Subswell Privacy Policy

Who is responsible for your information

Bing Zhang is the individual operator of Subswell, the party responsible for processing personal information, and its privacy officer. For privacy questions, access, correction, copying or deletion requests, or complaints, contact subswell@outlook.com. You may use “Subswell privacy request” as the subject. This Policy explains our information handling. Third parties have their own policies for their services; those policies do not reduce our responsibility for our own processing.

You can record subscriptions on your device without registering. Below, we distinguish on-device storage, network requests needed for features, and cloud sync for members. Being signed out does not mean that every feature works without network access. Reading this Policy does not grant every permission or replace any separate consent required by law.

Subscription records and images

Subscription names, plans, categories, amounts, currencies, billing cycles, start and renewal dates, statuses, notes and icons, together with payment, refund, plan-change and recently deleted records that you enter or generate through your actions, are saved on your device first. They support recordkeeping, reports, reminders and recovery.

When a member is signed in, these records for the current account are automatically synced to Tencent Cloud so they can be retrieved on another device. Records saved while signed out are included only after you choose “Link existing subscriptions on this device” to assign them to the account. Other accounts’ records are not assigned to the current account. Offline changes awaiting upload are temporarily held in a queue on the device.

Custom icons use images you select through the system photo picker. The selected image is resized and saved as an icon, and is uploaded with the subscription when it syncs. This does not give us access to your entire photo library. Please do not put passwords, identity documents, bank card details or other sensitive information unrelated to recordkeeping in names, notes or images.

Email, sign-in and device preferences

When you register, sign in, or set or reset a password, Tencent CloudBase Authentication receives your email address, verification code and verification reference. When you use a password, it also processes the password submitted for registration, verification or reset. Account identifiers, a randomly generated installation identifier and sessions identify your account, keep you signed in and support security. Verification codes are delivered to your chosen email address through an email service; your email provider also processes the message.

The App sends account requests over an encrypted connection and stores the installation identifier and sign-in session credentials in the system Keychain. It does not write passwords into subscription records. Signing out clears the current device’s sign-in credentials but does not delete the cloud account.

After a successful sign-in, up to three recent email addresses are stored on the device as input suggestions. They remain after sign-out; you can remove each one using the × beside the suggestion. Appearance, display currency, icon-recognition preferences and confirmation of agreement versions are also saved on the device. You confirm your age range; we do not collect your full date of birth or identity documents for this purpose.

Icon recognition and exchange rates

The built-in directory of common subscriptions and local matching of names and plans run on your device. When online recognition is enabled, after you pause typing a name, the App may send the subscription name and the device’s region code to Apple’s search service if local results are insufficient. This helps find icons and categories. A manual search sends the name in the search field. Previewing or selecting an online icon also requests the image. These requests do not include your account email, amount, billing cycle or notes, but the recipient receives network information needed for the connection, such as your IP address.

You can turn off online recognition in the subscription icon menu. You can still enter names, categories and icons manually. Matches may be incorrect, and you can change them.

For reports across currencies, the App sends currency codes to the public Frankfurter exchange-rate API and caches the rates and their dates on the device. It does not send your email, subscription names, amounts, notes or billing periods. Pages with multiple currencies may request rates automatically. Network infrastructure still processes communication information: excluding bill amounts does not mean that no network data is processed.

Reminders, purchases and support

Local notifications or alarms use subscription names, dates and local record identifiers to schedule and open reminders. The operating system manages notification permission. Relevant subscription reminder settings may sync with the record, but permission is required separately on each device. Lock-screen notifications may show subscription names; you can adjust notification previews in system settings.

Apple processes membership payments. Subswell uses membership products, transaction identifiers, purchase and expiry times, refund status and an identifier corresponding to your Subswell account to verify access to paid features, restore purchases, prevent duplicate entries and automatically record your Subswell membership subscription. We do not receive your bank card number or Apple Account password. Apple handles its own purchase and financial records under its rules.

When you contact support, we process your sender address, description of the issue, attachments and correspondence to respond, troubleshoot and handle complaints. Our support mailbox uses Microsoft Outlook. Please do not send passwords, verification codes or unnecessary sensitive material. When you export bill details, the receiving app or save location you choose receives the file; you decide how to share it.

Your choices and reasons for processing

Account verification, cloud sync you choose to use, and membership verification provide the respective services. Local records, reports and reminders provide the features you request. We process necessary information for account and service security, troubleshooting and legal obligations only as permitted by applicable law. Where optional processing relies on consent, you may withdraw it without affecting lawful processing before withdrawal.

You can turn off online recognition or individual reminders, or withdraw permissions such as notifications in iOS Settings. Declining photo or notification permission does not prevent basic recordkeeping. You can use local features without registering. Signing out stops further sync for that account on the device but does not delete uploaded information. To withdraw authorization needed for account services and delete cloud information, use account deletion on the account page opened from the profile button, or contact us for help.

The App does not read system contacts, the system calendar, your microphone or precise location, and does not connect to bank accounts. We do not sell personal information, use it for targeted advertising, track you across apps for advertising, or make solely automated decisions that have legal or similarly significant effects on you. Category suggestions are only assistance that you can change.

Service providers and information protection

We remain responsible for processing entrusted to providers. We require providers receiving data to process it only for the stated purposes and to the extent necessary, with protection no less than this Policy and applicable requirements. Outsourcing does not permit broader uses. For independent third-party processing, we also meet our applicable notice, lawfulness and security duties. If necessary protection cannot be achieved, we must stop the relevant transfer or adjust the service. When providing necessary information to competent authorities as required by law, we review the legal basis and limit its scope.

Tencent CloudBase: Tencent Cloud Computing (Beijing) Co., Ltd. provides account authentication, verification emails and cloud sync stored by account. The production subscription database uses the Shanghai region in mainland China. The account and subscription sections above describe the data received. Customer business data is distinct from the developer’s own Tencent Cloud account information and is handled under the purchased service’s terms. See Tencent Cloud’s customer data notice and its privacy statement and contact channels. You can also send related requests to our email address.

Apple: Apple Inc. and the Apple entities providing services in each region provide the App Store, membership transactions, search, images and related services, with the data described above. Apple’s processing facilities may be in the United States, Ireland and other countries or regions. See Apple’s Privacy Policy and privacy contact page for rights requests. This Policy does not give us access to your other Apple purchase records.

Frankfurter: We use the public exchange-rate API at api.frankfurter.dev. Its open-source project maintainer provides the public service, using Cloudflare for caching and network protection. Its official privacy information states that the API does not collect or log personal data, IP addresses or request URLs and provides only aggregate traffic statistics. This does not mean that communications avoid network infrastructure. You can use the project contact channel for API questions. For your own privacy requests, you can contact us first without posting personal details publicly.

Microsoft Outlook: Microsoft Corporation and applicable affiliates provide our support email service and process the emails and attachments you send. Data may be stored and processed in the United States and other locations where Microsoft operates facilities, not only in Shanghai where the subscription database is located. See Microsoft’s Privacy Statement and privacy contact information. Not contacting support does not affect on-device recordkeeping.

Cloudflare Pages: Cloudflare, Inc. and applicable affiliates provide hosting, content delivery and network protection for our public policy pages. When you visit those pages, Cloudflare processes IP addresses and network information such as requests, routing, and device or system configuration to deliver and protect the web service. Its privacy policy states that information is primarily stored in the United States and the European Economic Area and may also be accessed and processed in other operating locations. The pages do not require a Subswell sign-in; reading them does not upload your subscription records, account password or verification codes to Cloudflare. The policy pages we upload contain no advertising or third-party analytics scripts. See Cloudflare’s Privacy Policy and contact channels.

Retention, deletion and backups

Records in normal use: Local information is kept while you retain it. Synced account information is kept while the account exists and as needed to provide the relevant service, until deletion of records or the account. Membership expiry alone does not delete the account or uploaded records. We do not retain information that is no longer needed indefinitely merely because it might be useful.

Deleting an individual subscription: You can restore it from “Recently Deleted” for 30 days. After that period it cannot be restored through that feature. Expired records are removed locally when the App runs its cleanup. After a synced deletion reaches the cloud, a weekly cloud cleanup removes subscription content and historical sync copies whose recovery period has expired. Network or service interruptions or a cleanup backlog may delay actual removal. “Recoverable for 30 days” therefore does not mean every copy disappears instantly on day 30.

The cloud keeps deletion markers without names, notes or bill content to prevent old devices from uploading deleted records again. These markers remain associated with the account until account deletion. A deletion on an offline device reaches the cloud only after the device reconnects and syncs successfully.

Account deletion: After confirmation, the business database removes the account’s subscriptions, payments, plan changes, sync receipts and deletion markers. The current device clears the account’s records and pending uploads. If local cleanup is incomplete, necessary cleanup tasks remain for retry; the account is not treated as a normal account that can continue to be used. Copies on other offline devices cannot be erased remotely and immediately. Please complete cleanup when those devices reconnect, or remove the App’s data on them. Registering the same email again does not restore the old account.

Local safety copies: To reduce the risk of data loss from storage problems, the App may create recovery copies when opening its local database. It normally keeps the latest seven verified copies, not a fixed seven days. Older migration copies or original files affected by faults may be kept longer for recovery checks. They are not the “Recently Deleted” recovery feature. Account deletion also clears that account’s records from these copies under our control on the current device. We can help with requests to delete local information but cannot remotely read information stored only on your device.

Service logs and providers’ internal copies: Sign-in verification, security, troubleshooting or legal requirements may generate necessary records and disaster-recovery copies. Retention depends on security incident handling, applicable retention duties and the provider’s deletion and rotation arrangements. It is distinct from the 30-day subscription recovery period. We keep information under our control only for the relevant purpose, then delete or anonymize it when the purpose or retention period ends. Where law or technical constraints temporarily prevent deletion, use is restricted to necessary storage and security, not new business purposes. Records independently processed by providers, such as Apple purchase accounting records, are retained under their policies; use the channels above to request access or deletion.

Support emails: Correspondence and attachments for ordinary enquiries are retained for 90 days after resolution and then removed in monthly cleanup. Unresolved complaints or materials legally required to be kept are retained only for as long as needed for that matter, and cleared when the reason ends. The email provider’s own deletion and retention mechanisms are subject to its policy.

Sign-in and copies you keep: Signing out clears local session credentials. Recent email addresses can be removed individually from suggestions. Exported bill files, copies you make and device system backups are controlled by you and the relevant services; deletion within the App does not automatically remove them all. Uninstalling is not account deletion, and the system Keychain may retain some credentials after uninstalling. Use sign-out or account deletion for the relevant action.

Processing inside and outside mainland China

The subscription cloud database is in Shanghai, mainland China. This does not mean that email delivery, Apple search and transactions, Frankfurter network services, Outlook support emails or visits to Cloudflare-hosted pages are all processed in mainland China. If you use account sync from abroad, information is also transferred to that mainland China database. Your language and display currency do not change where data is stored.

We handle international transfers under applicable law, meeting requirements for recipient disclosures, impact assessments, contracts or other safeguards and separate consent where necessary. Accepting this Policy does not replace conditions that must legally be met before a transfer. The relevant transfer service may be provided only after those conditions are satisfied. Contact us to ask about recipients, safeguards and their scope as they relate to you, and to exercise your rights.

Your rights and how we handle requests

In the App, you can view, correct and delete subscriptions, restore recently deleted records within the recovery period, remove recent email addresses, disable online recognition and reminders, withdraw system permissions or delete your account through the profile page. Bill export is a membership feature, but buying a membership is not required to make a legally available request for access, a copy of personal information or data portability.

You can also contact subswell@outlook.com to request access, copying, correction, deletion, restriction of processing, withdrawal of consent, and portability, objection or other rights available under applicable law. Please explain the request and account involved. We verify identity in proportion to the risk and do not ask for passwords, verification codes or unrelated identification. For information stored only on your device that we cannot access, we explain the limitation and help you handle it locally.

We respond within 15 working days of receiving a request, or sooner where applicable law requires. If necessary information is missing, a lawful extension is needed or we cannot fulfil all of the request, we explain the reason, basis and further remedies within the applicable deadline. Requests are generally free; we explain any exception expressly allowed by law. We do not unfairly discriminate against you for exercising privacy rights.

Regional provisions

Read this section according to applicable law and your location, not the App’s interface language. Provisions for other regions do not reduce rights in your own region.

Mainland China: Your rights include being informed, making decisions, restricting or refusing processing, accessing, copying, correcting and deleting information, and requesting explanations of processing rules. Separate consent is obtained for international disclosures or other processing where required by law. You may complain or seek remedies from the competent personal information protection authority or courts.

United States: We do not sell personal information or share it for cross-context behavioural advertising. You can use the email above to exercise access, correction, deletion, portability, authorized-agent and appeal rights granted by applicable state law. If you disagree with a decision, you can request review and information about local complaint channels.

Canada, Australia and New Zealand: Subject to applicable law, you may request access, correction or deletion, withdraw consent where it can be withdrawn, or object to relevant processing. You can complain to our privacy officer first and may also seek remedies from the competent local privacy authority as provided by law. This Policy does not limit stricter local protections, deadlines or consumer rights. Legally applicable rights in other regions are not excluded simply because they are not separately listed here.

Security, young people and updates

The App uses HTTPS to access the listed network services and stores session credentials in the system Keychain. We use access controls, account isolation and security measures proportionate to the risk, but do not promise that any system is risk-free or describe system protection as separate encryption of all local information. We take remedial action and give notifications and reports as required by law when a security incident occurs.

The App is for users aged 16 and over, is not directed at children, and does not offer accounts or recordkeeping services to those under 16. You must confirm your age range before first using the relevant features, but this is not identity verification. If we discover information mistakenly collected from someone under 16, we investigate, stop the relevant processing and delete it as required by law. The individual or their guardian may contact us at the email above. Users aged 16 or over who are still minors under local law remain subject to local guardianship and other protections.

We show the date of policy updates. Material changes to purposes, processing methods, information categories or important recipients will be appropriately brought to your attention, with renewed consent where required by law. We do not use policy revisions to retroactively authorize new purposes. Operator: Bing Zhang. Contact: subswell@outlook.com.