Privacy Policy

SubTrim ("we," "our," or "us") operates the website at subtrim.dev and the SubTrim web application. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service.

We believe in transparency and minimal data collection. We do not sell your data, we do not use third-party ad trackers, and we do not place non-essential cookies on your device.

1. What We Collect

Account Information

• Email address and password (used for authentication)
• Display name, avatar selection, and account preferences you choose to set

Subscription Data

• Subscription names, costs, billing cycles, renewal dates, and categories you enter
• Audit survey responses (usage frequency, satisfaction, would-miss ratings)
• Budget settings and household membership information

Automatically Collected

• Basic web analytics via Vercel Analytics (page views, referrer, country, device type). This is privacy-friendly and does not use cookies or track individuals.
• Authentication session tokens stored in your browser's local storage (essential for keeping you logged in)

Contact Form

• If you use our contact form, we collect your name, email address, and message. This data is sent via FormSubmit.co to our email at hello@subtrim.dev.

2. How We Use Your Data

We use your information exclusively to:

• Provide and operate the SubTrim service (tracking subscriptions, generating audit recommendations, calculating your SubScore)
• Authenticate your identity and maintain your session
• Enable household sharing features when you opt in
• Respond to your support inquiries and feedback
• Understand aggregate usage patterns to improve the product (via anonymous analytics)

We do not use your data for advertising, profiling, or selling to third parties. Ever.

3. Data Storage & Security

Your data is stored in a Supabase-hosted PostgreSQL database. Supabase provides enterprise-grade security including:

• Encryption at rest and in transit (TLS/SSL)
• Row Level Security (RLS) policies ensuring you can only access your own data
• SOC 2 Type II compliant infrastructure
• Data hosted on secure cloud infrastructure

Passwords are hashed using bcrypt via Supabase Auth. We never store or have access to your plaintext password.

4. Third-Party Services

We use a limited number of third-party services, each chosen for their privacy practices:

We do not use Google Analytics, Facebook Pixel, or any advertising or behavioral tracking tools.

5. Cookies & Local Storage

SubTrim does not use tracking cookies. The only client-side storage we use is:

• Local Storage: Authentication session tokens managed by Supabase Auth (essential for keeping you logged in)
• Local Storage: UI preferences such as dismissed alerts and theme settings

No cookie consent banner is needed because we do not use non-essential cookies.

6. Your Rights

You have the right to:

• Access your data — all your subscription data is visible to you in the app at all times
• Export your data — CSV export functionality is available in your account settings
• Correct your data — you can edit any subscription or profile information at any time
• Delete your data — you can request complete account deletion by emailing us
• Withdraw consent — you can stop using the service at any time; no data is retained after deletion

To exercise any of these rights, contact us at hello@subtrim.dev.

7. Children's Privacy

SubTrim is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will promptly delete it.

8. Contact

If you have questions about this Privacy Policy or your data, contact us at:

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we will notify registered users via email.

Continued use of SubTrim after changes constitutes acceptance of the updated policy.