1. Scope and acceptance
These Terms and Conditions ("Terms") govern your download, access to and use of Expiry Pilot, including the iOS/iPadOS and Android apps and any Premium entitlement purchased inside them.
By installing or using Expiry Pilot, or purchasing Premium, you agree to these Terms and the Privacy Policy. If you do not agree, do not purchase Premium and discontinue use of the app.
Where local law requires a parent or legal guardian to authorize a minor's app use or purchase, that authorization is required.
2. Seller and developer
3. Licence and permitted use
Subject to these Terms and applicable store licence terms, you receive a personal, limited, non-exclusive, non-transferable licence to install and use Expiry Pilot on compatible devices associated with your permitted Apple/Google account or family/device arrangement.
You may not reverse engineer, redistribute, sell copies of, remove proprietary notices from, or exploit Expiry Pilot except where applicable law expressly permits an activity that cannot lawfully be restricted.
4. What Expiry Pilot does
Expiry Pilot is an organization and reminder utility for expiration, renewal, cancellation, payment, service, best-before, use-by and other dates. It supports manual entry; profiles/categories; issue/start and related dates; per-item date-format overrides; costs/currencies and recurring-spend summaries; recurrence, auto-renew cancellation warnings and automatic roll-forward of auto-renewing items; renewal or account links; notes/tags; primary photos and private attachments; local reminders with notification actions; editable lifecycle history including completion; Library sorting, bulk actions, Undo after delete and a month calendar; on-device scan suggestions; an optional bring-your-own-API-key AI scan assistant; Share/Add to Calendar handoff and calendar (.ics) export; widgets/quick actions; App Lock; portable cross-platform backup/restore; platform-specific complete/large manual backup formats; optional encrypted cloud backup; and CSV export.
Recurring-spend figures, including the charges projected for the next 30 days, are organizational estimates derived from the values and recurrence information you store. Different currencies are kept separate and Expiry Pilot does not provide exchange-rate conversion, accounting, tax or financial advice.
Expiry Pilot is not a government registry, legal notice service, medical device, insurer, bank, food-safety authority, travel authority, contract-management service or AI provider.
5. Accuracy, deadlines and reminder delivery
You are responsible for entering/reviewing dates accurately and for acting on important deadlines. A reminder may be delayed, suppressed or unavailable because of notification permission, Focus/Do Not Disturb, battery optimization, OS scheduling, device shutdown, system time/time-zone changes, corrupted local data, app removal, platform limits or other causes outside the developer's reasonable control.
Each tracked date can use up to 10 normalized advance reminders plus a same-day final alert. Auto-renewing primary dates can also use a last-chance cancellation warning (Off/1/3/7/14 days; default 7); when that day matches a normal reminder lead, the app upgrades that reminder rather than creating a duplicate. Android can use an exact alarm for the final same-day alert when special access is granted and otherwise relies on its WorkManager fallback. iOS/iPadOS keeps a rolling priority queue of up to 60 future local-notification requests because iOS limits pending requests, and marks the final same-day alert Time Sensitive; whether it breaks through Focus still depends on your iOS settings.
Snoozing a reminder does not change the underlying tracked date. Renew, Postpone, Cancel, Mark done and Reactivate modify item state/date only after user action and record lifecycle history, except for the automatic roll-forward of auto-renewing items described below.
Automatic renewal: for an active item you mark as renewing automatically, the app moves the date to the next cycle once it has passed — using the recurrence you set, or yearly when none is set — and records “Renewed automatically” in its history. This reflects the information you entered; it does not confirm that a provider actually renewed, charged or cancelled anything. Check the provider if a renewal matters, and update or archive the item when a subscription ends.
Undo after delete: a deleted item can be restored with Undo only for a few seconds; after that window, or once the app goes to the background or you start an export, import, restore or backup, the deletion is final.
6. Scanning, date detection and optional AI assistance
Camera/image/PDF scanning first uses on-device OCR, passport and ID-card MRZ parsing and QR/barcode recognition — including conservative GS1 date fields — to rank likely dates and may suggest a title. Detection is probabilistic and can be wrong because of image quality, language, unusual formatting, OCR errors, barcode contents or ambiguous context.
Eligible-barcode product enrichment is separate from expiry detection. When the app recognizes an eligible checksum-valid UPC/EAN/GTIN, Expiry Pilot may automatically look it up and that retail code may be sent to Open Food Facts / Open Products Facts to request product name/category metadata. Arbitrary QR text/URLs and invalid retail codes are not eligible for this lookup, and expiry scanning remains usable when product lookup is unavailable.
The optional AI scan assistant is off by default and is available without Premium. If you enable it, you choose ChatGPT/OpenAI, Claude/Anthropic, Grok/xAI, Gemini/Google, DeepSeek or OpenRouter and provide your own API key. Expiry Pilot may then send up to three downscaled JPEG scan pages (or one live-camera still) plus barcode/QR payloads decoded on-device directly to that provider; OpenRouter passes each scan on to the company that runs the model you chose. A request can be repeated once automatically after a temporary rate limit or service error, and once more without the preset tuning if the provider rejects it; each attempt may count toward your provider usage. AI output can propose item fields, but high-confidence local dates and barcode-database product matches keep priority and conflicting AI dates are shown for separate review. Provider use is subject to your provider account, model availability, usage limits/charges and provider terms/privacy.
The app is designed so neither local nor AI scan analysis auto-saves a candidate. You must review/confirm before creating a tracked item. Local scan inputs are subject to safety limits, including a maximum selected scan file size of 100 MB; for longer PDFs only the first 50 pages are scanned in the reviewed builds. API keys are stored using platform secure storage, are not logged by the app, and are not included in Expiry Pilot backups/exports.
7. Your records, attachments, sharing, exports and backups
You control the content you enter/import. Do not store, upload or share content you do not have the right to possess or process. You are responsible for maintaining independent backups of information whose loss would be serious.
Supporting attachment files are copied into app-private storage and are limited to 25 MB each; primary item photos are normalized separately, with the longest saved side capped at 1200 pixels. The normal cross-platform manual-transfer format is portable JSON v3 and may include records, categories, profiles, reminder lead times, saved locations, lifecycle history, normalized primary item photos and supporting attachment files. Portable embedded binaries are size-bounded and SHA-256 integrity-checked, private device-local paths are not exported, and the backup is fully validated before imported data is committed. Portable JSON has a 128 MB whole-file limit and a 5 MB normalized primary-photo payload ceiling per item; v1 and v2 portable backups remain importable.
A renewal or account link must be an http or https address of up to 2,048 characters. It opens in your browser only when you tap it; the linked website is a third-party service under its own terms, and you are responsible for the links you save.
Android also provides a platform-specific complete ZIP backup whose records/media are stored separately so photos and attachments do not count toward the portable 128 MB aggregate limit; the app's per-media safety limits and free-space checks still apply. Android normally emits portable JSON v3, but bounded grandfathered metadata can require its extended portable JSON v4 contract. iOS/iPadOS Export backup first attempts portable JSON v3 and automatically falls back to its own platform-specific binary v4 .epbackup container if a valid library cannot fit the JSON/Base64 envelope. Android complete ZIP, Android extended portable v4 JSON and iOS binary .epbackup are not represented as a single cross-platform format; a v3-compatible portable JSON backup is the normal Android↔iOS transfer path.
Manual import/restore is additive: unrelated local records are preserved, exact portable duplicates are refreshed, older versions of items whose only later changes on the device were lifecycle actions (renew, postpone, complete, cancel, reactivate) are skipped, a photo already on the device is not replaced by an older one, and genuinely different records remain separate. CSV exports contain a readable export of active and archived items and do not include binary attachments. Calendar (.ics) exports are one-way copies of tracked dates: events imported into a calendar app are not updated or removed by Expiry Pilot afterwards.
Encrypted cloud backup: on iOS/iPadOS, Expiry Pilot uses private iCloud/CloudKit storage; on Android, it uses the hidden appDataFolder of the Google Drive account you connect. The complete backup payload is encrypted on-device with AES-256-GCM before upload and the recovery key is kept in the same cloud account so a replacement device can restore. Copies are retained per device: on Android each installation keeps its three most recent verified copies and the newest copy of up to five other installations, and on iOS/iPadOS the account holds three copies chosen to protect the newest copy, the fullest copy and each other device's newest copy where the three slots allow; in both cases the copy with the most items is protected. Older copies are removed automatically under these rules. Cloud listing metadata can include backup time, item count, encrypted size/checksum, key identifier, device model, app build, platform and a random installation identifier. Because the recovery key is also held by the same cloud provider, no term here represents cloud backup as provider-inaccessible or “zero knowledge.”
Creating a cloud backup, whether Automatic backup or Back up now, requires Premium. Listing, restoring and deleting existing cloud backups remains available without Premium, and restoring a cloud backup is not limited by the free 5-active-item limit. Restore is additive/non-destructive and fully validates/decrypts the backup before applying it. Deleting all cloud backups removes the copies and recovery key and turns automatic backup off without deleting current-device data (on Android, other devices using that Google account also stop automatic backup until you turn it on again on each of them); uninstalling the app alone does not guarantee deletion of cloud copies. Cloud backup is tied to the platform/account used (iCloud on Apple devices, Google Drive on Android).
Share creates a copy of one reminder and hands it to the OS share sheet. Calendar (.ics) export writes a file for one item or all active items to a destination you choose. Add to Calendar creates an event draft: Android uses a calendar insert intent without requesting calendar permission; iOS/iPadOS uses Apple's EventKit system editor so you can review and choose the calendar before saving. Once you choose another app/provider or save an event, that destination controls its copy under its own terms.
System/device backup is distinct from Expiry Pilot cloud backup. iOS app data can participate in Apple device/iCloud backup according to Apple settings. Android Auto Backup/device transfer for the reviewed build is settings-only and does not include the Room database, tracked records, photos/attachments, AI keys/state or Expiry Pilot cloud-backup state. Any user-selected export/share destination may sync files under that provider's terms.
9. Annual Premium subscription
Annual Premium is an auto-renewing one-year subscription. Payment is charged by the platform store. It renews automatically unless cancelled according to the cancellation timing/rules shown by Apple or Google.
Cancellation normally stops future renewal; it does not necessarily end access immediately. Access generally continues through the paid subscription period unless the store revokes/refunds the entitlement or otherwise determines a different effective date.
Manage/cancel the subscription through the purchasing Apple ID/App Store or Google Play account. Expiry Pilot cannot cancel a store subscription on your behalf because billing/account control belongs to the store.
10. Meaning of Lifetime Premium
Lifetime Premium is a non-consumable/one-time entitlement tied to the purchasing store ecosystem/account, subject to store records and these Terms. "Lifetime" means the paid entitlement does not itself have a recurring expiry date while Expiry Pilot and the relevant store entitlement remain available; it does not guarantee that every device, OS version, store, API or application will exist or remain compatible forever.
A legitimate refund, chargeback, revocation, fraud determination or authoritative store change can remove the entitlement.
11. Store billing and product information
iOS/iPadOS purchases are processed through Apple StoreKit/App Store. Android purchases are processed through Google Play Billing. The final localized price, tax, currency, renewal terms and payment method shown by the store control the transaction.
Expiry Pilot receives product/transaction/entitlement information required to present and verify Premium. It does not directly collect your full payment-card details in the app.
12. Restore purchases and cross-platform limitations
Restore Purchases re-checks/synchronizes the purchasing ecosystem for eligible current entitlements. It does not create a new purchase.
Apple and Google purchases are separate. Expiry Pilot has no developer-hosted account/entitlement server that converts an App Store entitlement into a Google Play entitlement or vice versa. A separate qualifying purchase can therefore be required if you use both ecosystems.
Purchase entitlements cannot be transferred to an unrelated store account by copying local app data or a backup file. Refunds, revocations, expirations and other authoritative store-status changes can alter Premium access when the app next reconciles with the store.
Both current apps keep bounded local entitlement state to avoid a false free state while store verification starts. Lifetime ownership can be cached for continuity, while annual cached access is bounded to a 72-hour grace window. A completed successful App Store/Google Play entitlement verification is authoritative and clears stale state when the entitlement is no longer reported.
13. Refunds, withdrawal and consumer rights
Refund eligibility and processing depend on the store, purchaser location, transaction status, reason and mandatory consumer law. App Store transactions follow Apple's refund/Media Services procedures. Google Play transactions follow Google's refund process and policies, which may in some cases direct a purchaser to the developer after an initial store window.
Nothing in these Terms excludes statutory rights concerning defective, unavailable or non-conforming digital content, repair/replacement, price reduction, termination, withdrawal or other remedies that cannot lawfully be waived.
If Premium was paid for but is not recognized, use Restore Purchases while signed into the purchasing store account and then contact support if necessary. Do not send card details, account passwords or purchase tokens.
14. Privacy and permissions
Use of Expiry Pilot is also governed by the Privacy Policy. The reviewed builds are local-first, contain no developer advertising/analytics backend, perform core scanning and recurring-spend calculations on-device, and use external services only for the user-facing paths described in that policy: optional encrypted cloud backup, optional AI-provider requests, eligible product-barcode lookup, store/platform services, user-selected share/export/calendar destinations and renewal links you choose to open.
Refusing or revoking Camera/Notification/device-authentication capability, or turning off Time Sensitive notifications on iOS, can make the related feature unavailable or less prominent while leaving unrelated functionality usable. Cloud backup also depends on access to the relevant iCloud/Google Drive account, and AI assistance depends on the provider/API key you configure. Android Add to Calendar does not request calendar permission; iOS/iPadOS invokes Apple's EventKit editor only when you choose Add to Calendar. Existing files/photos use system pickers rather than broad media/storage access in the reviewed builds.
15. Third-party and platform services
Features interact with Apple/Google operating-system and store services, including Apple Vision/VisionKit/PDFKit/EventKit/LocalAuthentication/StoreKit/CloudKit, Android CameraX/ML Kit/Biometric/WorkManager/Google Play Billing/Google Identity/Google Drive, local notifications, system share/calendar/file/photo/document pickers and Apple system device backup. Automatic enrichment for an eligible checksum-valid retail barcode can query Open Food Facts / Open Products Facts.
If you enable the AI scan assistant, Expiry Pilot calls the OpenAI, Anthropic, xAI, Google Gemini, DeepSeek or OpenRouter API you selected using the API key you supplied; OpenRouter forwards requests to the company that runs the chosen model under your OpenRouter account settings. Those providers may independently impose authentication, model availability, content/safety rules, rate limits, usage charges, logging and retention. Websites opened from a renewal link and calendar apps that import an .ics file are likewise independent services. Expiry Pilot does not control or warrant a third party's independent service, outage, payment decision, account restriction, cloud behavior, provider-side data handling or API/platform change.
16. Compatibility, updates and availability
The reviewed iOS/iPadOS build 204 requires iOS/iPadOS 16.0 or later and supports iPhone/iPad. The reviewed Android build uses minSdk 26 (Android 8.0) and targets SDK 36. Individual features require compatible hardware and OS services.
Updates may change compatibility, UI, parsing heuristics, security, platform integration or features where reasonably necessary. Store/OS/API policy changes can affect installation, re-download, purchase verification, backup behavior or individual features. Compatibility with every future OS/device/customized Android environment cannot be guaranteed.
17. Warranties and limitation of liability
Expiry Pilot is designed and tested as an organization/reminder utility, but no software, scanner or notification system can be guaranteed error-free, continuously available or accurate for every document/date format/device configuration.
To the maximum extent permitted by law, Expiry Pilot is provided without warranties beyond those expressly stated here or required by mandatory law. Nothing excludes or limits liability, statutory conformity obligations, consumer protections or remedies that cannot lawfully be excluded or limited.
Where liability may lawfully be limited, the seller/developer is not responsible for indirect or consequential loss arising solely from ordinary use of Expiry Pilot, except to the extent applicable law provides otherwise. You remain responsible for verifying important deadlines and maintaining appropriate backups.
18. Intellectual property
Expiry Pilot, its source code, design, branding, interface, documentation, graphics and original content are protected by applicable intellectual-property law. Installation or Premium purchase does not transfer ownership rights.
Apple, iOS, iPadOS, App Store, Android, Google Play and other third-party names/technologies remain the property of their respective owners. Reference to them describes the actual platform/service relationship and does not imply additional sponsorship.
19. Apple App Store / iOS terms
The iOS/iPadOS app currently links to Apple's Standard Licensed Application End User License Agreement (Standard EULA). That Apple licence applies to the App Store-distributed licensed application. These Expiry Pilot Terms supplement the applicable Apple licence/store terms and are not intended to reduce rights or protections provided by Apple or mandatory law.
Apple is not responsible for the developer's support services. Apple processes App Store purchases, subscriptions, billing and applicable refund procedures under Apple's terms. If there is a conflict concerning the App Store licence that must be resolved under Apple's mandatory Standard EULA/store terms, those terms apply to that extent.
20. Google Play / Android terms
For the Android version distributed through Google Play, Lifetime Premium and Annual Premium are processed through Google Play Billing and remain subject to Google's applicable Play terms, payment rules, subscription controls and refund policies.
Google Play remains responsible for the purchasing account's transaction history and store-side payment/cancellation controls. Android system Auto Backup/device transfer for Expiry Pilot is settings-only in the reviewed build. The separate optional Cloud backup feature uses Google Identity authorization and the narrow Google Drive drive.appdata scope to store encrypted backups and the recovery key in the connected user account.
21. Suspension and termination
Use of Expiry Pilot or a paid entitlement may be restricted where reasonably necessary to address fraud, entitlement abuse, security threats, unlawful use or material violation of these Terms, subject always to mandatory rights/store rules.
Deleting the app ends local use and removes private local app data from the device, subject to separate Apple system-backup copies. It does not erase App Store/Google Play purchase history, user-created exports, calendar events (including events imported from .ics files), Expiry Pilot cloud backups already stored in iCloud/Google Drive, or data already transmitted to an AI provider. Those external copies are governed by the relevant deletion controls/provider terms.
22. Governing law and consumer rights
These Terms are governed by the laws of Italy, without depriving consumers of mandatory protections granted by the law that otherwise applies to them. Mandatory rules concerning jurisdiction, statutory guarantees, digital-content conformity, consumer remedies and dispute resolution remain unaffected.
If any provision is held invalid or unenforceable, the remaining provisions continue to apply to the fullest extent permitted by law.
23. Changes to these Terms
These Terms may be updated where reasonably necessary to reflect law, store requirements, security, platform APIs, billing or Expiry Pilot functionality. The current version will be published here with an updated effective date. Changes will not retroactively remove rights already accrued under mandatory law.
24. Support and legal contact
For technical issues, purchase/restore problems, privacy questions or these Terms: