Who we are

Tenny Subscription Tracker (“Tenny” or the “App”) is developed and operated by BabylonByte LLC (“BabylonByte”, “we”, “us”, or “our”), a limited liability company in the United States.

For the personal information described in this Privacy Policy (the “Policy”), BabylonByte is the controller (the “business”, under California law), except where we say that Apple or another provider acts on its own behalf. You can reach us at our email address (it appears here once the page has loaded).

Scope of this Policy

This Policy applies to Tenny for iPhone, iPad, Mac, and Apple Watch, including its widgets, Live Activities, and controls, and to our website at usetenny.app, including the browser demo at usetenny.app/try.

It does not apply to Apple’s services (such as the App Store, iCloud, and Apple Intelligence), to the subscription services you track, or to other websites you reach through links. Their own terms and privacy policies govern them.

What Tenny does not do

No account. Tenny does not require you to create an account with us.
No advertising. Tenny does not show ads, and we will never show ads in Tenny. We do not use your information for targeted advertising.
No sale of personal information. We do not sell personal information or “share” it for cross-context behavioral advertising, as those terms are defined under California law.
No tracking. Tenny does not track you across other companies’ apps or websites and contains no third-party analytics, advertising, or crash-reporting software development kits.
No bank or inbox access. Tenny currently does not connect to bank or card accounts and does not access your email inbox. You add subscriptions yourself or import text and files you choose.

Tenny has no analytics SDK. External icon providers retain technical request data, and Brandfetch uses queried brands to analyze demand and improve coverage, as described under Service icons below. If we introduce a feature that collects new kinds of information, such as bank connections or inbox access, we will update this Policy before that feature is released and explain what it collects and the choices you have.

Information Tenny processes

Subscription records you enter

Tenny stores the subscription details you enter, import, or approve: for example names, prices, currencies, billing cycles, dates, categories, status, notes, and icons, together with record identifiers, timestamps, and revision history. Tenny also keeps your settings, reminder preferences, check-in information, and local feature counters used to make features work, not for analytics. On iPhone and iPad, device motion may be read locally to animate backgrounds; it is not stored or uploaded.

Starting with Tenny 1.0.10, optional subscription details include Personal or Business space, a payment-method nickname, the last four digits, and an expiry month and year. Tenny also stores payment status, amounts, dates, notes and corrections, and savings actions, amounts and periods you record. These records are stored on your device using Apple’s SwiftData framework and can sync through your private iCloud database. Personal backups include subscription metadata and payment and savings history. Subscription metadata can appear in local revision history. They are not sent to BabylonByte.

Private iCloud sync (Apple CloudKit)

When iCloud is available, Tenny syncs your subscription, payment and savings records through your private Apple CloudKit database under your Apple Account, so they appear on your other devices. Sync is on by default. You can turn it off for a device in Settings, then Sync & Backup; the change applies after Tenny restarts. Turning sync off does not delete records already stored in iCloud. Your private database is controlled by Apple and accessible to you; BabylonByte cannot access it.

Apple Watch receives a snapshot of your subscriptions (names, amounts, currency, billing cycle, dates, status, category, accent colour, and small icon images) directly from your paired iPhone. The Watch app makes no network requests.

Community Pricing

Community Pricing shows what other people pay for the same plan. Starting with Tenny 1.0.10, Share my prices is off until you turn it on in Settings, then Community Pricing. When updating from the earlier sharing setting, Tenny turns sharing off and queues exclusion of known contributions until you choose to enable sharing again. After that migration completes, later explicit choices are kept. Earlier releases may have sharing on by default; check the setting on each device. You can see community estimates whether or not you share.

While sharing is on, when you save an active or trial subscription with a price above zero for a service in Tenny’s built-in catalog, Tenny writes a contribution to a public Apple CloudKit database. A contribution contains only:

a catalog service identifier and, when recognized, a plan identifier and normalized plan name;
the price in minor currency units (such as cents) and its currency;
the billing interval and interval count;
a country or region code taken from your device’s region setting, when available (not your location);
purchase-channel, price-type, and verification categories (currently always “unknown” channel and “user-entered”); and
when the price was first observed and last confirmed, and the contribution’s status.

A contribution does not contain your name, email address, notes, renewal dates, payment details, device identifiers, the identifier of your private record, or your list of subscriptions.

Contributions are not anonymous. CloudKit attaches the creator’s user record identifier to every public record as system metadata. This identifier is specific to Tenny’s iCloud container and does not include your name or email address, but it is linked to your Apple Account. Tenny also names each contribution with a one-way hash (SHA-256) of that identifier and the price group, so your contributions for the same plan replace one another and can be linked to each other.

Other Tenny installations download individual contributions from the public database to calculate estimates on the device. Tenny displays an estimate only when at least three qualifying contributions exist in a similar-price group (one per account and group), gives older reports less weight, can exclude outliers, and ignores contributions last confirmed more than 548 days ago. Estimates are suggestions, not verified prices.

When you turn sharing off on a device, delete a subscription, or delete all data, Tenny marks the related contributions it knows about as excluded, retrying if the network or CloudKit is unavailable. Exclusion removes a contribution from estimates but does not erase the public record or its CloudKit metadata. Uninstalling Tenny does not send an exclusion.

The upcoming Tenny 1.0.10 release adds Delete shared prices in Settings, then Community Pricing, or Settings, then Privacy on Mac. Earlier releases do not have this control. It turns sharing off on that device and deletes public Community Pricing contributions created by your current Apple Account, including excluded and older contributions, from both Tenny’s current and earlier public CloudKit databases. It preserves your private subscription records and other private iCloud data.

If deletion cannot finish, Tenny keeps the request pending and lets you retry. If Tenny cannot identify the account, retry explicitly after signing in. Once identified, the request requires the original account. Turn sharing off on your other devices too. Another device with sharing on, or enabling sharing again later, can upload new contributions.

On-device intelligence, dictation, and imports

Smart Add, saved-email extraction, and Ask Tenny use Apple’s on-device Foundation Models on supported devices with Apple Intelligence turned on; Smart Add and Ask Tenny can also use local rules. Ask Tenny answers from your own subscriptions on your device, and the only action it can take is scheduling a local reminder for you; you can turn it off in Settings with Show Tenny assistant. Dictation uses Apple’s on-device speech recognizer and never falls back to server-based recognition; Tenny does not save recordings. Screenshot import recognizes text on the device. None of this text, audio, or imagery is sent to BabylonByte or to a cloud model.

When you paste text or choose saved email files (such as .eml or .mbox) to import, Tenny reads them on your device to find subscriptions; nothing is uploaded. The email extractor does not open attachments, links, or remote images.

In Tenny 1.0.10, statement review stores approved normalized merchant and currency pairs with the subscription to recognize later imports, including after a rename. Those pairs can sync privately and appear in backups and revision history. The pairs do not contain the statement file, source filename or transaction rows. Statement Add and Merge do not contribute community prices. Original files you keep outside Tenny are not deleted.

Calendar renewal copies

Starting with Tenny 1.0.10, optional Calendar sync is off by default. If you enable it and grant Calendar access, Tenny writes the subscription name, formatted amount, renewal day and a link to the subscription into the writable calendar you choose. That calendar may sync through its provider or be shared with other people, according to its settings. These copies are separate from Tenny’s private iCloud records.

Turning Calendar sync off attempts to remove Tenny-managed upcoming events when access is available. Past renewal events can remain as history, and removal can fail if permission or connectivity is unavailable. Revoking Calendar permission stops Tenny from updating or removing events until access is restored. You can manage retained copies in Calendar.

Service icons (Brandfetch and Logo.dev)

Tenny includes icons for many services. When it does not have one, it may request one from Brandfetch or Logo.dev, for example after you save or rename a subscription, while you type the name of a known service, or when you open the icon picker. The request contains a website domain chosen from Tenny’s catalog or derived from the subscription name (for a name Tenny doesn’t recognize, typically the name followed by “.com”, so a request can reveal part of a name you entered), image and appearance parameters, and an app-level key that identifies Tenny, not you. Prices, dates, notes, and website addresses you type are not sent. There is currently no setting to turn icon lookups off.

Brandfetch and Logo.dev retain technical request data, including IP addresses, queried domains and timestamps, for service operation, security and metering. Brandfetch operational logs may include User-Agent and remain for up to 90 days. Brandfetch also uses queried brands to analyze demand and prioritize coverage and curation. See Brandfetch security, Brandfetch ordinary query use and Logo.dev privacy.

Exchange rates (Frankfurter)

To convert currencies, Tenny requests the latest euro reference rates from Frankfurter (api.frankfurter.dev) when the App starts and its saved rates are more than a day old. The request contains no information about you or your subscriptions; conversion happens on your device.

Purchases (Tenny Pro)

Tenny Pro is a one-time in-app purchase made through the App Store using Apple’s StoreKit. Apple processes the Pro purchase payment; Tenny does not receive the full card number or security code used for that purchase. Optional payment-method tracking details you enter in Tenny are stored as described above. Tenny verifies the signed transaction information Apple provides on your device to unlock Pro, including through Family Sharing. Apple provides us with sales and download reports that do not identify you. Optional public Community Pricing contributions, described above, are the app functionality covered by the “Purchase History” data type in Tenny’s App Store privacy label.

Notifications, widgets, Live Activities, and controls

Renewal reminders are local notifications scheduled on your device; Tenny does not use push notifications or a server. Depending on your settings, a reminder can show a subscription’s name, price, or renewal date, including on the Lock Screen.

On iPhone and iPad, Tenny widgets can show your monthly total and the names, amounts, and dates of upcoming renewals. To supply them, the App writes a small summary and icon images to an on-device container shared only with its own widget extension, which makes no network requests. Renewal Live Activities are off by default; when on, they show a subscription’s name and amount only if Show Names & Prices is also on. Live Activities run on your device without a server. Widgets and Live Activities can be visible on the Lock Screen to anyone who can see your device. The Add Subscription and Ask Tenny controls only open the App.

Diagnostics shared through Apple

If you have chosen in your device settings to share analytics with app developers, Apple may provide us with crash reports and aggregated usage statistics for Tenny under Apple’s terms. These do not identify you to us, and we use them only to find and fix problems.

Messages you send us

If you contact us, we receive your email address, your message, and anything you choose to include. We use them to respond and to improve Tenny. Please don’t send passwords or payment details.

Our website and the browser demo

usetenny.app has no analytics or advertising, and its own code sets no cookies. Your appearance choice (Light, Dark, or Auto) and anything you enter in the browser demo are kept in your browser’s local storage and are not sent to us; you can clear them in your browser at any time. The demo uses sample data and makes no network requests of its own. Like any website, our hosting and content-delivery provider processes technical information such as your IP address, browser type, and the pages requested, in order to deliver the site and protect it from abuse.

How we use information

We use the information described above only to:

provide Tenny’s features you choose to use, including sync, reminders, widgets, icons, currency conversion, and Tenny Pro;
calculate and show Community Pricing estimates;
respond to your questions and requests;
keep Tenny and our website secure and working, and fix problems; and
comply with law and protect our rights.

We do not use your information for advertising, and we do not build profiles of you.

Legal bases (EEA, UK, and Switzerland)

Where the EU or UK General Data Protection Regulation or similar laws apply, we rely on the following legal bases:

Performance of a contract: To provide the App and the features you use, such as private sync, icons, exchange rates, reminders, and Tenny Pro.
Legitimate interests: To offer accurate Community Pricing estimates, to keep our services secure and working, and to answer messages you send us. You can object at any time; turning off Share my prices stops new contributions from that device.
Consent: Where the law requires consent, for example for device permissions such as notifications, microphone, and speech recognition, which you grant and can withdraw in your device settings. Withdrawing consent does not affect processing before withdrawal.
Legal obligations: Where we must keep or disclose information to comply with law.

Retention

Your subscription records stay on your device, and in your private iCloud database if sync is on, until you delete them or delete all data in Settings. Deleting Tenny removes its data from that device. Copies in exports, backups, and files you keep are under your control.

Community Pricing contributions have no automatic deletion schedule. Excluded and superseded contributions can remain in the public database. The Delete shared prices control planned for Tenny 1.0.10 removes your contributions, including excluded and older contributions, as described under Community Pricing. The 548-day rule above limits which contributions are used in estimates; it is not a deletion deadline.

We keep support emails for as long as needed to help you and for our records, and then delete them. Providers such as Apple and our hosting provider retain information under their own policies.

International transfers

BabylonByte is based in the United States. Apple and the other providers described above may process information in the United States and other countries whose data protection laws may differ from those where you live. Where the law requires it, transfers of personal information from the EEA, the UK, or Switzerland rely on appropriate safeguards, such as adequacy decisions or standard contractual clauses.

Security

Tenny relies on Apple’s platform protections, including app sandboxing, data protection on iPhone and iPad, and CloudKit access controls, and uses encrypted HTTPS connections for the requests described above. On Mac, disk encryption depends on your settings, such as FileVault. Tenny does not add a separate encryption layer to subscription records.

No method of storage or transmission is completely secure. Public Community Pricing contributions do not have the protections of your private database. Please protect your device, your Apple Account, and any files you export.

Children

Tenny is a general-audience app for managing subscriptions and is not directed to children under 13 (or the minimum age in your country). It does not ask for a date of birth or verify age, and we do not knowingly collect personal information from children. If you believe a child has provided information that should be removed, contact us.

Your choices and rights

Choices in the App

View, edit, and delete subscriptions; export them as CSV; or delete all data in Settings, then Reset.
Turn private iCloud sync off for a device in Settings, then Sync & Backup.
Turn Community Pricing sharing off in Settings, then Community Pricing, on each device.
In the upcoming Tenny 1.0.10 release, use Delete shared prices in Settings, then Community Pricing, or Settings, then Privacy on Mac, to erase your public contributions.
Change notification, Live Activity, microphone, and speech-recognition permissions in your device settings, and remove widgets at any time.

EEA, UK, and Switzerland

You have the right to access your personal information, to correct it, to have it erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

California and other US states

If you live in California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use, and disclose; to access and obtain a copy of it; to correct it; and to delete it; and you will not be discriminated against for exercising these rights. In the past 12 months, the categories of personal information processed in connection with Tenny were: identifiers (such as the CloudKit identifier linked to Community Pricing contributions, IP addresses received by service providers, and the email address of anyone who wrote to us); commercial information (community price contributions and subscription-brand lookup requests); and the content of messages you send us. We collected them from you, your device, and Apple, for the purposes in How we use information, and disclosed them only as described in How information is shared. We do not sell or share personal information for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes that require a right to limit.

How to exercise your rights

Most of your information is under your control in the App and in your Apple Account; requests about Apple’s own processing, including your private iCloud data, should also go to Apple. To erase public Community Pricing contributions, use the Delete shared prices control planned for Tenny 1.0.10, described above. For help or other privacy requests, email us at our email address (it appears here once the page has loaded). You may use an authorized agent where the law allows.

We cannot verify ownership of Community Pricing contributions from an email address or copied public record identifiers. The in-app deletion control uses your signed-in Apple Account. We do not ask you to email passwords, verification codes, tokens, payment details, or CloudKit record identifiers. We respond within the time the law requires, generally within one month (45 days in California).

Changes to this Policy

We will update this Policy when Tenny’s practices change, and before releasing any feature that collects new kinds of information. We will post the updated Policy here and in the App with a new “Last updated” date, and for material changes we will give additional notice, for example in the App or in release notes.

Contact

BabylonByte LLC, United States. Email: our email address (it appears here once the page has loaded). For help with the App, see Tenny Support.

Your use of the App is governed by Apple’s Standard EULA. Tenny doesn’t have a license agreement of its own. Like many apps, it uses Apple’s standard one, the Licensed Application End User License Agreement, which applies to App Store apps without a custom agreement.