Privacy Policy

Introduction

Subcut ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our iOS application ("App").

Please read this privacy policy carefully. By downloading, installing, or using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this privacy policy, please do not access or use the App.

Our Privacy-First Approach

Subcut is designed with privacy as a core principle. We believe your financial data belongs to you, and we've built our app to minimize data collection while maximizing functionality.

Data We Collect

We are committed to transparency about the data we collect. Below is a comprehensive list of all data collected by the App:

1. Data You Provide Voluntarily

When you use Subcut, you may voluntarily enter subscription information including:

• Subscription names and service providers
• Billing amounts and currencies
• Billing frequencies (weekly, monthly, yearly)
• Billing dates and renewal information
• Subscription categories
• Notes you add to subscriptions
• Email access permissions for subscription detection

2. Automatically Collected Data

We collect minimal technical information necessary for app functionality:

3. Data We Do NOT Collect

We explicitly do not collect:

• Your name, email address, or contact information (unless you contact support)
• Bank account numbers, credit card numbers, or financial credentials
• Login credentials for any third-party services
• Precise location data
• Contacts, photos, or other personal data from your device
• Browsing history or activity on other apps
• Advertising identifiers (IDFA) or cross-app tracking data
• Health or fitness data

Email Scanning and AI Processing

Subcut offers an optional feature to automatically detect subscriptions from your emails. This section explains exactly how this feature works and how your data is handled.

What Email Data is Read

When you enable email scanning, Subcut accesses your email inbox to identify subscription-related emails. Specifically:

• Email subject lines
• Email sender addresses
• Email body content (text only)
• Date and time of emails

How Email Data is Processed

Email content that may contain subscription information is processed using Google's Gemini API for intelligent extraction:

Google Gemini API

We use Google's Gemini API for AI-powered subscription extraction. Important details about this processing:

Google Gemini API processing is subject to Google's Privacy Policy and Google AI Terms of Service.

What Happens to Your Email Data

Disabling Email Scanning

Email scanning is entirely optional. You can disable this feature at any time in the App's Settings. When disabled, no email data is accessed or processed. You can also revoke email access through your email provider's connected apps settings.

How We Collect Data

Data is collected through the following methods:

• Direct Input: Information you manually enter into the App
• Email Scanning: Subscription-related emails processed via Google Gemini API (when enabled)
• Apple Services: Purchase verification through Apple's StoreKit APIs
• RevenueCat SDK: Anonymous subscription status verification
• Apple Crash Reporting: Anonymized crash data (if you've enabled sharing with developers in iOS Settings)

How We Use Your Data

The limited data we collect is used solely for the following purposes:

Third-Party Services & Data Sharing

We share data only with the following third parties, who provide the same or greater protection of your data:

Apple Inc. (CloudKit & iCloud Sync)

We use the following Apple services:

• App Store: App distribution and in-app purchases
• CloudKit: Optional iCloud sync for your subscription data
• StoreKit: Subscription management and purchase verification
• APNs: Push notifications (processed locally on your device)

Apple services are subject to Apple's Privacy Policy and iCloud Terms.

Google LLC (Gemini API)

We use Google's Gemini API for AI-powered email subscription detection:

• Email content from subscription-related emails (when email scanning is enabled)
• AI processing to extract subscription details (service name, price, billing cycle)

See Google's Privacy Policy and Google AI Terms of Service.

RevenueCat Inc. (Subscription Management)

We use RevenueCat to manage Subcut Pro subscriptions. Data shared with RevenueCat:

• Anonymous App User ID: A randomly generated identifier not linked to your identity
• Purchase Transaction Data: Receipt information from Apple for subscription verification
• Subscription Status: Whether your Pro subscription is active, expired, in trial, etc.
• Purchase History: Transaction dates and subscription periods

RevenueCat is SOC 2 Type II certified and GDPR compliant. See RevenueCat's Privacy Policy and Data Processing Agreement.

No Other Third Parties

We do not share data with any other third parties. We do not use third-party analytics services, advertising networks, or tracking SDKs beyond what is explicitly listed above.

Data Storage and Security

Local Storage

Your subscription data is stored locally on your device using Apple's Core Data framework. iOS provides encryption at rest for all app data when your device is locked with a passcode.

CloudKit / iCloud Sync (Optional)

If you enable iCloud sync, your subscription data is stored in your personal iCloud account using Apple's CloudKit service:

Email Data

When you use email scanning:

• Email content is processed in real-time via Gemini API
• Raw email content is NOT stored by Subcut after processing
• Only extracted subscription details are saved locally
• Email access uses OAuth tokens-we never see your email password

Biometric Security

Subcut offers optional FaceID/TouchID protection. Biometric data is:

• Processed entirely by iOS on the Secure Enclave
• Never accessible to the App
• Never transmitted off your device
• Never stored by Subcut

Data Retention and Deletion

Retention Period

• Local subscription data: Retained until you delete it or uninstall the App
• CloudKit/iCloud data: Retained until you delete it or disable iCloud sync
• Email content: NOT retained-processed in real-time and discarded immediately after extraction
• Gemini API processing: Google does not retain data after processing the request
• RevenueCat data: Retained as long as your subscription exists, plus as required by Apple for financial records
• Support correspondence: Retained for 2 years after resolution

How to Delete Your Data

You have full control over your data and can delete it at any time:

Your Rights and Choices

Data Control Rights

You have the following rights regarding your data:

• Access: View all your data within the App at any time
• Portability: Export your data in CSV or JSON format (Pro feature)
• Correction: Edit any subscription data directly in the App
• Deletion: Delete individual subscriptions or all data
• Withdrawal of Consent: Disable iCloud sync or any permissions at any time

How to Withdraw Consent

• iCloud Sync: Go to iOS Settings → [Your Name] → iCloud → Apps Using iCloud → toggle off Subcut
• Notifications: Go to iOS Settings → Subcut → Notifications → toggle off
• FaceID/TouchID: Disable within the App's Settings

No Account Required

Subcut does not require you to create an account. Since we don't create accounts, there is no account to delete. Your data is controlled entirely through your device and iCloud settings.

Tracking and Advertising

Children's Privacy

Subcut is not directed to children under 13 years of age (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at [email protected]. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information.

International Users

Subcut is available worldwide. Your data remains on your device or in your iCloud account, which may be stored in data centers in your region based on Apple's infrastructure.

For EU/EEA/UK Users (GDPR)

Under the General Data Protection Regulation, you have additional rights including:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

Legal Basis for Processing: We process your data based on:

• Contract Performance: Providing the service you requested
• Legitimate Interest: App functionality, security, and improvement
• Consent: Optional features like iCloud sync and notifications

For California Users (CCPA)

Under the California Consumer Privacy Act, you have the right to:

• Know what personal information is collected
• Know whether your data is sold or disclosed and to whom
• Say no to the sale of personal information (we do not sell data)
• Access your personal information
• Request deletion of your personal information
• Equal service and price, even if you exercise your privacy rights

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Updating the "Last updated" date at the top of this page
• Posting a notice within the App for material changes
• Sending a push notification for significant changes (if you have notifications enabled)

We encourage you to review this Privacy Policy periodically. Your continued use of the App after changes become effective constitutes acceptance of the revised Privacy Policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

App Store Privacy Labels

In accordance with Apple's App Store requirements, we disclose the following privacy information: