Privacy Policy

1. Who we are

Subpulse is currently operated as an independent project during its beta phase. For any privacy question, contact us at privacy@getsubpulse.app.

2. Information we collect

• Account data: your email address and authentication credentials (managed by Supabase Auth), or your name, email and profile picture if you sign in with Google.
• Subscription data: the service name, amount, currency, billing cycle, next billing date, category and any notes you add - either entered manually or detected from an uploaded bank statement.
• Telegram data: your Telegram chat ID, stored only after you explicitly connect your Telegram account, so we can send you reminders.
• Technical data: IP address and request metadata, used briefly for rate limiting and abuse prevention.

3. How we process your bank statement

When you upload a PDF bank statement, the file is transmitted over an encrypted connection and read entirely in memory. We extract the text and send it to Anthropic's Claude API to identify recurring payments. The original PDF file is never written to disk or stored in our database. Once subscriptions are detected and shown to you for confirmation, the extracted text is discarded - we do not keep a copy of your statement.

4. How we use your information

• To show you your subscriptions and spending in the dashboard
• To send reminders before a subscription renews, via Telegram and/or email
• To detect subscriptions from a bank statement you choose to upload
• To keep the service secure and prevent abuse

5. Who we share data with

We use a small number of service providers ("subprocessors") to run Subpulse. We do not sell your data.

• Supabase - hosts our database and handles authentication
• Anthropic (Claude API) - analyzes the text extracted from a bank statement you upload, to detect subscriptions
• Telegram - delivers reminder messages you've opted into
• Resend - delivers transactional emails
• Vercel - hosts the application
• Each provider only receives the data necessary to perform its function, under its own privacy and security terms.

6. Legal basis for processing

Where GDPR applies, we process your data based on performance of a contract (providing the service you signed up for) and your consent (e.g. connecting Telegram, uploading a statement).

7. Data retention

We keep your account and subscription data for as long as your account is active. If you delete your account, your profile, subscriptions and connected Telegram data are permanently removed. Bank statement files and their extracted text are never retained in the first place - see Section 3.

8. Your rights

Depending on where you live (including under GDPR for EU/EEA users, and Ukrainian data protection law), you may have the right to:

• Access and export your data (Settings → Export data, or GET /api/user/export)
• Correct inaccurate data
• Delete your account and data (Settings → Delete account, or DELETE /api/user)
• Object to or restrict certain processing
• Withdraw consent at any time (e.g. disconnect Telegram)

9. Cookies

We use one essential cookie set by Supabase Auth to keep you signed in. We do not use advertising or analytics cookies, and we do not track you across other websites.

10. Security

Access to your data is restricted by row-level security policies in our database, so no user can read another user's data. All traffic is encrypted in transit (HTTPS). Administrative credentials that could bypass these protections are never used in client-side code.

11. International data transfers

Our service providers may process data outside your country of residence, including in the United States and the EU. Where required, we rely on the safeguards those providers offer, such as standard contractual clauses.

12. Children

Subpulse is not directed at children under 16, and we do not knowingly collect data from them.

13. Changes to this policy

We may update this policy as the product evolves. We'll update the "Effective date" above when we do.

14. Contact

Questions about this policy? Email privacy@getsubpulse.app.