Privacy Policy

Subscription Freedom is the data controller for the personal data described here. For any privacy request — access, correction, export or erasure — email privacy@subscriptionfreedom.com. We reply within 30 days.

• We never connect to your bank or card accounts. There is no Plaid, no open banking, no card linking.
• We never log in to, or read, your email account. We have no OAuth access to any inbox.
• We never sell personal data, and we do not run advertising or cross-site tracking pixels.

Account data. Your email address, an account identifier, your country, your plan, and your notification preferences. If you sign in with Google, we receive your email address and name from Google — nothing else.

Forwarded receipt emails. You forward subscription receipts to a private address at @in.subscriptionfreedom.com. For each forwarded message we store the sender address, the subject line, and a text preview of up to 2,000 characters of the message body, alongside the parsed result. We keep this excerpt so you can see why a subscription was created and so a mis-parse can be corrected. We do not store attachments, and we do not store the full message body.

Subscription records. Merchant name, amount, currency, billing period, renewal date, category, cancellation status and any notes you add.

Operational logs. Request timestamps, error records and email-delivery status, used to keep the service running and to detect abuse.

To read a merchant, amount and renewal date out of a forwarded receipt, the text of that email is sent to an AI model through the Lovable AI gateway (which routes to Google Gemini models). This is the one place where the content of your forwarded emails leaves our own infrastructure. Only the text of receipts you forward is sent — never your whole inbox, and never your account credentials.

The gateway is used for inference only. If you would rather no email content be processed this way, do not use forwarding: add subscriptions manually instead, which involves no AI processing at all.

These companies process data on our behalf:

• Contract — account data, subscription records and receipt parsing, because they are the service you asked for.
• Legitimate interests — security logging, abuse prevention and service reliability.
• Legal obligation — payment and tax records relating to Premium.
• Consent — optional email reminders, which you can switch off in Settings at any time.

• Account and subscription data — until you delete your account.
• Forwarded email records (sender, subject, text preview) — 12 months, then automatically removed.
• Price history and alerts — the amount, currency, billing period and date we read from each receipt are kept for as long as you hold the account, and are deliberately not removed by the 12-month clean-up above. Without them we could not tell you a price had changed. They contain no email content — only the figures — and they are deleted in full when you delete your account.
• Operational and security logs — 90 days.
• Billing records held by Stripe — as required by law, typically 7 years.

Data is encrypted in transit (TLS) and at rest. Every table is protected by row-level security so one account cannot read another's rows, enforced by the database rather than by the app. Passwords are hashed and checked against known-breached password lists at signup. Cancellation-proof PDFs are stored in a private bucket and served only through short-lived signed links.

You can access, correct, export or erase your data. Deleting your account in Settings cancels any active Premium subscription with Stripe, removes your stored files, deletes your subscriptions, receipt records and preferences, and deletes your login. This is immediate and cannot be undone.

If you are in the UK or EU you also have the right to object, to restrict processing, and to complain to your data protection authority.

The service is not intended for anyone under 16, and we do not knowingly collect their data.

If we change how data is used in a material way, we will update the date at the top of this page and email account holders before the change takes effect.