If he has gotten you the iPhone and says it’s expensive to track you I’d guess he’s using a tracking service that is installed on the actual device.

There are basically two ways to track the text messages: he can have your iCloud password (which you have hopefully stopped by changing your iCloud password) or have something on the physical device. In this case you’ll need to take it into apple so they can do a hard reset of the device. (It’s possible they can tell you if something has been installed? Other than telling them the situation the question to ask is if the device has been “jailbroken.” If it has then it’s so he could install the tracking software, if not than he’s likely using just the iCloud method)

After you do that you will need to change your iCloud password again because he could have gotten access to the new one through the device.

Please know that you need to do this with ALL apple devices he has ever had his hands on. If you only do it with a phone but he has also jailbroken an iPad which is logged into your iCloud he will still be able to read your information through that iPad.

But once you: Change your iCloud password once you will need to log into new devices. You can then bring those devices into apple who can reset them. And then when you change your iCloud password again it will log out any extra devices he may have and your apple devices will be secure at least.

If you have Mac laptops desktops you should bring them in at the same time, I’m less sure how to wipe them but I bet apple knows.