which this site checks before it loads anything.

Your own copy is yours to manage directly: Premium can export your full history as a CSV file, and deleting the app removes its data from that device.

Changes

If this policy ever changes, the date at the top changes with it. If a future version of the app ever sends anything beyond what is described here, the change will be described here plainly, and it will stay off until you turn it on.

Contact

Questions about this policy: hello@littlebirdtrading.com

Keep the Diff is made by Little Bird Trading LLC.