Privacy Policy

SubCrisp is a privacy-first subscription tracker. We built it so you can understand your recurring spending without ever connecting a bank account. This policy explains what we collect, what we deliberately do not, who processes your data on our behalf, how long we keep it, and how you can delete it.

SubCrisp is operated by Dablity, the trading name of Damian Blochowiak, a sole trader based in the United Kingdom. Dablity is the data controller for the personal data described below. You can reach us about anything in this policy at [email protected], or by post at:

• Account email address — used to sign you in (magic link or Google sign-in) and to send the notifications you enable.
• Subscription data you enter manually — the names, costs, currencies, billing cycles, renewal dates, and notes you type in yourself.
• Your settings: base currency, monthly budget, your optional monthly take-home pay, theme, and notification preferences. The take-home figure is a single number you type in yourself; it is never requested from a bank or an employer, is only used to show your spending as a share of it, and can be cleared at any time.

• No bank connections. We never ask for or hold banking credentials and never link to your bank.
• No access to your financial accounts. SubCrisp cannot see your real transactions, balances, or card details.
• No tracking of your actual payments. Everything in SubCrisp is information you entered by hand — we do not observe money leaving your accounts.

Under UK GDPR we must have a lawful basis for each thing we do with your data. Ours are:

• Running the app — your account, the subscriptions you enter, and your settings are processed to perform our contract with you (Article 6(1)(b)). Without this data there is no service to provide.
• Renewal reminders, trial alerts, and the weekly summary email — sent on the basis of your consent (Article 6(1)(a)), given by switching each one on. You can withdraw consent at any time in Settings → Notifications, which stops those emails without affecting anything else.
• Taking payment for SubCrisp Pro — performance of our contract (Article 6(1)(b)). Keeping the resulting payment and invoice records is a legal obligation for accounting and tax (Article 6(1)(c)).
• Keeping the service secure — preventing abuse, fraud, and unauthorised access rests on our legitimate interests in running a safe service (Article 6(1)(f)).

We do not use your data for automated decision-making or profiling, and we never sell it.

We rely on a small number of trusted service providers to run SubCrisp. Each only receives the data needed for its role:

• Supabase — hosting, database, and authentication. Your data is stored in the eu-west-2 (London) region.
• Stripe — payment processing for SubCrisp Pro. Stripe handles your card details directly; we never see or store them.
• Google Play and RevenueCat — payment processing and subscription management for SubCrisp Pro bought inside the Android app. Google handles your payment details directly; we never see or store them. RevenueCat keeps a subscriber record linked to your account so the app knows your Pro status.
• Resend — delivery of transactional and notification emails.
• logo.dev — supplies the brand logos shown beside your subscriptions. Your device never contacts logo.dev: it asks our own servers for each logo, and we fetch it by the service's public domain name (for examplenetflix.com). Your IP address is not shared with logo.dev, and no account details or personal data are sent.
• Google — optional OAuth sign-in, only if you choose to sign in with Google.

Each provider processes data only on our instructions, under its own data processing terms, and only for the purpose described above.

Your account and subscription data is held in the United Kingdom, in Supabase's eu-west-2 (London) region.

Some of the processors above — in particular Stripe, RevenueCat, Resend, logo.dev and Google — are based in, or transfer personal data to, the United States and other countries outside the UK. Where a provider is certified under the EU–US Data Privacy Framework, we rely on the UK Extension to that framework. Otherwise we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the safeguards required by Article 46. You can request details of the safeguards applying to a specific transfer at [email protected].

SubCrisp sets no advertising or analytics cookies and does no cross-site tracking. Cloudflare Web Analytics is the only analytics we use: it counts page visits and traffic sources, sets no cookies, and does not fingerprint visitors.

We do store a small amount of data on your own device, which stays there:

• Your sign-in session — so you stay logged in between visits. Held in browser storage on the web, and in the operating system's secure app preferences on Android.
• Your theme preference — whether you chose light, dark, or to follow your device.
• Your dashboard layout preference — whether you last viewed your subscriptions as a list or a grid.

All three are strictly necessary to provide the service you asked for, so under the Privacy and Electronic Communications Regulations they do not require a consent banner. Clearing your browser or app storage removes them and signs you out.

We keep your account data for as long as your account is active. When you delete your account, your app data is erased immediately (see below). Records that we are legally required to retain — in particular payment and invoice records held by Stripe or Google Play for accounting and tax purposes — are kept for the period required by law, as permitted by GDPR Article 17(3)(b).

You can permanently delete your account at any time from Settings → Delete account. This immediately:

• cancels any active SubCrisp Pro subscription billed through Stripe;
• erases your subscriptions, settings, and billing mapping from our database; and
• removes your authentication account.

If you subscribed to Pro through the Android app, you must also cancel in Google Play. Google does not let us cancel a Play subscription on your behalf, so deleting your SubCrisp account alone will not stop Google billing you. Cancel at play.google.com/store/account/subscriptions before or after deleting.

The only data retained afterwards is the payment/invoice history legally required for accounting and tax, held by Stripe or Google.

Deletion is the right most people want, and it is built into the app. You also have the right to:

• Access a copy of the personal data we hold about you;
• Rectify anything inaccurate — most of it you can edit yourself in the app;
• Erase your data, as described above;
• Restrict or object to our processing, including anything we do on the basis of legitimate interests;
• Port your data — receive it in a structured, machine-readable format;
• Withdraw consent for notification emails at any time, in Settings → Notifications.

To exercise any of these, email [email protected] or write to us at the address above. We will respond within one month, as UK GDPR requires, and we will never charge you for a request.

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you are in the EU or EEA, you may instead complain to the data protection authority in your own country. We would rather hear from you first, but you do not have to contact us before going to a regulator.

We may update this policy from time to time. If we make material changes, we will update the "last updated" date above and, where appropriate, notify you by email.

Questions about this policy? Email [email protected], or write to: