Privacy Policy
Last updated: October 20, 2026
Suboptima is built privacy-first. The short version: we collect the minimum needed to run your account and the AI advisor, we don't sell your data, and you can delete everything yourself, whenever you want.
1. What we collect
When you sign up we store your email and an auth identifier. When you add subscriptions we store the details you enter — service name, price, currency, billing cycle, renewal date, category, and any notes. We also log activity (like "added a subscription") for your recent-activity feed. If you use the guest option, we store the same subscription data against an anonymous account with no email.
2. Authentication data
Sign-in is handled by Supabase. If you sign in with Google, we receive a verified email and a unique identifier — never your Google password. If you sign in with an email and password, your password is stored by Supabase in hashed form; we never see it.
3. AI features and Google Gemini
When you use the AI chat or the "Suggested for you" card, our server sends your active subscription data to Google Gemini, the AI provider we use, so it can write a response. That data includes each subscription's name, price, currency, billing cycle, category, days until renewal, and any notes you wrote, plus the messages you type into the chat. We do not send your email address or password. Google processes this data under its own terms and privacy policy. Please don't put sensitive personal information in your subscription notes or chat messages. The AI features only run when you use them, and you can use Suboptima without them.
4. What we don't do
We don't sell your data. We don't run ads. We don't share your subscription list with anyone except the service providers listed below, who process it only to run Suboptima. We don't read your email automatically or import bank transactions (yet).
5. Service providers
To run Suboptima we use: Supabase (database and sign-in), Vercel (hosting), Google (Gemini AI and Google sign-in), and Resend (sending reminder emails). Each receives only what it needs for its job. For example, Resend gets your email address and the renewal details in the reminder, and Supabase stores your account and subscription data.
6. Where data lives and how it is protected
Your data is stored in a Supabase database on secure cloud infrastructure and sent over encrypted connections. Our server only reads and changes the data of the signed-in account that makes a request. Your subscription list is not visible to other users.
7. Cookies and sessions
We use essential cookies to keep you signed in. No tracking cookies, no analytics that identify you across other sites.
8. Your rights
You can export your subscriptions as a CSV from the subscriptions page, correct them at any time, and delete individual subscriptions. You can change your email or password, and permanently delete your account, from Settings. If you need something we can't do from inside the app, such as a copy of all the data we hold about you, contact us and we'll help.
9. Email
We send you renewal reminder emails: a plain-text summary of subscriptions renewing in the next 7 days, sent daily while something is due. We also send account emails such as sign-up confirmation and password reset. We don't send marketing emails or a newsletter. Reminder emails can't be switched off in the app yet; deleting your account stops them.
10. Data retention and deletion
We keep your data while your account is active. When you delete your account from Settings, your subscriptions, activity history, notifications, settings, and your login are removed from our database right away. Our database and hosting providers may keep short-lived backups or technical logs, which are removed on their normal schedules. Copies already sent to Google Gemini or to Resend are handled under their own policies.
11. Changes to this policy
If we change how we handle your data in a material way, we'll tell you inside the app before it takes effect.