Privacy Policy

• Read-only access. We can never send, delete, or modify your email.
• Process and discard. Email bodies are parsed in memory and discarded. We do not store the content of your emails.
• We keep only extracted facts: merchant name, amount, currency, charge date, and the email’s subject line and message reference — so every detected subscription can show its evidence.
• No bank linking, no selling data. We never connect to your bank and we never sell or share your data for advertising.
• One-click deletion. Disconnect your inbox anytime and optionally delete everything we derived from it.

When you connect a Google account, we request the read-only Gmail scope (gmail.readonly). We use it to run targeted searches for billing emails — receipts, invoices, and renewal notices from known subscription merchants — and to read the matching messages. We do not read your mailbox broadly, and the permission technically cannot send, delete, or alter anything.

From each billing email we extract and store: merchant, amount, currency, and charge date, plus the email’s subject line, sender, and message reference so you can always see which emails produced a detected subscription.

We do not store email bodies. They are processed in memory during a scan and discarded. This is architectural, not a policy choice: our systems and staff cannot display content that was never persisted.

We also store your account details (name, email address, sign-in identity), your connected inbox address and its encrypted access credential, your plan and billing status, and the subscriptions, price changes, and cancellation requests derived for you.

Some billing emails from merchants we don’t yet recognize are analyzed by an AI model (Anthropic’s Claude, via API) solely to extract the merchant, amount, and date. The content sent for extraction is subject to the same process-and-discard rule, and it is not used to train AI models.

SubZero’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Gmail data is used only to provide the subscription-detection features you see in the product; it is never used for advertising, never sold, never transferred except to provide those features (see subprocessors below), and never used to train generalized AI models. Humans do not read your Gmail data except with your explicit consent for support, where required for security or legal reasons, or in aggregated, anonymized form.

We use a small set of infrastructure providers, each only for what it says:

• Vercel — application hosting
• Cloudflare — database hosting (Cloudflare D1) for the extracted facts only, never email bodies; encrypted at rest
• Clerk — sign-in and account identity
• Google — OAuth and Gmail API access you grant
• Stripe — payments (we never see your card details)
• Anthropic — AI extraction of billing facts (no training on your data)

Inbox credentials are encrypted at rest with per-user keys (AES-256-GCM); all traffic is encrypted in transit. OAuth tokens and encryption keys are never displayed in any interface, including our own admin tools.

Your data is kept while your account is active. You can disconnect an inbox at any time — the access credential is discarded immediately — and choose to also delete everything derived from it (charges, subscriptions, evidence, price history). Deleting your account removes all of the above. Revoking SubZero’s access from your Google Account settings has the same effect on access.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data. The product exposes the important ones directly (view evidence, disconnect, delete); for anything else, contact us and we’ll handle it.

If this policy changes materially, we’ll note it here with a new date. Questions or requests: support@subzero.o2c.one.