The short version. Subsy stores your email address and the subscription records you type in. There is no analytics, no advertising, no tracking and nothing is sold or shared for marketing. You can export everything as JSON at any time, and deleting your account deletes your data.
Who runs Subsy
Subsy is an independently operated tool. You can export or delete your data yourself at any time: Settings → Backup for export, Settings → Account → Delete account for deletion. For any privacy question, or if you cannot sign in, email hello@subsy.app.
What Subsy collects
Account information
To sign you in, Subsy stores your email address. If you sign in with Google instead of email, Google also passes back the basic profile it associates with your account (typically your name and profile picture URL). Subsy never receives your Google password.
Subsy does not use passwords. Sign-in is by one-time link or one-time code sent to your email, or by Google.
Content you enter
Everything in this table is information you type in yourself. Subsy does not collect any of it automatically.
| What | Examples |
|---|---|
| Services | Name, category, account label, tier, cost, billing cycle, renewal date, plan limits, notes, and links to usage, dashboard and billing pages |
| Apps | Project names, repository URLs, and free-text notes describing the stack |
| Payment cards | Card brand, the last four or five digits, expiry month and year, a link to the card's management page, and an optional image you upload |
| Preferences | Display currency, sort order, status filter and light/dark theme choice |
On payment cards. Subsy stores only a partial card number — the last four or five digits — plus brand and expiry, so you can tell one card from another. It never asks for, and has no field for, a full card number or security code. Subsy does not process payments and is not connected to your bank.
If you upload an image for a card, it is stored exactly as given. Please do not upload a photograph showing a full card number or security code.
Technical information
Like any website, Subsy's hosting and database providers record standard server logs — IP address, browser type, timestamps and which pages were requested — for security and reliability. Subsy does not add its own analytics or tracking on top of this, and does not build advertising or behavioural profiles.
Subsy stores a small amount of data in your browser: a sign-in session so you stay logged in, and your theme preference so the page does not flash the wrong colours while loading. These are not tracking cookies and are not shared with anyone.
Why Subsy holds this
- To run the service. Storing and showing you the records you entered is the entire product.
- To sign you in. Your email address is used to send sign-in links and codes.
- To keep the service working and secure. Server logs help diagnose faults and detect abuse.
Subsy does not use your data for marketing, and will not email you anything other than sign-in messages and, rarely, a notice about the service itself.
Who your data is shared with
Subsy does not sell your data and does not share it for advertising. It is shared only with the providers needed to run the service, each acting on Subsy's behalf:
| Provider | Role | What it sees |
|---|---|---|
| Supabase | Database, authentication and file storage | Your account and all records you enter |
| Netlify | Website hosting | Standard request logs, including IP address |
| Resend | Sending sign-in emails | Your email address and the message sent to it |
| Optional sign-in provider | Only if you choose to sign in with Google | |
| Expo | Building and delivering the mobile app | App build and update delivery; no access to your records |
Subsy may also disclose information where legally required to do so, or where necessary to protect the safety and integrity of the service.
Where your data is held
Subsy's database is hosted in the United States. If you are outside the United States, your information will be transferred to and stored there.
How your data is protected
All traffic is encrypted in transit. Every record is stored against your user account and protected by row-level security enforced by the database itself, which means one Subsy user cannot read another's data even in the event of a client-side flaw. Uploaded card images are held in a private storage bucket and served only through short-lived signed links to the account that owns them.
No system is perfectly secure. Subsy is a small independent tool, not an enterprise platform, and you should weigh that when deciding what to record in it.
How long it is kept
Your records are kept for as long as your account exists. Deleting your account deletes your services, apps, cards, uploaded images and preferences. Server logs held by the providers above are retained according to their own schedules, typically for a matter of weeks.
Your rights
- Access and portability. Settings → Backup → Export JSON gives you a complete copy of your records at any time, without asking anyone.
- Correction. Every record is editable in the app.
- Deletion. Delete individual records in the app, or email hello@subsy.app to have your whole account removed.
- Objection and restriction. If you are in a jurisdiction granting these rights, such as the UK, EU or California, email the address above and they will be honoured.
Subsy will not discriminate against you for exercising any of these rights.
Children
Subsy is a tool for managing software subscriptions and is not directed at children. It is not intended for use by anyone under 13, and accounts are not knowingly created for them.
Changes to this policy
If this policy changes in a way that materially affects how your data is handled, the date at the top will be updated and, where the change is significant, you will be notified by email at the address on your account.
Contact
Questions, requests or complaints about privacy: hello@subsy.app.