Privacy Policy

Last updated: 31 July 2026

Substrack ("we", "us") helps you discover and monitor recurring subscriptions found in your email. This policy explains what we collect, how we use it, and the choices you have. Questions: noreply@hyperbytes.in.

Information we collect

• Account details — your email address, name, and a hashed password (or your Google account identifier if you sign in with Google).
• Connected Gmail accounts — for each inbox you connect, we store the Gmail address and an encrypted OAuth token that grants read-only access.
• Email data we process — we search only for billing/receipt-type messages and read their metadata and short snippets (sender, subject, date, preview). We do not download or store full email bodies.
• Derived subscription data — service name, price, billing cycle, category, and which connected account it came from.

How we use your data

• To detect subscriptions, we send email metadata and snippets to an AI model (an OpenAI-compatible provider) for classification. You may configure your own model provider in Settings.
• To operate your account: authentication, showing your dashboard, and sending transactional email (verification, password reset) via our email provider.

Google user data — Limited Use

Substrack's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request the gmail.readonly scope solely to identify subscription-related emails. We do not sell this data, do not use it for advertising, and do not use it to train generalized AI models.

Sharing

We do not sell your data. We share the minimum necessary with service providers that operate the product: Google (authentication and Gmail access), our AI model provider (email metadata/snippets for classification), and our email provider (Resend, for transactional email). Hosting is on our own infrastructure.

Security & retention

OAuth tokens and any custom API keys are encrypted at rest. Access is over HTTPS. We retain your data while your account is active. You can delete any connected inbox at any time, or delete your entire account (which permanently removes your inboxes, stored tokens, and subscription data) from Settings.

Your choices

• Disconnect a Gmail account anytime on the Accounts page.
• Revoke access directly at Google Account permissions.
• Delete your account and all data from Settings.

Changes

We may update this policy; material changes will be reflected by the date above.