Privacy Policy

Effective October 8, 2026

The short version. Your bank statement is read on your own device and never uploaded. If you make an account, we keep your email address and the list the app builds (names, amounts, dates, which card). Payments are handled by Stripe; we never see your card number. We don't sell data, we don't run ads, and we don't use tracking cookies.

Who we are

Sneaky Subscriptions is made by Fancy's Apps, based in New York, USA. Questions about this policy go to [email protected].

What the app does with your statement

When you drop a bank or card statement (PDF or CSV), the file is opened and read by the app running in your browser or on your phone. The reading happens on your device. The file is not sent to us or to anyone else, and no copy of it is kept. The site runs under a browser rule (a Content Security Policy) that only allows it to talk to two places, our own site and the account service (Supabase) named below, which you can verify in your browser's developer tools.

From the statement, the app keeps only the charges you tick, and only their name, amount, date and which card they came from. Everyday purchases are counted toward the on-screen totals while the file is open but are not kept. Deposits, transfers and card payments are ignored.

What we collect, and why

Without an account: nothing. Your list lives in your browser's storage on that device. We don't see it.
With an account: your email address (to sign you in and send the 6-digit code), and your list (so it can follow you between your phone and your computer). The list is the names, amounts, dates, cards, categories, usage answers and notes you've entered or ticked. It's stored encrypted in transit and at rest.
If you pay: Stripe collects your card details on its own page and tells us only that you paid, which plan, and when it renews. We store a Stripe customer ID and subscription ID so we can show your plan and let you cancel. We never receive or store your card number.
If a friend used your link: we record that their account came from your referral code, so the free month can be applied.
Email we send: sign-in codes, and a receipt from Stripe each time a payment goes through. Nothing else unless you write to us first. No newsletters, no marketing.

What we don't do

No selling or renting of your data, ever.
No advertising, no ad networks, no analytics trackers, no tracking cookies.
No bank logins. We never ask for, and cannot accept, your online-banking password.
No reading of your phone's screen time or other apps.

Who else touches the data

We use a few services to run the app. Each one only sees what it needs for its job:

Supabase stores accounts and synced lists (database and sign-in), on servers in Canada.
Resend delivers the sign-in code emails.
Stripe processes payments and holds your card details under its own privacy policy.
Cloudflare hosts the site and, like any host, sees the technical details of each request (such as your IP address) in its logs.

None of these receive your statement, because your statement never leaves your device.

Storage on your device

The app keeps your list and your settings in your browser's local storage so it works offline and loads instantly. If you sign in, your session token is kept there too. Clearing your browser data removes all of it. "Clear everything" under Your data does the same for the list.

Your choices and rights

See your data: everything we hold about you is what you see in the app.
Delete the list on a device: Your data › Clear everything.
Delete your account and everything with it: email [email protected] from the address on the account. We delete it within 7 days and confirm by email.
Export: on request by email, until the export button ships.
Stop emails: sign-in codes only go out when you ask for one, and receipts only when you pay.

If you're in a place with specific privacy rights (for example California, the UK or the EU), those rights apply and the email above is how to use them.

How long we keep things

Your account and list stay until you delete them. Payment records stay as long as the law requires us to keep them. Server logs at our host roll off on their schedule, typically within days.

Children

Sneaky Subscriptions is for adults managing their own money. You must be 18 or older to make an account or pay. We don't knowingly collect anything from anyone younger; if that has happened, email us and we'll delete it.

Changes

If this policy changes in a way that matters, the date at the top changes and the app shows a note the next time you open it. The current version always lives at sneakysubscriptions.com/privacy.