Privacy policy

LimitTracker for iOS, iPadOS and macOS · Version 1.0 · Effective 6 November 2026 · Deutsche Fassung

1. Controller

The provider of the app and the party responsible for this policy is:

Vortex Labs
Tayfun Ilker
Welserstraße 3
87463 Dietmannsried
Germany
Email: hello@vortex-labs.de

Because the app does not transmit personal data to us, we do not hold personal data about app users on our own systems. Where this policy describes processing, it is processing that takes place locally on your device under your control, or processing by Apple or by the services you choose to connect.

2. Scope

This policy covers the LimitTracker app (bundle identifier de.vortexlabs.limittracker) including its widget extension, as distributed through the Apple App Store for iPhone and iPad (iOS and iPadOS 18 or later) and for Mac (macOS 15 or later), and this website. It does not cover the websites, APIs and apps of the third-party services you connect. Their own privacy policies apply to them.

3. Data on your device

The app saves the following data locally. None of it is sent to us.

The usage data can reveal how heavily you use certain AI services. We treat it accordingly: it is not shared with anyone and not used for anything other than showing it to you.

Backups. Files in the app's Application Support folder and the preferences may be part of device backups you create with iCloud Backup or on a computer, depending on your settings. Keychain items marked “this device only” cannot be restored onto another device.

4. Connections to services

The app has one network function: reading your usage from the services you add. The requests go directly from your device to the service; no proxy or server of ours is involved. Each request carries the credential you provided and an ordinary browser-style User-Agent text. Like any internet request, it also reveals your IP address to the service.

Depending on the accounts you add, the app contacts these hosts:

The app only contacts a host if you have added an account for that service. These services are independent controllers. They process the request, your IP address and your account data under their own privacy policies, which you accepted when you created your account there. Some of them may be located outside the European Economic Area, in particular in the United States and China.

The app's network session is ephemeral: it keeps no cookies, cache or cookie storage between requests. Responses are processed in memory and only the values listed in section 3 are saved.

5. Sign-in with the browser

For Claude, ChatGPT / Codex and Cursor you can sign in inside the app instead of pasting a cookie. The app then opens the service's own login page in an embedded web view (Apple's WebKit).

• The web view uses a non-persistent data store. Nothing from this browsing session, such as cookies, cache or form data, is kept after the sheet is closed.
• You enter your password, passkey or one-time code only on the service's page. The app and we never see them.
• The app looks for a single, specific session cookie of that service (sessionKey, __Secure-next-auth.session-token or WorkosCursorSessionToken), copies its value into the Keychain and ignores everything else.
• Because that cookie works like a login, treat the device it lives on accordingly. Signing out on the service's website or revoking sessions there invalidates it.

6. Notifications, widgets and background refresh

Notifications

If you enable alerts, the app asks for permission through the system. Notifications are generated locally on your device when a limit crosses your threshold or has reset. LimitTracker does not use Apple Push Notification service and has no push token. You can switch alerts off in the app or in System Settings.

Widgets

The widget extension only reads the latest usage snapshot from the shared Keychain group. It makes no network requests of its own and does not have access to your credentials.

Background refresh (iOS, iPadOS)

With your system's Background App Refresh enabled, the app may refresh usage in the background at times chosen by the system. This follows the same rules as a manual refresh (section 4). You can turn it off in System Settings. On the Mac the app refreshes at the interval you set while it is running.

Permissions the app does not request

LimitTracker does not request access to your contacts, photos, camera, microphone, location, health data, tracking (App Tracking Transparency) or the advertising identifier.

7. Tips (in-app purchases)

The app is free and has no locked features. You may leave an optional tip, offered as consumable in-app purchases through the App Store (product identifiers de.vortexlabs.limittracker.tip.coffee, .cake, .meal and .feast).

• The purchase is processed entirely by Apple using your Apple Account and payment method. We do not receive your name, payment data or Apple Account details.
• The app uses StoreKit on your device to load the products and to check your own purchase history. If a tip appears there, the app stores a simple “supporter” flag locally and stops showing support prompts. This also works after a reinstall, because Apple lists consumable purchases in your history.
• As the developer, we can see aggregated sales and, only for users who agreed to share app analytics with developers in their device settings, aggregated usage statistics in App Store Connect. These are provided by Apple and not linked to you.

8. What Apple processes

When you use Apple's services around the app, Apple processes data under its own responsibility, for example when you download or update the app, make a purchase, use TestFlight, enable iCloud Backup, or share diagnostics and analytics from your device. We do not control this processing. See Apple's Privacy Policy and, for sharing diagnostics with developers, Settings › Privacy & Security › Analytics & Improvements on your device.

9. What we do not do

• We do not collect, store, sell or share personal data from the app.
• We do not use analytics, crash-reporting, advertising or attribution services, and the app contains no third-party libraries.
• We do not track you across apps or websites and do not build profiles.
• We do not use your usage data or credentials for any purpose other than showing you your own numbers.
• We do not make automated decisions that affect you.

10. Storage, security and deletion

Security. The app uses the Apple platform's protections: Keychain with data protection, file protection, App Sandbox and Hardened Runtime on the Mac, and encrypted connections (HTTPS) to all services. No system is perfectly secure, so keep your device updated, protected by a passcode and, on the Mac, by FileVault.

Retention. History is deleted automatically after 90 days. Everything else stays until you remove it.

Deleting data.

• Remove an account in the app: this deletes its credential from the Keychain together with its history and usage snapshot.
• Delete history in the app's History view removes all stored history points.
• Delete the app: removes its files and preferences. Because iOS may leave Keychain items behind after an app is deleted, please remove your accounts in the app before deleting it. If you already deleted it, reinstalling and removing the accounts clears them.
• You can revoke access at the service itself at any time (see section 4).

11. This website

This website is a static site. It sets no cookies, uses no analytics, tracking pixels or social-media plugins, and loads no external fonts, scripts or images; everything is served from the same host.

It is served as static files by Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) on the Cloudflare Workers platform. When you open a page, your browser transmits technical data such as your IP address, the requested page, date and time, and browser information to the hosting provider, which processes it to deliver the page and to keep the service secure and may record it in server logs. We do not combine these logs with other data and cannot identify you from them. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Cloudflare may process data in the United States and other countries; see Cloudflare's Privacy Policy.

If you write to us by email, we process your address and message to answer you (Art. 6(1)(b) or (f) GDPR) and delete them once the matter is closed, unless we are legally required to keep them.

12. Legal bases

To the extent data protection law applies to processing by us:

• Local features that you request, such as showing your usage and sending alerts you enabled, are performed on your device to provide the app you chose to use (Art. 6(1)(b) GDPR). Alerts additionally rest on the system permission you grant (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Website hosting and email correspondence: Art. 6(1)(f) GDPR, as set out in section 11.

13. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), and the right to withdraw consent with effect for the future (Art. 7(3)). Because we hold no personal data about app users, we can usually only confirm that. Most of what you may want to do, such as viewing or deleting your data, you can do directly in the app (section 10). To exercise your rights against us, write to hello@vortex-labs.de. Rights against the services you connect or against Apple must be asserted with them.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, workplace or the place of the alleged infringement. The authority competent for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

Residents of California and other regions with comparable laws: we do not sell or share personal information and do not collect any from the app.

14. Children

LimitTracker is a utility for people who use AI subscriptions and APIs. It is not directed at children, and we do not knowingly collect any data from them.

15. Changes

If the app or the law changes, we will update this policy. The version in effect is the one published at this address, and the date above shows when it took effect. If a change means that we start to collect personal data, we will state it here and in the App Store privacy details before it takes effect.

16. Contact

Questions about privacy: hello@vortex-labs.de