Privacy Policy
Last updated: June 22, 2026
The short version: SubForge never sees your bank credentials, never shows ads, and never sells your data. Bank linking is optional and read-only — it runs through Plaid, helps surface recurring charges and bank-attention states, and without it SubForge touches no financial accounts at all. Your subscriptions, your data, your call. That's the deal.
1. Who we are
SubForge ("SubForge," "we," "us") provides a subscription-tracking application for iOS and the website subforge.ai. Questions about this policy: support@subforge.ai.
2. Information we collect
- Account information. SubForge requires an account so your subscriptions can be monitored, synced, and backed up. We collect your email address and — if you sign in with Apple or Google — the name those providers share, plus an internal account identifier.
- Subscription records you enter. Service names, prices, billing cycles, renewal dates, categories, and notes that you type into the app. These are stored in our cloud database (Google Firebase) and synced across your devices.
- Optional bank connection (Pro). If you choose to connect a bank account for automatic subscription detection, the connection is made through Plaid, a regulated financial data network. You authenticate directly with your bank inside Plaid's secure interface — SubForge never sees or stores your bank credentials. From the connection we receive and store only read-only recurring-charge information (merchant, amount, billing cadence, dates, institution names, and account metadata needed to manage your connected banks) used to suggest subscriptions and alert you when a bank needs attention, plus secure access tokens kept server-side, encrypted at rest, and inaccessible to client apps. You can disconnect a bank at any time in Settings, which revokes its Plaid access token and deletes that token and stored connection metadata for that bank; subscriptions you already chose to track remain unless you delete them. Plaid's handling of your data is described in Plaid's End User Privacy Policy.
- Purchase information. If you buy SubForge Pro, the transaction is processed entirely by Apple's App Store, and by Google Play if Android becomes available. We (via our subscription-management provider, RevenueCat) receive receipt tokens that confirm your entitlement. We never see your card details.
- Push notification tokens. To deliver bank-powered alerts, SubForge registers your device with Firebase Cloud Messaging and stores a device-specific push token. This token is used only to route notifications to your device.
- Crash and diagnostic data. We use Google Firebase Crashlytics to detect and fix crashes: when the app crashes it sends a diagnostic report including the error, a stack trace, device model, OS version, and app version. SubForge does not use analytics or advertising SDKs, and this data is never used to track you across other companies' apps or websites.
- Activity history. SubForge stores app and bank-powered activity events, such as alerts, imports, bank attention, and disconnect history, so the Home Activity feed can show recent account history. The app displays the newest 100 events; older events may remain in your account history until bank/item cleanup or account deletion.
3. What we never collect
- Your bank credentials — even with an optional bank connection, sign-in happens directly between you and your bank via Plaid; SubForge never receives usernames, passwords, or full account numbers.
- Bank data of any kind unless you explicitly connect an account — without a connection, SubForge has no access to financial accounts at all.
- Screenshots, PDFs, and CSVs you import are used only for the import you initiate. Screenshot text is processed on-device, and imported files are not stored by SubForge. If you add a candidate, only the resulting subscription record is stored.
- Your contacts, photos (beyond the screenshot you explicitly pick, which stays on-device), or location.
- Advertising identifiers for cross-app tracking. SubForge contains no third-party advertising.
4. How we use information
To provide the service (sync, backup, restoring purchases), to send the renewal and trial reminders you configure, to respond to support requests, and to improve the app. Local renewal and trial reminders are scheduled on your device. Server-sent push notifications are used for bank-powered alerts such as price changes, duplicate subscriptions, new recurring charges, stopped-charge prompts, new bank accounts, bank disconnects, and reconnect requests. We do not sell or rent personal information, full stop.
5. Sharing
We share data only with the service providers that make SubForge run: Google Firebase (authentication, database, and crash reporting — acting as our processor, including Firebase Cloud Messaging for push alerts), Plaid (optional bank connections, as described above), RevenueCat (purchase entitlements), and Apple/Google (payment processing). We may disclose information if required by law. If SubForge is ever acquired, data would transfer under this same policy's protections. We never sell personal information.
6. Data retention & deletion
Your data is yours to destroy:
- In-app: Settings → Danger zone → Delete account permanently erases your account and all cloud data. Settings → Erase all subscriptions clears your subscription records at any time. Bank disconnect controls revoke Plaid access and remove bank connection data; accepted subscriptions stay in your list unless you delete them.
- By email: request deletion at support@subforge.ai and we'll complete it within 30 days.
7. Security
Data is encrypted in transit (TLS) and protected at rest by Google Firebase's infrastructure. Cloud records are isolated per account by security rules — your data is readable only by your authenticated account.
8. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information we maintain about you. If you are a California resident, these rights are guaranteed under the California Consumer Privacy Act (CCPA). We do not sell personal information or share it for cross-context behavioral advertising. To make a privacy request, email support@subforge.ai.
9. Children
SubForge is not directed to children under 13, and we do not knowingly collect personal information from them.
10. International users
SubForge is operated from the United States and data is processed on servers located there. By using SubForge you consent to that processing.
11. Changes
We'll post any changes to this policy here and update the date above. Material changes will be highlighted in the app.