Privacy Policy

Effective date: 9 July 2026 Last updated: 9 July 2026 Contact: devmobileuae@gmail.com

The short version. Paid is a local-first invoicing app. Your business data — your clients, invoices, estimates, receipts, and business profile — is stored on your iPhone, and only mirrored to your own private iCloud if you turn sync on. We don't run servers that hold your ledger. We don't require an account. We don't sell data, show ads, or track you across other apps. The only things that ever leave your device are your anonymous subscription status (so your Pro purchase works across your devices) and — if we ever switch it on — anonymous product statistics that never include your invoices, clients, or amounts.

Contents

1. The short version
2. Who we are
3. What data we process, and why
4. What we do NOT do
5. Where your data is stored
6. The people you invoice (your clients' data)
7. Device permissions we ask for
8. International transfers
9. How long we keep data
10. Your rights
11. Third parties
12. Cookies and tracking on the website
13. Security
14. Children's data
15. Automated decision-making
16. Deleting your data
17. Changes to this policy
18. Contact

1. The short version

Paid is a tool for making invoices, estimates, and receipts. Everything you create — your business profile, your client list, your line items, amounts, notes, and the documents themselves — is stored on your iPhone, inside the app's own sandboxed storage. It does not leave your device unless you choose to turn on iCloud sync, and even then it goes only to your own private iCloud account, which we cannot access.

We (the developer behind Paid) do not operate any server that stores your documents or your clients. There is no account and no login. We do not sell or rent your data. We show no ads. We do not use your documents to train any AI model — we couldn't, because we can't read them.

The only personal data that can reach a third party is the minimum needed to make your subscription work: a random, app-generated identifier and your App Store purchase status, handled by Apple and by our subscription tool RevenueCat. Neither of them receives your invoices, your clients, or any amounts.

Plain English: We don't have your ledger. It lives on your phone.

2. Who we are

Paid (Paid: Invoice & Estimate Maker) is operated by Aleksandr Borodin, an individual developer based in the United Arab Emirates.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Aleksandr Borodin is the data controller for the limited personal data described in this policy.

• Privacy contact: devmobileuae@gmail.com.

3. What data we process, and why

We designed Paid to process as little personal data as possible. Most of what you create never reaches us at all. The table below lists everything, why it exists, and — for users in the EEA and UK — the GDPR legal basis.

Plain English: The only personal data that can reach us or our subscription tool is an anonymous ID and your Apple purchase status. Your invoices and your clients are not in that list.

4. What we do NOT do

Because this is the heart of our promise, we state it plainly. We do not:

• require you to create an account, sign in, or hand over an email address to use the app;
• read, see, or hold a copy of your invoices, estimates, receipts, or client list — we operate no server that stores them;
• receive, see, or store your payment-card details — Apple processes all billing, and card data never touches us;
• sell or rent your data to anyone, ever;
• show advertising, or include any ad SDK or ad identifier (no IDFA; the App Tracking Transparency prompt is not shown, because we do not track);
• use your documents to train any AI or machine-learning model;
• share data with data brokers;
• track you across other apps or websites.

Any on-device conveniences — for example, cutting the background out of your uploaded logo — run on your iPhone. Your logo image is not uploaded to us, and no external AI service is involved.

5. Where your data is stored

• On your iPhone. Your business profile, clients, documents, item templates, and preferences live in the app's sandboxed local storage (Apple's SwiftData / Core Data). This is the default and primary location.
• Optionally, in your own iCloud. If you turn on iCloud sync, your data is mirrored to your personal iCloud account (Apple's CloudKit private database), encrypted in transit and at rest by Apple. Only you, signed in with your Apple ID on your own devices, can read it. We (Paid) have no access to this iCloud container.
• Our limited records. An anonymous subscription status (via RevenueCat, Section 11) and any support correspondence you send us by email are handled as described in Sections 9 and 11.

6. The people you invoice (your clients' data)

To create a document, you enter details about your clients — and Paid can import them from your iOS Contacts if you choose to. That information is your business record. Paid simply stores it on your device and, if you enable sync, in your own iCloud. We never receive it.

When you email or share a finished PDF, it is delivered by whatever app or service you pick (Mail, Messages, WhatsApp, AirDrop, and so on) directly — it does not pass through us.

Because these are your customers' details, you are responsible for handling them lawfully — for example, having a legitimate business reason to store a client's contact information, and honouring a client's request to see or delete what you hold. You can edit or delete any client in the app at any time.

Plain English: Your client list is yours. We are just the notebook it's written in.

7. Device permissions we ask for

Paid asks for a few iOS permissions, only when you use the feature that needs them. You can change any of them later in iOS Settings → Paid.

• Contacts — only if you tap "import from Contacts." We read the contact you pick to pre-fill a client's details, then it lives in the app like any client you typed. We do not upload or scan your address book.
• Photos / Camera — only if you add a business logo. The image you choose is stored with your business profile on your device.
• Notifications — only if you enable reminders. Used for local due-date, overdue, and follow-up alerts, scheduled on your device. No push server, and no notification content leaves your phone.

Declining any of these simply disables that one feature; the rest of the app works normally.

8. International transfers

• If you use iCloud sync, the geographic location of that data is determined by Apple, not by us. See Apple's privacy documentation at https://www.apple.com/legal/privacy/.
• RevenueCat, Inc. (our subscription tool) is based in the United States, so your anonymous subscription data may be processed there. If you are in the EEA or UK, that transfer relies on the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.
• If a support email you send us is received at a provider hosted outside your region, the same safeguards apply. Any analytics provider added later will be named here with its region.

9. How long we keep data

• Your business data (profile, clients, documents, templates): kept for as long as you keep it on your device. You can delete any client or document at any time. "Delete all data" in Settings wipes everything immediately. If iCloud sync was on, the synced copy is removed through iCloud's standard mechanisms.
• Subscription / entitlement records: retained by RevenueCat and Apple on their own schedules while your subscription is active and for their record-keeping. The random app-user identifier persists so purchases can be restored, until you delete the app and its data.
• Support correspondence: if you email us, we keep that correspondence for 24 months, then delete it.

10. Your rights

Under GDPR / UK GDPR (EEA and UK users)

You have the right to:

• access — request a copy of the personal data we hold about you;
• rectification — correct inaccurate data;
• erasure ("right to be forgotten") — have us delete your personal data;
• restrict processing;
• data portability — receive your data in a machine-readable format;
• object — to processing based on legitimate interests;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local supervisory authority (for example, the ICO in the UK, or the CNIL in France).

Because almost all of your data lives only on your device, most of these are satisfied instantly inside the app — you can view, correct, export, and delete everything yourself. For anything else, email devmobileuae@gmail.com; we will respond within 30 days.

Under CCPA / CPRA (California users)

You have the right to:

• know what categories of personal information we collect and the purposes;
• delete your personal information;
• correct inaccurate personal information;
• opt out of the "sale" or "sharing" of personal information — note that we do not sell or share your personal information;
• limit the use of sensitive personal information — we do not use sensitive information beyond what is necessary to provide the app;
• non-discrimination for exercising any of these rights.

We offer no financial incentives in exchange for personal information. Even though we do not sell or share, a "Do Not Sell or Share My Personal Information" link is provided in our website footer for transparency.

Under PIPEDA (Canada) and the Australian Privacy Act

You have the right to access and correct your personal information, and to complain to the Office of the Privacy Commissioner of Canada, or the OAIC in Australia.

Exporting your data yourself

Inside the app you can share or export any document as a PDF, and your data is always available on your own device and (if enabled) in your own iCloud. These are the fastest way to obtain a portable copy — usually faster than a formal request.

11. Third parties

We keep this list honest and complete. These are the only third parties that can receive any personal data, and exactly what they receive:

If we ever add another provider, we will add a row here and disclose it in the same release in which the integration ships.

12. Cookies and tracking on the website

Our website (invoicepaid.app) uses no cross-site tracking, no Meta or Google advertising pixels, and no ad retargeting. It either uses no cookies at all, or only privacy-respecting, consent-exempt analytics (such as Plausible or Fathom). If cookies that require consent are ever introduced, a compliant consent banner will be added in the same release.

13. Security

• Data on your device is protected by iOS sandboxing and, if you enable it, by a Face ID / passcode lock on the app itself.
• iCloud sync data is encrypted by Apple in transit and at rest.
• Communication with RevenueCat is encrypted in transit (TLS).
• Any internal tools we use (such as email or support tooling) are protected with multi-factor authentication.
• We maintain a process to assess and, where GDPR requires, notify the relevant supervisory authority of a personal-data breach within 72 hours.

14. Children's data

Paid is a business tool and is not directed to children under 13 (under 16 in the EEA, unless local law specifies otherwise). We do not knowingly collect personal data from children in those age brackets. Subscriptions are gated by the age of the App Store account. If we learn that we have collected such data, we will delete it. A parent or guardian may email devmobileuae@gmail.com to request deletion.

15. Automated decision-making

We do not make decisions about you by automated means that produce legal or similarly significant effects. Overdue and follow-up reminders are simple, date-based alerts scheduled on your device from your own documents — not profiling, and with no effect outside the app.

16. Deleting your data

You can delete individual clients and documents at any time, or wipe everything at once with Settings → Delete all data. This removes the copy on your device immediately; any iCloud-synced copy is removed through iCloud's standard mechanisms.

You can also email devmobileuae@gmail.com to request deletion; we will process it within 30 days.

Important: Deleting your data in the app does not cancel an active App Store subscription. To stop auto-renewal, cancel it in Settings → Apple ID → Subscriptions on your iPhone.

17. Changes to this policy

We will post any changes on this page with a new "last updated" date. Material changes will be communicated inside the app before they take effect.

18. Contact

• Data controller: Aleksandr Borodin (United Arab Emirates)
• Privacy email: devmobileuae@gmail.com
• Supervisory authority: for EU users, the data-protection authority in your country of residence; for UK users, the Information Commissioner's Office (ICO).