Privacy Policy - SubLess
Effective Date: April 13, 2026
SubLess ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application ("App").
1. Information We Collect
1.1 Information You Provide
- Subscription Data: Names, prices, billing cycles, and renewal dates of subscriptions you add to the App.
- Uploaded Documents: Bank statements or screenshots you upload for AI-powered subscription detection. These are processed in real-time and are not stored on our servers.
- Gmail Data (optional, opt-in): If you explicitly choose to connect your Gmail account for the Gmail Scan feature, the App reads email headers (sender, subject, date) and email body text solely to identify subscription receipts, invoices, and renewal notifications. See Section 4 for details on how Gmail data is handled.
1.2 Automatically Collected Information
- Device Information: Device type, operating system version, and language settings for optimizing your experience.
- Usage Analytics: Anonymized usage patterns to improve the App (no personally identifiable information).
1.3 Information We Do NOT Collect
- We do not require account creation, email addresses, or personal identification.
- We do not collect financial account credentials or banking information.
- We do not track your location.
2. How We Use Your Information
- To provide subscription tracking and management features.
- To send local notifications about upcoming renewals and trial expirations (with your permission).
- To sync your data across your devices via Apple iCloud (if enabled).
- To process uploaded documents for AI-based subscription detection.
- To scan your Gmail mailbox (only if you opt in) for the purpose of detecting recurring subscription payments.
- To improve the App's functionality and user experience.
3. Data Storage & Security
Your subscription data is stored locally on your device using Apple Core Data. If you have iCloud enabled, your data syncs across your devices through Apple's CloudKit infrastructure. We do not have access to your iCloud data.
Documents uploaded for AI analysis are transmitted securely via HTTPS and are processed in real-time. We do not store, retain, or have access to your uploaded documents after processing is complete.
4. Gmail Access and Google API Services
The Gmail Scan feature is strictly opt-in. It is disabled by default and is only activated when you explicitly connect your Google account via Google's OAuth consent screen. You can disconnect at any time from the App (Settings → Disconnect Gmail) or from your Google Account permissions page.
4.1 Scope of Access
When you connect Gmail, the App requests the following Google API scope:
https://www.googleapis.com/auth/gmail.readonly — read-only access to your Gmail messages and metadata.
We use this scope for the sole purpose of identifying subscription-related emails (receipts, invoices, renewal notifications) within the last 12 months.
4.2 What We Read and What We Do With It
- The App searches your mailbox for emails likely to contain subscription information using keyword-based queries (e.g. "receipt", "invoice", "subscription", "renewed").
- Matching emails are filtered client-side using heuristic signals (currency amounts, billing sender patterns, known service names).
- Only a small, filtered subset of candidate emails (headers and body text) is sent to OpenAI's API for subscription extraction. Emails that do not match our filters never leave your device.
- Extracted subscription information (service name, amount, currency, billing cycle, date) is shown to you for confirmation. You decide which detected subscriptions to add to the App.
4.3 Limited Use Disclosure (Google API Services)
SubLess's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- No resale: We do not sell or transfer Google user data to any third party for advertising, credit-worthiness, or any other purpose.
- No human review: No human at SubLess reads your emails. All processing is automated. We do not read, review, or manually inspect your Gmail content, except as necessary for the limited purposes expressly permitted by Google's policy (e.g. security investigations, compliance with law, or with your explicit consent).
- No AI/ML training: Your Gmail data is not used to develop, improve, or train generalized or non-personalized AI and/or machine learning models. Emails are processed in real-time to extract subscription details and are not retained afterwards.
- No data retention on our servers: SubLess does not operate any server that stores your Gmail content. All Gmail processing happens on your device; the only outbound transfer is sending filtered email content to OpenAI's API for subscription extraction.
- Transfer to OpenAI: Filtered email content is transmitted to OpenAI's API over HTTPS solely to extract subscription metadata. OpenAI does not use API data to train its models (per OpenAI's Enterprise Privacy terms) and retains API request data for a limited period for abuse monitoring only.
4.4 Token Storage
Google OAuth access and refresh tokens are stored securely in the iOS Keychain on your device. They are never transmitted to SubLess-operated servers. Tokens are automatically deleted when you disconnect Gmail from the App.
4.5 Revoking Access
You can revoke SubLess's access to your Gmail at any time:
5. Third-Party Services
We use the following third-party services:
6. Data Retention
Your subscription data remains on your device and your iCloud account. You can delete all data at any time through the App's Settings. When you delete your data, it is permanently removed from your device and iCloud.
Gmail content is not retained by SubLess. It is processed in memory during a scan and discarded immediately after subscription details are extracted. Only the final detected subscriptions that you choose to add are stored on your device.
7. Children's Privacy
SubLess is not intended for children under the age of 13. We do not knowingly collect personal information from children.
8. Your Rights
You have the right to:
- Access all data stored on your device through the App.
- Delete all your data at any time through Settings → Delete All Data.
- Disable iCloud sync through your device's Settings.
- Opt out of push notifications at any time.
- Connect or disconnect your Gmail account at any time. See Section 4.5.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any significant changes through the App or on this page. The "Effective Date" at the top reflects the latest revision.
10. Contact Us
If you have questions about this Privacy Policy, please contact us at:
[email protected]