Privacy Policy
SubTrack Pro is a subscription manager. This policy explains what information the app collects, how it uses each Google permission it asks for, and how to delete your data.
Last updated: August 14, 2026
Our Commitment to Privacy
SubTrack Pro is a subscription management application that helps you keep track of the recurring payments you have — what each costs, when it renews, and when a price changes. At SubTrack Pro, we believe that privacy is a fundamental right. We are committed to being transparent about our data practices and giving you control over your personal information. This Privacy Policy applies to all users of the SubTrack Pro application and website (collectively, the "Service").
Google User Data
SubTrack Pro’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
SubTrack Pro requests two Google permissions beyond basic sign-in. Both features that use them are optional and opt-in — the app is fully usable without granting either.
| Scope | Why SubTrack Pro needs it |
|---|---|
gmail.readonly |
To read subscription billing emails (receipts, invoices, renewal notices) so SubTrack Pro can identify which subscriptions you pay for, how much they cost, and when they renew, and offer them to you for import. |
calendar.app.created |
To create a dedicated secondary calendar named “SubTrack Pro” in your Google Account, to find that calendar again on later syncs, and to create, update and delete the renewal events SubTrack Pro writes inside it. This permission reaches only calendars SubTrack Pro created — it grants no access to your existing calendars. |
Google user data is never sold, rented, or shared with data brokers; never used for advertising or personalisation; and never used to develop, train, or improve any artificial intelligence or machine learning model. The sections below explain each integration in full.
Gmail Access (gmail.readonly)
When it happens
Never automatically. Gmail is accessed only after you open the subscription import screen inside SubTrack Pro and press “Connect Gmail and scan”, and then complete Google’s consent screen. Each scan requires a fresh, explicit authorisation.
What we request from Gmail
SubTrack Pro does not request your whole mailbox. It sends Gmail a narrow search restricted to likely billing mail: messages from known subscription providers and payment processors (for example Stripe, PayPal, Paddle, Apple), messages from billing-style addresses such as billing@, receipts@ or invoice@, and messages whose subject lines contain receipt, invoice, renewal or payment keywords. Promotional, social and forum categories are excluded, as are subjects that clearly are not receipts. The search is limited to roughly the last two years and to a maximum of a few hundred messages per scan. Only messages matching that search are ever retrieved.
What we do with them
Matching messages are retrieved directly from Google to your browser. Their sender, subject, date and text body are analysed in your browser using fixed keyword and pattern rules — no artificial intelligence or machine learning is involved — to extract the merchant name, charge amount, currency and charge date. Those extracted values are grouped into suggested recurring subscriptions and shown to you for review.
What we store, and what we do not
Gmail message content is never transmitted to SubTrack Pro’s servers and is never stored anywhere. It exists only in your browser’s memory for the duration of the scan and is discarded when you close the import window or leave the page. The only data that is saved is the subscription records you explicitly select and confirm on the review screen — service name, amount, billing cycle, next payment date, category, and a short plain-text note describing how the subscription was detected (for example, “Subscription imported from email. Detected 6 charges from the same merchant”). We also store a timestamp of when your last scan ran, so the app can suggest re-scanning later. No email addresses, message bodies, subjects, attachments or message identifiers from your mailbox are retained.
Tokens
The Gmail access token issued by Google is short-lived, is held only in the memory of the browser tab performing the scan, and is discarded when the scan finishes or the window is closed. SubTrack Pro does not request a Gmail refresh token and cannot access your mailbox in the background or when you are not using the app.
What SubTrack Pro cannot do
The gmail.readonly scope is read-only. SubTrack Pro cannot send, reply to, modify, label, archive or delete any message in your mailbox.
Google Calendar Access (calendar.app.created)
When it happens
Never automatically. Google Calendar is accessed only after you connect it from SubTrack Pro’s settings and complete Google’s consent screen.
What we do
On connection, SubTrack Pro creates one secondary calendar in your account named “SubTrack Pro”, and on later syncs looks it up again by the identifier Google gave it at creation. It then writes one all-day event per tracked subscription onto that calendar, on the subscription’s next payment date, with a recurrence rule matching its billing cycle (weekly, bi-weekly, monthly, quarterly or yearly). The event title is the service name followed by “Payment”, and the description contains the amount, billing cycle, category and any note you added in SubTrack Pro. If you have enabled reminders for a subscription, the event carries Google reminders one day and one hour before the charge. When you edit, cancel or delete a subscription in SubTrack Pro, the corresponding event is updated or removed.
What we do not touch
SubTrack Pro requests the calendar.app.created permission, which by design grants access only to calendars this application created. Your personal, work and shared calendars are therefore outside the permission entirely — SubTrack Pro cannot read, list, move, edit or delete them even in principle, not merely as a matter of policy. Within its own calendar, SubTrack Pro touches only the renewal events it wrote.
What we store
Because calendar sync continues while you use the app, SubTrack Pro stores your Google Calendar OAuth access token, refresh token, token expiry, and the identifier of the SubTrack Pro calendar in our database (hosted on Supabase, encrypted at rest, protected by row-level security so only your account can read your row). We also store, alongside each subscription, the Google event identifier of the event we created for it, so we can update the right event later. No event content from any other calendar is stored.
Disconnecting and deletion
Disconnecting Google Calendar in SubTrack Pro deletes the events SubTrack Pro created, clears the stored event identifiers, and deactivates the stored tokens. You can also revoke SubTrack Pro’s access at any time from your Google Account permissions page; SubTrack Pro then stops syncing and the stored tokens become unusable. Deleting your SubTrack Pro account deletes the stored tokens along with the rest of your data.
Information We Collect
Account Information
When you create an account, we collect your name, email address, and authentication credentials. If you sign in with Google, we receive your basic Google profile information (name, email address and profile picture) for the purpose of creating and authenticating your SubTrack Pro account. Signing in with Google by itself grants no access to your Gmail or your calendars — those are separate, optional permissions you are asked for individually, only when you choose to use the Gmail import or Google Calendar sync features, and they are described in full in the two sections above.
Subscription Data
We collect information about the subscriptions you track, including service names, billing amounts, renewal dates, and categories you assign.
Usage Information
We automatically collect information about how you use SubTrack Pro, including features accessed, time spent, and interaction patterns to improve our service.
Device Information
We collect device type, operating system, browser type, and IP address to optimize your experience and ensure security.
How We Use Your Information
Service Delivery
We use your information to provide, maintain, and improve SubTrack Pro, including tracking your subscriptions, sending reminders, and generating analytics.
Communications
We may send you service-related notifications, renewal reminders, and occasional product updates. You can manage your notification preferences at any time.
Security & Fraud Prevention
We use your information to detect, prevent, and respond to security incidents, fraud, and other harmful activities.
Analytics & Improvements
We analyze usage patterns to understand how users interact with our service, identify issues, and develop new features.
Data Security
Encryption
All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. Your sensitive information is protected with industry-leading security standards.
Access Controls
We implement strict access controls and authentication mechanisms. Only authorized personnel can access user data, and all access is logged and monitored.
Infrastructure Security
Our infrastructure is hosted on secure, SOC 2 compliant cloud providers with regular security audits and penetration testing.
Incident Response
We maintain comprehensive incident response procedures and will notify affected users of any security breaches in accordance with applicable laws.
Data Sharing & Third Parties
Service Providers
We share data with trusted service providers who assist in operating our service, including cloud hosting, email delivery, and analytics providers. These providers are contractually bound to protect your data.
Payment Processing (Stripe)
If you subscribe to a paid plan, your payment is processed by Stripe, Inc. (“Stripe”), a PCI‑DSS Level 1 certified payment processor. We share with Stripe the information needed to create your account and process payments — your name, email address, billing address, and a Stripe customer identifier we store on our side. SubTrack Pro never sees, stores, or transmits your full card number, CVC, or bank details; those are entered directly into Stripe’s hosted payment form and held only on Stripe’s infrastructure. Stripe acts as an independent data controller for the payment data it collects and is governed by its own Privacy Policy.
Legal Requirements
We may disclose information when required by law, legal process, or government request, or to protect the rights, property, or safety of SubTrack Pro, our users, or others.
Business Transfers
In the event of a merger, acquisition, or sale of assets, user information may be transferred. We will notify users of any such change and any choices they may have.
No Sale of Personal Data
We do not sell, rent, or trade your personal information to third parties for their marketing purposes. Google user data — whether obtained through Google Sign-In, the Gmail API, or the Google Calendar API — is never sold, rented, or transferred to third parties, and is never shared with data brokers, advertisers, or analytics providers.
Google User Data Is Not Shared With Our Own Service Providers
Gmail message content is processed entirely in your browser and never reaches our servers or any of our service providers. Google Calendar tokens are stored only in our own database (Supabase); no third party receives them. Google user data is never sent to Stripe, to our analytics or email providers, or to any other processor.
No Use for Advertising or AI Training
We do not use your data — including any Google user data — for targeted advertising, personalized advertisements, or to train, improve, or build artificial intelligence or machine learning models. SubTrack Pro’s subscription detection uses fixed keyword and pattern rules, not machine learning. All data use is strictly limited to providing the user-facing features of SubTrack Pro described in this policy.
Your Rights & Choices
Access & Portability
You can access and download your personal data at any time through your account settings. We provide your data in a commonly used, machine-readable format.
Correction & Deletion
You can update your account information at any time. You may also request deletion of your account and associated data by contacting us.
Marketing Opt-Out
You can opt out of marketing communications at any time by clicking the unsubscribe link in emails or adjusting your notification preferences.
Cookie Preferences
You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect service functionality.
Data Retention
Active Accounts
We retain your data for as long as your account is active and as needed to provide you with our services.
Account Deletion
When you delete your account, we remove your personal data within 30 days, except where retention is required for legal or legitimate business purposes.
Backups
Data in backups may be retained for up to 90 days for disaster recovery purposes, after which it is permanently deleted.
Gmail Data
Zero retention. Gmail message content is held only in your browser’s memory during a scan and is discarded the moment the scan finishes or the window is closed. The Gmail access token is discarded at the same time. Nothing derived from Gmail is retained except the subscription records you explicitly confirmed, which are ordinary SubTrack Pro subscription entries you can edit or delete at any time.
Google Calendar Data
Your Google Calendar tokens and the SubTrack Pro calendar identifier are retained for as long as the integration is connected. Disconnecting the integration, revoking access from your Google Account, or deleting your SubTrack Pro account removes them; disconnecting from within SubTrack Pro also deletes the calendar events SubTrack Pro created.
How to Delete Google Data
You can disconnect Google Calendar at any time from SubTrack Pro’s settings, revoke all of SubTrack Pro’s Google permissions at myaccount.google.com/permissions, or request full deletion of your SubTrack Pro account and all associated data by emailing privacy@subtrackpro.ca. Account deletion requests are actioned within 30 days.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
Email: privacy@subtrackpro.ca
Website: www.subtrackpro.ca
Address: SubTrack Pro, Canada