Back to App
Data Protection & Privacy

Privacy Policy

At SubTrack, we believe keeping track of your recurring subscriptions should never come at the expense of your personal privacy. We collect only what is strictly necessary to detect renewals, send alerts, and give you complete control over your recurring costs.

Effective Date: September 29, 2026•Last Updated: September 29, 2026•Version 1.0

Privacy Commitments at a Glance

Never Sold or Monetized

We do not sell, rent, or trade your personal data, email content, or subscription details to advertisers, brokers, or third parties.

Read-Only Gmail Access

Connecting Gmail is 100% optional. If enabled, access is strictly read-only and limited solely to identifying subscription receipts and renewal notices.

Google Limited Use Policy

Our handling of information received from Google APIs strictly complies with the Google API Services User Data Policy, including Limited Use requirements.

Total User Ownership

Disconnect inboxes, clear subscriptions, or permanently delete your account and all associated records at any moment directly inside Settings.

1.Overview & Scope

SubTrack ("SubTrack," "we," "our," or "us") provides a web-based productivity platform that enables users to record recurring subscriptions, track billing cycles, forecast recurring expenses, and receive proactive renewal alerts.

This Privacy Policy describes how we collect, handle, store, and safeguard your personal information when you access our website, sign in with your Google account, connect external services, or interact with our dashboard. By accessing SubTrack, you acknowledge the practices detailed in this policy.

2.Information We Collect

We collect information in three ways: information you provide, information automatically gathered from your authorization, and operational technical data:

  • Google Account Profile: When you sign in using Google OAuth 2.0, we receive your primary email address, full name, Google unique user identifier, and public profile avatar URL.
  • Subscription Records: Subscription merchant names (e.g. Netflix, Spotify, GitHub), billing cycles (weekly, monthly, quarterly, annual), recurring prices, currency codes, renewal or end dates, category classifications, and notes entered manually or approved by you.
  • Optional Gmail Read-Only Data: If you explicitly choose to connect Gmail for automatic subscription detection, our backend receives read-only authorization (https://www.googleapis.com/auth/gmail.readonly). We scan incoming message headers, sender domains, dates, and snippets strictly to detect subscription invoices, renewal confirmations, and trial expiration notices.
  • Optional WhatsApp Notification Details: If you choose to enable WhatsApp renewal notifications, we store your designated international mobile phone number and your per-subscription reminder preferences (e.g., alert 1, 3, or 7 days prior to renewal).
  • Technical & Security Metadata: Standard operational logs such as browser user-agent, request timestamps, and session identifiers, utilized strictly to maintain application security, prevent abuse, and troubleshoot technical errors.

3.Google API Limited Use Disclosure

SubTrack values the sensitivity of email data and strictly limits any processing of information received from Google APIs.

Google API Services User Data Policy Compliance

SubTrack's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We do not use your Gmail data for serving advertisements.
  • We do not sell, transfer, or distribute your email data to third parties.
  • We do not use your email content to train generalized artificial intelligence (AI) or machine learning (ML) models.
  • Human beings will not read your emails unless you provide explicit consent to investigate a specific technical bug or as strictly required for legal and security compliance.

Gmail access is strictly limited to extracting subscription billing events that are presented directly to you for confirmation before being saved to your dashboard.

4.How We Use Information

SubTrack uses the collected information strictly for legitimate operational purposes:

  • Personal Workspace Management: Displaying your active subscriptions, aggregating your monthly and annual commitments, and calculating your upcoming payment timelines.
  • Automated In-App and WhatsApp Reminders: Evaluating your renewal dates against your scheduled reminder intervals and dispatching automated renewal warnings so you can cancel unwanted subscriptions on time.
  • Receipt & Trial Detection: Parsing transaction receipts to discover new subscriptions or price changes, placing them into your "Needs review" inbox for your explicit approval.
  • Authentication & Security: Verifying your identity via signed JSON Web Tokens (JWT) and preventing unauthorized access to your account data.

5.Storage & Security

We implement industry-standard administrative, physical, and technical safeguards to protect your data against unauthorized access, loss, or alteration:

  • Encrypted Connection Tokens: All Google OAuth tokens and refresh keys are cryptographically sealed using AES encryption before storage.
  • Secure Cookies: Session tokens are delivered with HttpOnly, Secure, and SameSite=Lax cookie flags, protecting them against cross-site scripting (XSS) and request forgery (CSRF).
  • Data Isolation: All subscriptions and review items are strictly segmented by user identity. No user can view, edit, or access another user's subscription records.

6.Third Parties & Service Providers

We do not sell, rent, or lease your personal data. We engage a minimal set of trusted infrastructure processors solely to operate SubTrack:

  • Google Cloud / Google APIs: Facilitates OAuth 2.0 user authentication, Gmail read-only synchronization, and Google Cloud Pub/Sub push notifications for real-time receipt detection.
  • Twilio / WhatsApp Business API: Dispatches automated WhatsApp reminder alerts to your verified phone number when configured.
  • Cloud Database Hosting: Secure PostgreSQL database infrastructure storing your confirmed subscription records and user preferences.

7.Your Rights & Complete Data Control

You retain complete ownership and full control over your personal information at all times:

  • Disconnect Gmail Inboxes: In the Connections or Settings panel, you can disconnect any connected Gmail address with one click. This terminates monitoring and revokes inbox watch subscriptions immediately.
  • Edit or Remove Subscriptions: You can edit, update, or delete any individual subscription at any time.
  • Delete All Subscriptions: You can wipe all saved subscription entries and scheduled reminders simultaneously via the Settings panel while keeping your account active.
  • Permanent Account Deletion: Clicking "Delete account" in the Settings panel permanently and irreversibly purges your user profile, all subscription records, Gmail tokens, review candidates, and notification logs from our databases.

8.Cookies & Authentication

SubTrack uses only strictly essential cookies required to operate our authenticated service:

  • session_token: Secure, signed JSON Web Token used to authenticate your session across pages. Valid for up to 90 days or until you sign out.
  • gmail_connection: Sealed credential cookie enabling your browser to synchronize read-only inbox monitoring securely.

We do not deploy advertising trackers, tracking pixels, behavioral cookies, or third-party marketing analytic scripts.

9.Children's Privacy

SubTrack is not directed to individuals under the age of 16. We do not knowingly collect or solicit personal information from children. If we discover that personal data from a child under 16 has been collected without verified parental consent, we will promptly purge that information from our records.

10.Changes to this Privacy Policy

We may periodically update this Privacy Policy to reflect improvements to SubTrack, changes in applicable regulations, or newly added features. When revisions occur, we will update the "Last Updated" date at the top of this document. Continued use of SubTrack following modifications constitutes your acceptance of the revised policy.

11.Contact Us

If you have questions, feedback, or requests regarding this Privacy Policy or your personal data, please contact our privacy team:

SubTrack Privacy & Legal Support

Our team is dedicated to safeguarding your privacy and promptly responding to data requests.

privacy@subtrack.appsupport@subtrack.app