Privacy Policy

Last updated: October 21, 2026

This Privacy Policy explains how Diego Pais (“we”, “us”, or “Dribs”) handles information in connection with the Dribs application for iPhone, iPad and Mac (the “App”). We built Dribs to be private by design: your financial data lives on your device and, if you choose, in your own iCloud account, never on our servers.

The short version. Dribs has no accounts to sign up for and no Dribs-operated servers that store your financial data. We don’t sell your data, we don’t use it for advertising, and we don’t track you across apps or websites.

1. Who Is Responsible (Controller)

The controller for the limited processing described in this policy, within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR/DSGVO), is:

Diego Pais
Charlottenburger Str. 140
13086 Berlin, Germany
hello@dribs.app

We are not required to appoint a Data Protection Officer under Art. 37 GDPR or § 38 BDSG. Privacy questions go directly to the address above.

2. Information You Enter

Dribs lets you record financial information such as accounts, ledgers, transactions, balances, categories, and the people you share a ledger with. This content is created and controlled entirely by you.

Stored on your device. By default, the data you enter is stored locally on your device.
Optional iCloud sync. If you enable iCloud sync, your data is synchronized through your own Apple iCloud account using Apple’s CloudKit. We do not operate these servers and cannot read this data. Its handling is governed by Apple’s Privacy Policy.
Optional ledger sharing. If you share a ledger with another person, the shared records are made available to that person through Apple’s CloudKit sharing. Only people you invite can access a shared ledger.

We do not receive, collect, or have access to the financial content you enter. Because this content never reaches us, we do not process it as a controller; it stays under your control on your device and in your Apple account.

3. Information Collected Automatically

To keep the App stable, we collect limited diagnostic information. This is consistent with the privacy information published on our App Store listing.

Data	Purpose	Linked to you?	Used to track you?
Crash data	App functionality & stability	No	No
Other diagnostic data (e.g. performance)	App functionality & stability	No	No

This diagnostic data is processed on our behalf by Sentry under a data processing agreement, on infrastructure located in the European Union. It is not linked to your identity and is not used to track you. See Sentry’s Privacy Policy.

Crash reporting is on by default, and you can turn it off at any time in the App under Settings → Crash Reports. Reports are scrubbed on your device before they are sent and never include the financial content you enter.

If you contact us by email, we receive your email address and whatever you choose to tell us, so that we can answer you.

If you buy a subscription or other paid feature, Apple tells the App whether a purchase is active. We receive aggregated sales and payout reporting from Apple; we do not receive your name, address, or payment details.

Exchange rates and release notes

To fetch exchange rates and the “What’s New” notes for each release, the App connects to our own server at api.dribs.app, which runs on Cloudflare (see Section 6). The requests contain only what is needed to answer them, such as the dates the App needs rates for, and never the financial content you enter. As with any request over the internet, your IP address is transmitted. Our server uses it only while handling the request, to limit how often security challenges can be requested, and does not store or log it. Our server keeps no request logs.

Before it fetches rates, the App proves to our server that it is a genuine copy of Dribs using Apple’s App Attest, with a random key that identifies neither you nor your device. On Mac, where App Attest is not available, it uses Apple’s DeviceCheck instead: alongside a random key of the same kind, the App sends a one-time token from Apple, which our server passes back to Apple to confirm and does not store.

4. What We Don’t Collect

No bank connections. Dribs does not link to your bank and never sees banking credentials.
No location data. No GPS, no location services.
No contacts, photos, or documents.
No advertising or attribution SDKs. No ad identifiers, no cross-app tracking, no profiling.
No account. There is nothing to sign up for, so we hold no user accounts or profiles.

5. Legal Bases for Processing

Where we process personal data, we rely on the following legal bases under Art. 6(1) GDPR:

Processing	Legal basis
Crash and diagnostic data, to keep the App stable and secure	Legitimate interest, Art. 6(1)(f): our interest in a working, reliable App (see also Recital 49). You may object at any time under Art. 21, most easily by turning off crash reports in the App’s settings.
IP addresses of requests to api.dribs.app, used only while the request is handled	Performance of a contract, Art. 6(1)(b), to provide the exchange rates you use; and legitimate interest, Art. 6(1)(f), in protecting our server from abuse
Providing paid features you have purchased	Performance of a contract, Art. 6(1)(b)
Answering your support emails	Performance of a contract or our legitimate interest in responding, Art. 6(1)(b) and (f)
Retaining records where tax or commercial law requires it	Legal obligation, Art. 6(1)(c)

The financial content you enter is not covered by this table because we never receive it, as explained in Section 2.

6. Third-Party Services

Cloudflare

Our server at api.dribs.app and this website run on Cloudflare, which processes the data described in Section 3 and Section 15 on our behalf as our processor under Art. 28 GDPR. See Cloudflare’s Privacy Policy.

Exchange-rate data

Our server obtains exchange rates from ExchangeRate-API (exchangerate-api.com). The App never contacts ExchangeRate-API itself: the requests come from our server, so ExchangeRate-API does not receive your IP address or anything else about you.

Apple

Sync and sharing rely on Apple iCloud, and App Attest and DeviceCheck are Apple services. Data handled by Apple is subject to Apple’s Privacy Policy.

Sentry

Sentry provides crash and diagnostic reporting as our processor under Art. 28 GDPR, on EU-based infrastructure.

7. Face ID and Device Security

Dribs has no lock of its own. You can lock it with Face ID (or your device passcode) through iOS: touch and hold the app icon on the Home Screen and choose Require Face ID. Biometric authentication is handled entirely by Apple’s operating system on your device; your biometric data never leaves your device and is never accessible to us.

On Mac, Dribs has no lock either. It is protected by your Mac’s login password and screen lock.

8. How We Use Information

We use the limited information described above only to:

Provide and operate the App’s features, including any paid features;
Diagnose crashes and improve stability and performance;
Respond to you when you contact us.

We do not use your information for advertising, profiling, or cross-app/website tracking, and we do not sell or rent it. We do not make automated decisions producing legal or similarly significant effects within the meaning of Art. 22 GDPR.

9. Data Retention and Deletion

Because your financial data is stored on your device and in your iCloud account, you remain in control of it. You can delete it at any time by deleting records within the App, removing the App, or managing the Dribs data in your iCloud settings.

Data	Kept for	Stored where
Everything you enter (accounts, ledgers, transactions)	Until you delete it	Your device and, if enabled, your iCloud account
Crash and diagnostic events	Up to 90 days	Sentry, EU region
IP address seen by api.dribs.app	Only while the request is handled; never logged	Not stored
Support emails	Until your request is resolved, and up to 12 months afterwards	Our mailbox
Records subject to statutory retention	As required by German tax and commercial law	Our records

10. Security

Your data is protected primarily by your own device and Apple account security: device encryption, your passcode, Face ID or Mac login password, and the protections Apple applies to iCloud. Because we operate no servers holding your financial data, there is no central store of it to breach. Data transmitted by the App is sent over encrypted connections. Keeping your device and Apple Account secure, and your device software up to date, remains an important part of protecting your data.

11. Children’s Privacy

Dribs is intended for users aged 16 and over, and we do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Your Rights

If you are in the European Economic Area, the GDPR gives you the following rights over personal data we hold about you. Because we do not hold your financial content and the diagnostic data we receive is not linked to your identity, most of your data is already under your direct control, but these rights apply to anything we do hold, such as support correspondence.

Access (Art. 15). Ask what personal data we hold about you and receive a copy.
Rectification (Art. 16). Have inaccurate or incomplete data corrected.
Erasure (Art. 17). Ask us to delete data we no longer need to keep.
Restriction (Art. 18). Ask us to pause processing while a question about it is resolved.
Data portability (Art. 20). Receive data you provided in a structured, machine-readable format.
Objection (Art. 21). Object to processing based on our legitimate interests, including the diagnostic data described in Section 5.
Withdraw consent (Art. 7(3)). Where we ever rely on consent, withdraw it at any time, without affecting processing already carried out.

To exercise any of these, email hello@dribs.app. We will respond within one month, as required by Art. 12(3) GDPR, and there is no charge.

13. Complaints

If you think we have handled your data improperly, we would like the chance to put it right, but you always have the right to complain to a data protection supervisory authority under Art. 77 GDPR. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin, Germany
datenschutz-berlin.de

You may also complain to the supervisory authority in your own country of residence or place of work.

14. International Transfers

We keep processing within the European Union wherever we can: crash and diagnostic data is processed on EU-based infrastructure. Cloudflare handles requests to our server and this website in the data centre closest to you, which may be outside the EEA; its data processing agreement includes Standard Contractual Clauses, and Cloudflare is certified under the EU-U.S. Data Privacy Framework. Where a service provider processes data outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses under Art. 46 GDPR. Data you sync through iCloud is handled by Apple under its own terms and safeguards.

15. Cookies and Our Website

The Dribs website sets no cookies and uses no analytics or tracking scripts. Cloudflare, which hosts it, processes your IP address to deliver the pages and gives us aggregate statistics such as page views, countries and referring sites, without cookies or scripts. The App contains no advertising or attribution SDKs and does not access the advertising identifier.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. If a change materially affects how we handle your data, we will give notice in the App or by other appropriate means before it takes effect.

17. Contact Us

If you have any questions about this Privacy Policy or your data, contact us at:

hello@dribs.app
Diego Pais

Full provider details are set out in our Impressum.

This policy applies to the Dribs app for iPhone, iPad and Mac.