UnSurveil exists to fight surveillance pricing, so it is built to need as little of your data as possible. This policy is written to be read rather than skimmed past: it says exactly what leaves your phone, exactly who receives it, and exactly which parts are optional. Where something is sent to another company, that company is named.
Everything below sits in one of two places, and we never join them together.
| The anonymous side | Price checks, the watchlist, community quotes, and product analytics. These travel under a random install identifier that is generated on your device and is not derived from any hardware, Apple, or advertising identifier. No name, no email, no account. |
| The account side | Optional. If you sign in, we hold an account identifier, an email address, and a display name so your history can follow you to a new device. |
The rule we hold ourselves to is that the account is never attached to an analytics event, a community quote, or a price check. The moment those were joined, the anonymous side would stop being anonymous.
When you first open the app it generates a random identifier (a UUID) and stores it on your device, in the app's private app group so the app and its share extension count as one install. It is not your name, email, Apple ID, phone number, advertising identifier, or any hardware identifier, and deleting and reinstalling the app produces a brand new one.
We use it to measure anonymous, aggregate product analytics, and to count each person only once in community quote statistics. It is not joined to an account on our servers.
UnSurveil can read a price out of a screenshot. Doing that means sending the image off your phone: there is no way to read a picture without it going somewhere. The reading is done by a third-party AI vision service — OpenAI or Google (Gemini).
Because that is a transfer of your data to a third party, the app asks first. Screenshot scanning is off until you turn it on, the request explains what is being sent before you answer, and you can switch it back off at any time under You → Privacy → Screenshot scanning. Declining costs you nothing else in the app: pasting a link, sharing a page from another app, and typing a quote in by hand all work exactly the same either way.
What we do on our side:
One correction to an easy assumption: if a screenshot has a street address in it, that address is inside the image, so it goes to the vision service along with everything else in the frame. It is only the separately typed address in a quote form that never leaves your phone (see section 6).
An account is not required. Every feature except cross-device sync works signed out. If you do choose to sign in, here is precisely what exists:
| Sign in with Apple | Apple hands us an account identifier, an email address, and — if you allow it — your name. The email may be one of Apple's private relay addresses, which forwards to you without revealing your real address. |
| Email sign-in | You give us the email address itself. Passwords are handled by Google Firebase Authentication; we never see or store one. |
| Display name | Editable in the app under You. A name can exist here even if Apple never gave us one. |
| What syncs | Your price-check history and watchlist, so a new device picks up where the old one left off. |
Account data lives in Google Firebase and is stored under your account identifier. It is never attached to an analytics event or a community quote.
Deleting your account is available in the app under You. It removes your account from Firebase Authentication, deletes the synced copy of your history and watchlist from our servers, and erases the local copy on the device you did it from.
There are two different kinds, and they work differently enough to be worth separating.
When a watched item reaches your target, the alert you see is a local notification posted by the app on your phone. The decision to fire it is made on the device, not by a server pushing you a message.
The app also supports notifications we send — service announcements and similar. That requires a push token: an identifier for this installation on this device, issued by Apple and handled through Google Firebase Cloud Messaging. When you turn notifications on, this token is registered with Firebase and, if you are signed in, stored on our backend under your account so we can reach you. Turning notifications off in the app removes this device from our broadcast list; turning them off in iOS Settings stops delivery outright.
Two separate things send your watched items to our servers, and neither is the alert:
When you paste a link, share a page to UnSurveil, or scan a screenshot, we fetch a clean baseline price for that product through an anonymous server-side session that carries none of your cookies, none of your account, and no tracking of yours. Fetching that public price uses two data providers, ScraperAPI and SerpApi.
The product link you check, and the product name we search for, are sent to our backend under the anonymous install identifier. We strip campaign and session parameters (utm_*, fbclid, gclid, session_id) from the link before it is sent. What that does not remove is the identity of the page itself, which is the thing we need in order to price it — so rather than argue that away, we declare it.
From the checks our server receives, we also keep aggregate tallies of which stores and products are checked most, so the most-requested stores get supported first. These tallies are pure counts — a store name, a product page's public name and link, and a number — with no install identifier, account, or anything else attached to them.
For services with no public list price — rides, delivery, hotels, flights — you can voluntarily log a price you were quoted. Submitting a quote is the consent to share that one number. Nothing is shared unless you submit it. What is stored is deliberately coarse:
| We store | the service (for example "Uber"), the price you were quoted, the time of day and the weekday, an optional tier, room, or fare label, and a coarse location — the first 3 digits of a ZIP code only. |
| We never store | your full ZIP code, your pickup or drop-off addresses, your account, your payment details, or the screenshot itself. |
Stated precisely, because the distinction matters: when you submit a quote, the full five-digit ZIP is transmitted to our server, and the server truncates it to its first three digits before anything is written to storage. What is retained is never more than three digits. For a ride quote it is a pair of three-digit prefixes, pickup and drop-off, which together describe a general direction rather than a route.
If you type a street address into a quote form, your device converts it to a ZIP code locally, using Apple's on-device geocoder, and then discards the address — that typed address never reaches our servers. This is not true of an address that is visible inside a screenshot you choose to scan; see section 2.
There is a setting called "Count me in." It is off unless you turn it on. With it on, each time a price check finds a gap between the price you were shown and the clean baseline, an anonymized record is contributed: a one-way hash of the product link (not the link itself), the retailer, the two prices, the size of the gap, and a timestamp. No name, email, account, device identifier, or precise location is attached, and the record carries only the anonymous install identifier.
We are telling you the business use of this rather than leaving it implied: these anonymized records are pooled into an aggregate market-intelligence dataset about surveillance pricing, which we may publish, license, or sell in aggregate form. This is why the setting exists and why it is opt-in. It is also why we can say without hedging that we do not sell your personal information — what is in this dataset carries nothing that identifies you, and we do not sell what does.
You can turn it off at any time under You → Privacy. Turning it off stops all future contributions.
We record first-party, anonymous events — installs, opens, and how far you get in checking or logging a price — against the random install identifier in section 1. These go to our own backend. There is no third-party analytics SDK and no cross-app tracking.
If the app crashes or hits a handled error, a diagnostic report may be sent to Google Firebase Crashlytics so we can fix it. These reports contain the technical state of the app at the moment of failure — the type of device, the iOS version, and where in the code it failed. We do not attach your name, email, or account to them.
Free users may see ads served by Google AdMob. UnSurveil does not ask for tracking permission and does not access Apple's advertising identifier, so you will not see an App Tracking Transparency prompt from us and ads are not personalized using cross-app data about you. Google's handling of ad requests is governed by Google's Privacy Policy. Pro subscribers see no ads at all.
UnSurveil Pro is processed by Apple through the App Store. We never see your card details. The app learns your subscription status from Apple in order to unlock Pro features. We separately record anonymous events for the subscription funnel — that a purchase was started, completed, cancelled, or failed, and which plan — against the install identifier, never against your account.
Every third party that receives anything is named here. We require each of them, by contract and by their published terms, to provide protection at least equal to what this policy promises, and to process what they receive only to perform the function described.
| Company | What it does | What it receives |
|---|---|---|
| Google Cloud | Hosts our backend | Everything the app sends our servers, as described above |
| Google Firebase | Accounts, database, push delivery, crash diagnostics | Account identifier, email, display name, push token, synced history and watchlist, crash reports |
| OpenAI | Reads a screenshot you chose to scan | The image itself, with no identity attached — only if you turned screenshot scanning on |
| Google (Gemini) | Reads a screenshot you chose to scan | The image itself, with no identity attached — only if you turned screenshot scanning on |
| ScraperAPI | Fetches public retailer prices | The product link or search term being priced — never your account or install identifier |
| SerpApi | Fetches public retailer prices | The product link or search term being priced — never your account or install identifier |
| Apple | Sign in with Apple, subscriptions, push delivery | Governed by Apple's own policy; we receive only what section 3 describes |
| Google AdMob | Serves ads to free users | Standard non-personalized ad-request data; nothing from your account or your price checks |
Screenshots are not retained at all. Anonymous community quotes and price-disparity records are retained indefinitely in aggregate form, because they are what make community medians and typical ranges possible — and because they carry nothing that identifies you, they cannot be traced back to you or removed on request individually. Account data is retained until you delete your account, at which point it is removed as described in section 3.
UnSurveil is not directed to children and is not intended for use by anyone under 13. We do not knowingly collect information from children.
UnSurveil is operated from the United States, and data is processed there and by the providers listed in section 10. Because the anonymous side of the app collects nothing that identifies you, we do not use it to make decisions about you individually.
If our practices change, we will update this page and revise the effective date at the top. If a change means sending your data somewhere new, the app will ask you again rather than relying on this page alone.
Questions about privacy? Email hello@dubmog.com.