Privacy Policy

1. Information We Collect

When you use Subzy, we collect the following information:

Account Information

• Email address — used for authentication, OTP codes, and renewal reminders
• Username — derived from your email at registration
• Password hash — stored as a bcrypt hash; your plaintext password is never stored
• Google account ID — if you sign in with Google
• Apple account ID — if you sign in with Apple

Subscription Data

• Subscription names, prices, billing cycles, and renewal dates you manually enter
• Tags and notes you attach to subscriptions
• Billing history entries you manually record
• Cancellation dates and trial period flags

Preferences

• Currency preference — synced across your devices
• Timezone — detected during onboarding for scheduling reminders at the right time
• Theme preference — light, dark, or system
• Notification preferences — whether you want email reminders, push notifications, and how many days in advance

Activity & Platform Data

• Last active timestamp — the date and time you last used the app
• Platform history — whether you have used Subzy on web, iOS, and/or Android (stored as boolean flags)
• Device tokens — push notification tokens for iOS (APNs) and Android (FCM) used to deliver payment reminders to your device

Payment Data

• Stripe customer ID and subscription status — managed by Stripe. We do not store card numbers or full payment details.
• Google Play purchase tokens — used to verify premium subscriptions purchased via Google Play

Feedback

• Optional feedback submitted when you cancel your premium subscription or delete your account

2. How We Use Your Information

• Authenticate you and maintain your session
• Send OTP verification codes to your email
• Send email reminders before your subscriptions renew (only if you opt in)
• Deliver push notifications to your device for upcoming renewals (only if you grant permission)
• Generate spending analytics and visualizations within your dashboard
• Display platform usage statistics in our internal admin dashboard for service improvement
• Verify premium subscription status via Stripe and Google Play
• Respond to feedback and improve the service

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)) — processing necessary to provide the Subzy service you signed up for (account creation, subscription tracking, reminders)
• Consent (Art. 6(1)(a)) — email marketing reminders and push notifications, which you may withdraw at any time in Settings
• Consent (Art. 6(1)(a)) — website analytics and advertising measurement, set only if you accept the cookie banner and withdrawable at any time
• Legitimate interests (Art. 6(1)(f)) — service reliability and security monitoring, where these interests are not overridden by your rights
• Legal obligation (Art. 6(1)(c)) — retaining records where required by applicable law

4. Data Sharing

We do not sell, trade, or rent your personal information. We share data only in the following cases:

• When required by law or legal process
• When necessary to protect our rights or safety
• With the following service providers, strictly to operate the service:

5. Cookies and Local Storage

Strictly necessary — set without consent, because the service cannot work without them:

• accessToken / refreshToken (httpOnly cookies) — maintain your login session on the web
• localStorage — stores your subscription data locally (local-first design), theme preference, currency, timezone, and notification settings

Analytics and advertising — set only if you choose “Accept” on the cookie banner. Choosing “Decline” means none of the following is loaded at all:

• Subzy analytics (sessionStorage, first-party) — an anonymous per-session identifier used to count visits, measure which pages are read, and see which links bring people here. Stored on our own server. We do not record IP addresses: an address is read once per request to derive a country and is never written down.
• Meta pixel and TikTok pixel (third-party) — measure whether our advertising leads to sign-ups. These set their own cookies and send data to Meta and TikTok, including outside the EEA.

You can withdraw this consent at any time by clearing your browser storage for this site, which brings the banner back. Separately, you give consent to our Terms of Service and Privacy Policy at registration via a checkbox before your account is created.

6. Data Security

Your data is stored in a MySQL database with access restricted to the application. Passwords are hashed with bcrypt and never stored in plaintext. JWT tokens are signed with secret keys and expire after 15 minutes (access) or up to 30 days (refresh, depending on "Remember me" setting). Push notification tokens are stored encrypted at rest.

We never connect to your bank accounts or access your actual financial data — all subscription information is entered manually by you.

7. Your Rights

Under GDPR and applicable privacy law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — delete your account and all associated data at any time via Settings → Delete Account
• Restriction — request we restrict processing of your data in certain circumstances
• Portability — export your subscription data as CSV or PDF directly from the app (Settings → Export Data). You may also contact us for a full account data export.
• Withdraw consent — turn off email or push notifications at any time in Settings → Notifications without affecting your account
• Lodge a complaint — with your local data protection authority if you believe your rights have been violated

8. Data Retention

We retain your data for as long as your account is active. You may delete your account at any time from Settings — this permanently removes all your data including subscriptions, notification preferences, and activity history.

Device push notification tokens are deleted automatically when you log out or uninstall the app. Feedback submitted at account deletion is deleted immediately when your account is deleted.

9. Children's Privacy

Subzy is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice within the application. Continued use of Subzy after the effective date of any changes constitutes acceptance of the revised policy.

11. Contact

For any questions about this Privacy Policy, to exercise your rights, or to request a data export, contact us at: [email protected]