Substrack Privacy Policy

Last updated: 25 April 2026

Substrack (“we”, “the app”) is a mobile app that helps you track your subscription bills and reminds you before each renewal. This policy explains what we collect, why, and how to control it.

1. What we collect

• Account info. If you sign in with Google or Apple, we receive your email address, display name, and profile photo URL from that provider. If you sign in as a guest, we generate an anonymous Firebase user ID with no personal data attached.
• Your subscription list. The names, prices, billing dates, and categories you enter (or that are auto-detected) are stored against your account in Google Cloud Firestore.
• Gmail metadata (only if you use Gmail Scan). When you opt in to Gmail Scan, we request a short-lived Gmail read-only OAuth token and use it once to fetch the subject lines and first 5KB of message bodies from emails matching subscription keywords. We never store the full email content; only the parsed subscription details (service name, amount, date) are saved to your account.
• Purchase data. If you buy “Remove Ads”, RevenueCat receives the receipt to validate the purchase and grant the entitlement. We do not see your payment method or card details.
• Push notification token. Firebase Cloud Messaging assigns a token so we can deliver renewal reminders. The token is tied to your device, not to you personally.
• Crash reports. Firebase Crashlytics collects anonymous stack traces and device model when the app crashes. No personally identifying information is included.
• Ad identifiers (free users only). Google Mobile Ads uses your device’s advertising ID to serve relevant ads. Purchasing “Remove Ads” disables all ad SDKs on your device.

2. What we do NOT collect

• We do not read, store, or share the full content of your Gmail messages.
• We do not sell or rent your data to anyone.
• We do not use Gmail data to train AI models.
• We do not collect your contacts, location, microphone, or camera.

3. Where your data lives

All cloud data is hosted on Google Cloud Platform (Firebase) in the United States (region: nam5). Push notifications go through Firebase Cloud Messaging.

4. Sharing

We share data only with the third-party services we use to operate Substrack:

• Google Firebase — auth, database, push, crash reporting (privacy: firebase.google.com/support/privacy)
• RevenueCat — purchase validation (revenuecat.com/privacy)
• Google Mobile Ads — advertising for free users (policies.google.com/technologies/ads)

We never share your subscription list with any of these providers.

5. Your controls

• Delete. Settings → Delete account permanently removes your auth user and all your Firestore data within seconds. No retention.
• Sign out. Settings → Sign out clears your session locally; cloud data remains attached to your account for next sign-in.
• Revoke Gmail access. Visit myaccount.google.com/permissions and remove Substrack.
• Disable ads tracking. Buy “Remove Ads”, or revoke your device advertising ID in your phone’s settings.

6. Children

Substrack is not directed at children under 13. If you believe a child has signed up, email us and we will delete the account.

7. Changes

If we materially change this policy, we will update the “Last updated” date and surface the change in-app on your next launch.

8. Contact

Questions, requests, or complaints: support@subs-track.com