Privacy Policy

This policy explains what information Subbly collects, how we use it, and what control you have over it. Subbly helps you discover, track, and cancel recurring subscriptions by analyzing, with your explicit permission, your email and, in the future, your bank activity.

When you create an account and complete your profile, we collect:

• Your email address, used to sign in and to contact you about your account.
• Your password, if you sign up with email and password: it's transmitted securely to our authentication provider (Supabase) and Subbly never stores or sees it in plain text.
• If you sign in with Google or Microsoft, the provider confirms your identity and verified email; Subbly never receives or stores your password for those accounts.
• Your name, your avatar icon and color choice, and a rough estimate of how many subscriptions you have — all optional, and you can skip or change any of it anytime from Settings.

If you choose to connect your Gmail account from "Connect accounts," we request read-only access (Google's gmail.readonly permission) to detect your subscriptions automatically.

This access is read-only only: Subbly can never send, delete, modify, or forward email on your behalf.

From subscription-related emails (renewal notices, payment confirmations, free trials), we extract only structured signals: the provider name, price, billing or renewal date, and category.

We never store the full content of your emails, nor of emails unrelated to subscriptions.

If our automatic extraction can't confidently identify the price, date, or plan type from an email sent by a provider we already recognize, we send that email's text — never the original HTML, and never emails from senders outside our known-provider catalog — to OpenAI, to attempt the same structured extraction. OpenAI doesn't use this content to train its models; it retains it for at most 30 days for abuse-prevention purposes and then deletes it. We only store the structured result (price, date, plan type) — never the AI's response itself, or the text we sent it.

You can disconnect your Gmail account at any time from "Connect accounts" — this immediately revokes our access and deletes the stored credentials.

Subbly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use your information solely to operate Subbly: detecting and displaying your subscriptions, managing your account, and communicating with you about the service. We never sell your information or share it with third parties for advertising purposes.

We share information only with the providers strictly necessary to run the service:

• Supabase, our authentication and database provider, which stores your account and data securely.
• Google, only to process the Gmail connection you initiate yourself — Subbly doesn't share your information with Google beyond what's needed for that exchange.
• OpenAI, only for the text of an email when our own automatic extraction can't confidently identify it — never full emails, and never from unrecognized senders.
• Resend, our email delivery provider, only if you turn on renewal reminders — details under “Renewal reminder emails” below.
• Sentry, our error-monitoring service (EU data region), which receives technical reports when something fails in the app — details under “Error monitoring” below.
• When required by law.

When something fails in Subbly, the app sends a technical report to Sentry, an error-monitoring service we use in its EU data region, so we can find and fix the problem. That report includes:

• The error message and the technical trace of the failure (the code that was running).
• The path of the page or endpoint where it happened, without URL parameters, and technical details such as browser and operating-system type.
• Internal identifiers for your account or the affected subscription, so we can locate the problem — we deliberately don't include your email address or the names of your subscriptions.

We configure the app so the report does not include cookies, authorization headers, the contents of requests, URL parameters, your IP address or the values of program variables. Error messages generated by other services can, in specific cases, contain technical identifiers. We don't use Sentry for advertising or to record your screen, and it is only active in the deployed version of Subbly, not during local development.

If you turn on email reminders in Settings, we warn you before a subscription renews or a trial ends. This means:

• An automated process checks your active subscriptions and ongoing trials once a day, in the background, to decide whether a reminder is due — without you needing to open the app.
• Resend, our email delivery provider, sends the actual message.
• We keep a minimal record of each reminder sent — which subscription it's for and whether it was delivered, never the email's content — for 90 days, to avoid duplicates and catch delivery failures.

Email reminders are off by default: you only receive them if you turn them on yourself in Settings, and only at an already-confirmed email address. You can turn them off anytime from Settings, or with one click from the unsubscribe link every reminder includes, with no sign-in required.

Gmail access credentials are encrypted before being saved in our database. Access to your own data is protected at the database level (Row Level Security), so even a bug in the application couldn't expose another account's data. All communication between your browser and Subbly is encrypted (HTTPS).

We only use strictly necessary technical cookies: the session cookie that keeps you securely signed in; a language-preference cookie (NEXT_LOCALE) that remembers the language you view the site in; and short-lived security cookies, created only while you connect an account (for example Gmail) to protect against forged requests. At this stage of the product we don't use analytics or advertising cookies; if that changes, we'll update this policy and ask for your consent before enabling them.

You have direct control over your information at all times:

• You can edit your name, avatar, and email, or change your password, from Settings.
• You can disconnect your Gmail account at any time from "Connect accounts."
• You can permanently and immediately delete your account and all your data from Settings — this has no grace period and can't be undone.

Go to Settings

Subbly isn't directed at children under 16, and we don't knowingly collect information from anyone under that age.

We may update this policy as Subbly evolves. We'll post any changes on this same page along with the last-updated date.

If you have questions about this policy or your data, write to us at minmen.se@gmail.com.