RESTITUTEPRIVATE · ON-DEVICE

Last updated · 14 October 2026

Privacy

Short version: your screenshots, and everything Restitute finds in them, never leave your iPhone. There are no accounts, no advertising and no tracking. The app sends two things: anonymous usage counts (to Aptabase) and a record of Pro purchases (to RevenueCat). Neither is linked to you, and neither ever includes a service, a subscription, a charge, a price or any text from your screenshots.

Who we are

Restitute is made by an independent developer (“we”). The developer’s legal name is shown as the seller on Restitute’s App Store page. You can reach us at privacy@restitute.app.

What stays on your iPhone

  • Screenshots. You pick screenshots with the iOS photo picker, so Restitute can only see the images you choose, not the rest of your photo library. It reads the text in them on your iPhone with Apple’s on-device text recognition, then lets them go. Screenshots are never uploaded and Restitute doesn’t keep them.
  • What it finds. The subscriptions, trials and charges it finds, and what you decide about them (cancelled, kept, refund asked), are saved on your iPhone. Restitute never syncs them to iCloud and never sends them to us or anyone else. Like all app data, they’re included in your own iPhone backups (in iCloud or on your computer, if you back up), which we can’t access. Deleting the app deletes them from your iPhone.
  • Reminders. Reminders are local notifications scheduled on your iPhone. No push service or server is involved. Turn them off per item in the app, or for Restitute in iOS Settings.
  • Refund letters. Letters are drafted on your iPhone. You decide whether to send them, with your own Mail app or the share sheet. Restitute never sends anything and never sees replies. The name you sign with is stored on your iPhone (and in your own backups).

What the app sends

Restitute contains two third-party SDKs, and they’re the only code in the app that connects to anything other than Apple. The app makes no other network requests of its own.

  • Anonymous usage counts (Aptabase). The app sends a short event when a scan finishes, when the Pro screen opens and when Pro is bought, so we can see whether scanning works and whether Pro is worth offering. Each event says only which of those happened, plus one coarse detail: whether the scan used the bundled example or your own screenshots, and roughly how many things it found (0, 1–2, 3–5 or 6+); whether the Pro screen was opened from the results or from Home; or which plan was bought (annual, monthly or lifetime). It also carries the app and iOS version, the device model, your language and a random session number. The events never include a service, subscription, charge, price, date or any text from your screenshots. Aptabase sets no device identifier. To count daily users it hashes the connection’s IP address with a key it throws away every 24 hours, so counts can’t be tied to you or followed from one day to the next. Our Aptabase data is stored in the EU and kept for up to five years.
  • Purchase records (RevenueCat). RevenueCat is switched on only once you open the Pro screen, or if you already have Pro. From then on the app checks in with RevenueCat when it opens, and when you buy Pro it passes Apple’s signed record of that purchase, which we use to see sales, renewals and refunds. RevenueCat receives the plan, its price and currency, the dates, the App Store country, a random ID that the RevenueCat SDK creates on your iPhone, and Apple’s identifier for vendor: a code Apple gives Restitute for this iPhone, different for every developer, which resets when you delete all of our apps. None of these is your Apple Account, and none is linked to your name or email. RevenueCat may also check that purchase’s renewals and refunds with Apple. Like any web service, it sees your IP address when the app connects. RevenueCat is based in the United States.
  • Payments. Restitute Pro is sold by Apple through the App Store. We never see your payment details. Whether you have Pro is checked on your iPhone with StoreKit, so it works offline. Apple’s privacy policy covers purchases.
  • Crash reports. If you’ve turned on Share With App Developers in iOS Settings › Privacy & Security › Analytics & Improvements, Apple may share anonymous crash reports and usage statistics with us. You can turn this off at any time.

We use the usage counts and purchase records because we have a legitimate interest in knowing whether the app works and in keeping track of sales (GDPR Art. 6(1)(f)). We never sell them, never use them for advertising and never combine them with other data to identify you.

This matches Restitute’s App Store privacy label: Data Not Linked to You (Usage Data and Purchases). Neither is used to track you.

This website

restitute.app sets no cookies, runs no scripts or analytics, has no forms and loads nothing from other companies. Fonts are served from restitute.app itself. The site is hosted by Vercel, which processes standard technical data such as IP addresses in server logs to deliver the pages and keep them secure; see Vercel’s privacy policy.

If you email us

We use your message and email address only to reply to you, and delete them when they’re no longer needed. You can ask us to delete them at any time.

Children

Restitute is not directed at children.

Your rights

What the app finds stays on your iPhone and in your own backups, and deleting the app removes it from your iPhone. Usage counts and purchase records aren’t linked to you, so we can’t look yours up by name or email. If you have a question about them, or about anything in this policy, write to privacy@restitute.app. If you’re in the EU, EEA or UK, you can always contact your local data protection authority.

Changes

If this policy changes, we’ll update the date at the top. Significant changes will also be mentioned in the app’s release notes.