Privacy Policy
MidRate does not collect personal data. The app has no accounts, no analytics, no advertising, and no tracking of any kind. Its App Store privacy label reads “Data Not Collected”. This page states why that is true, and exactly what the app’s network requests do carry.
No accounts
There is nothing to sign up for. MidRate has no registration, no login, and no cloud sync. We hold no record of who uses the app and could not connect any data to you if we wanted to.
No analytics, no tracking
The app contains no third-party analytics, advertising, or tracking code. It does not read your device’s advertising identifier, does not fingerprint your device, and sends us no usage data. What you convert, which currencies you follow, and how you use the app never leave your device.
What stays on your device
Your preferences (chosen currencies and display settings) and the subscription state the app checks are stored only on your device. They are included in the backups your phone makes; they are never transmitted to us.
What leaves your device
The app fetches currency rates over HTTPS. Like every request on the web, a rate request necessarily shows the answering server an IP address, and it names the currency table being asked for. Beyond that it carries no cookie, no account, and nothing that identifies you personally; the one addition, on premium requests, is the device-integrity proof described below. The app’s requests go to three places:
- The exchange-rate providers we use, directly. Daily rates are fetched straight from those providers’ public endpoints. This is how free features get every rate and premium features get some of theirs. Those providers see the request as any web server does, under their own privacy policies.
- Our own server. Premium features fetch rates from a server we run. We do not log requests there and do not store IP addresses: the service answers from cached rate tables and keeps nothing about who asked.
- Apple. Subscriptions, described below, are handled by Apple through the App Store under Apple’s privacy policy, and the device-integrity check described below is verified through the platform as well.
Premium requests and device integrity
Requests to our server carry a device-integrity proof: a cryptographic assertion, produced by a check built into iOS, that the request comes from an unmodified copy of MidRate on a genuine device. It exists to keep abusive traffic off our rate service, and it proves only what it says: the app is genuine. It carries no purchase information and no identity we can read. No name, no account, no payment details.
Subscriptions
MidRate Premium is bought through Apple. Apple processes the payment, runs the free trial, and manages renewal and cancellation. We never see your payment details, your name, or your Apple ID. Your purchase is a matter between you and Apple; the app verifies it on the device, and that state never leaves the device except as the device-integrity proof above.
This website
midrate.app is a static site and sets no cookies. Its traffic is measured by our hosting provider’s privacy-preserving page-view count, which the provider injects into these pages: a cookieless count that does not follow you across sites and shows us only aggregate numbers. The site and our server are delivered through that provider, which processes requests in transit under its own privacy policy. The app is unaffected: as stated above, it carries no analytics at all.
The contact form sends what you type into it, the topic, your email address, your name if you give one, and your message, to us by email. Neither the site nor the form stores any of it; the message lives in our mailbox so that we can reply. A spam check from our hosting provider runs on the contact page. It does not read or store what you type, and it sets no cookies on this site.
Your rights
Privacy laws such as the GDPR and the CCPA give you rights over the personal data an organization holds about you. We hold none about the people who use the app, so there is nothing of that kind for us to disclose, export, correct, or delete. The one exception is a message you choose to send us: we keep it, with the address you wrote from, only so that we can reply, and we delete it when you ask. For that, or any question about this policy, use the contact form and a person will answer.
Children
MidRate is not directed at children, and because it collects no personal data from anyone, it collects none from children either. If you believe a child has sent us personal data through the contact form, tell us through the same form and we will delete it.
Changes
If a future version of MidRate ever collects more than this page describes, for instance by adding a software component that collects anything, this policy and the app’s App Store privacy label will change together, before that version ships. The dates above mark the policy’s first version and its last revision.
Contact
Use the contact form. A person reads every message and replies by email.