Privacy Policy

Last updated: September 13, 2026 · Effective: September 13, 2026

This policy covers personal information used for the SubTap mobile app, subtapapp.com, our purchase funnel at quiz.subtapapp.com, and related customer support. It explains account data, subscription tracking, web payments, AI, analytics, and your choices.

SubTap does not connect to your bank account to track subscriptions. You enter tracking information yourself. Paying for SubTap on our website is a separate transaction processed by Stripe. Subscription billing and cancellation are explained in our Terms of Use.

1. Who is responsible for your information

APPTALKS LLC ("SubTap", "we", "us", or "our") is the commercial operator and the controller responsible for the processing described in this policy, including account services, web billing, subscription administration, and privacy requests.

APPTALKS LLC, 1007 North Orange Street, Wilmington, DE 19801, United States.
Contact: support@subtapapp.com.

ALLIE LTD, Emmanouil Roidi 44, Kirzis Center, 3031 Limassol, Cyprus (registration number HE 460424), develops the application. It may receive information needed for development, maintenance, and technical support on our behalf. Direct privacy and billing requests to APPTALKS LLC using the contact above.

This policy is a privacy notice. Reading it, using the app, or accepting the Terms does not give blanket consent to optional data uses. Where a particular activity requires consent, that consent must be obtained separately.

2. Information we collect and its sources

• Account and authentication: email, account identifier, optional name, currency, time zone, and sign-in records. Email sign-in uses verification codes or links. Where password sign-in is used, passwords are stored as hashes. Apple or Google sign-in, when available, provides the identifiers and account information you authorize that provider to share, which may include a name, email, or Apple relay address.
• Subscription records: service names, prices, currencies, billing cycles, renewal and trial dates, categories, usage information, payment-method labels, notes, and reminder preferences that you enter or update. These labels do not give us access to the corresponding bank, card, or provider account.
• Purchase-funnel information: answers and preferences you submit in the quiz, your checkout email, selected offer, and information needed to process your order and connect it to mobile access.
• Billing and access: Stripe customer, subscription, and transaction references, plan, amount, currency, payment status, paid-period dates, renewal status, cancellation and refund records, and any billing or tax information provided at checkout. We may receive limited payment-method information such as card brand and last four digits. Full card numbers and security codes entered in Stripe's payment fields are handled by Stripe.
• AI interactions: messages you submit and subscription information used to respond, as described in section 4.
• Support: your correspondence, contact details, purchase references, and attachments you choose to send. This can include screenshots submitted with a refund request. You may redact unrelated personal information.
• Technical and usage information: IP address, device and installation identifiers, browser or app version, operating system, language, approximate location derived from IP, feature events, and diagnostic reports. The analytics and attribution sections below explain the relevant providers and controls.
• Notifications: push registration tokens, device platform, notification preferences, and reminder-delivery information. Displaying notifications depends on your device permissions and settings.

Information comes from you, your use of our services, your device, sign-in providers, and payment or technical providers. Providing account and purchase information is necessary to authenticate you, process an order, and supply paid access. Optional AI messages, support attachments, and optional permissions are your choice.

3. Subscription tracking and synchronization

Your subscription records are stored in the app's local database and synchronized with your account on our servers when you are signed in and connected. Cloud synchronization is part of the account service. The records are based on your input; we do not import your bank transactions or access the accounts of the subscription providers you track.

Local copies enable use between connections. A change on another device, including a deletion request, may not immediately remove an offline copy. Protect access to your devices and remove local app data on devices you no longer use.

4. AI assistant

The assistant uses OpenAI through OpenRouter. Before your first AI request, the app presents a disclosure naming these providers and asks for confirmation. If you decline, you can continue using the other app features.

When you send a request, its contents pass through our backend to the AI providers. This includes your message, currency and time zone, and relevant subscription information or calculated insights: service names, amounts, billing cycles, categories, renewal and trial dates, status, usage information, and technical record identifiers included in those results.

We do not add your account email, sign-in credentials, or full payment-card details to the AI request. However, information you type into a message, including personal information, is part of that message and can be transmitted. Avoid including sensitive information or another person's data without permission.

Chat history is stored in the app. Our backend processes requests and tool results to generate responses and keeps usage counts for rate limiting; it does not maintain a server-side conversation history. AI providers have their own processing and retention arrangements, which may include security or abuse-monitoring records. See OpenRouter's privacy policy and OpenAI's privacy policy. Deleting local history does not itself delete records already held by a provider.

You can stop future AI requests by not using the assistant. Signing out clears the app's AI confirmation so it can be declined at the next prompt. For withdrawal of consent or a request concerning information already processed, contact support. Withdrawal does not undo processing that was lawful before it was withdrawn.

5. Payments, activation, and service emails

APPTALKS LLC sells recurring web subscriptions using Stripe. We use purchase and account references to connect successful payment to app access, administer renewals, prevent fraud, and handle cancellations, refunds, tax obligations, and payment disputes. Stripe also processes information for its own legal, security, and payment-network responsibilities as explained in its privacy policy.

We use your checkout email to send purchase confirmations, an activation magic link (app link), and relevant subscription notices. Verification and activation records help protect access and link the purchase to the correct account. The paid period starts at successful web payment; later activation does not change that date.

We use email delivery infrastructure, including Amazon Web Services, for account and service messages. Essential purchase, security, cancellation, and privacy correspondence is separate from optional marketing communications. If marketing emails are offered, they include a way to unsubscribe and are subject to any required consent.

Adapty is used for purchase and access-status management in the app. Where a purchase was made through an app marketplace, Adapty, Apple, or Google may also process receipt and entitlement information under their applicable terms.

6. Product analytics and diagnostics

Amplitude processes product-usage events, such as screens opened, onboarding steps, and feature actions, with attributes such as category, billing cycle, currency, app version, and device information. Our event definitions do not include your email, account identifier, subscription names or amounts, notes, or AI message text.

Events use an installation identifier rather than your account identifier. They are pseudonymous, not necessarily anonymous. SDK technical metadata can include IP-derived approximate location, carrier, device model, operating system, a vendor identifier on iOS, and an advertising identifier on Android where available. An advertising identifier need not be the main event identifier to be included as metadata.

The current app provides a device-specific analytics switch in Settings > Privacy; product analytics is enabled by default unless you have switched it off. Switching it off stops future product-analytics collection on that device; it is not a request to erase events already received. This control is separate from attribution and crash diagnostics.

Sentry and Firebase Crashlytics process error reports, stack traces, device and app information, and diagnostic context to investigate failures. Sentry reports can include an internal account identifier to associate an error with an authenticated session. These reports should not be treated as anonymous.

For more information about these providers, see Amplitude, Sentry, and Firebase.

7. Install attribution and website technologies

AppsFlyer measures which campaign or referral led to an installation. When configured, it processes installation and campaign information, technical device data, IP address, and advertising identifiers where available. It is separate from Amplitude and is not disabled by the product-analytics switch.

On iOS, access to the advertising identifier (IDFA) is subject to Apple's App Tracking Transparency permission. You can change it in iOS Settings > Privacy & Security > Tracking. Denying IDFA access does not stop all attribution processing: the SDK may still receive other installation and technical information. On Android, use the advertising privacy controls available on your device. See AppsFlyer's privacy policy.

Our websites and checkout use technical storage and network requests to provide pages, preserve relevant session or purchase state, and support payment security. Website measurement or marketing technologies, where used, are subject to applicable consent requirements. Browser controls can limit cookies or local storage, but blocking necessary technologies may affect checkout. A website choice does not automatically change a mobile app setting.

Device permission and an analytics opt-out do not substitute for prior consent where local law requires it for non-essential analytics, attribution, or storage access. Merely accepting this policy does not authorize those activities. We do not show ads in the app or use your tracked subscription details and AI message content for advertising.

8. Purposes and legal bases

Where the GDPR, UK GDPR, or similar rules apply, we use the following bases as appropriate:

• Contract: creating and authenticating accounts, synchronizing records, providing requested features, processing purchases, activating access, and handling subscription administration and support.
• Legal obligation: maintaining necessary accounting and tax records, responding to valid legal demands, and fulfilling applicable consumer and privacy duties.
• Legitimate interests: protecting accounts, preventing fraud, diagnosing failures, resolving disputes, and understanding product use where permitted without consent. We consider the impact on your rights and your right to object.
• Consent: AI transfers covered by the in-app confirmation and any optional marketing, analytics, attribution, or device-storage activity for which applicable law requires consent. Legitimate interests do not replace required consent.

We use AI to provide information and suggestions, not to make decisions about you with legal or similarly significant effects.

9. Recipients of information

We disclose information needed for the functions described above to:

• ALLIE LTD for development and technical service work on our behalf.
• Hosting, database, and email providers, including Amazon Web Services.
• Stripe for web payments; Adapty and relevant app marketplaces for purchase and access records.
• OpenRouter and OpenAI for AI requests you choose to send.
• Amplitude for product analytics, AppsFlyer for attribution, and Sentry and Firebase Crashlytics for diagnostics.
• Google Firebase Cloud Messaging and Apple push infrastructure for notification delivery; Apple or Google for sign-in where you use those methods.
• Professional advisers or authorities where necessary for legal obligations, disputes, or protection of rights, and a business successor if ownership or operations change, subject to applicable notice and privacy requirements.

Some providers act on our instructions; others also act independently for purposes such as payment compliance or the operation of their own accounts. We do not sell your personal information for money. Analytics and attribution disclosures are described above so you can understand what information leaves the Service.

10. Retention and account deletion

We retain account and tracking information to provide the service while the account is active. You can request deletion in the app's Settings or by emailing support@subtapapp.com. We may verify identity before acting. For other personal information, retention depends on its purpose, the duration of the relationship, applicable legal periods, and the need to resolve disputes or protect the Service.

Deleting your account does not cancel your paid SubTap subscription. Automatic charges continue until you request cancellation separately. You may request both actions in one email, including after you have lost access to the app. See how to cancel.

Closing the app account removes its active account and synced tracking records. Limited information may remain where necessary to administer an uncancelled subscription, meet accounting and tax duties, process refunds or disputes, prevent fraud, or document a privacy request. This can include purchase email, payment and subscription references, transaction dates and amounts, billing status, and relevant correspondence. These records are separate from the subscription entries you tracked in the app.

Authentication, security, and diagnostic records may have separate retention periods based on their purpose and applicable requirements. Expiry of a sign-in link ends its ability to authenticate; it does not necessarily erase the associated security record. We do not keep retained information indefinitely merely because it might be useful.

Backups and providers' records may remain until their applicable retention or deletion process completes. Information retained after a deletion request is limited to the relevant purpose. A remote request cannot instantly erase an offline device or copies in device backups you control; remove local app data separately where needed.

To request deletion of analytics, diagnostic, or other records, contact us. We may need additional information to locate a device-based record. We respond within the applicable legal timeframe, normally one month for GDPR requests, and explain any permitted extension or lawful reason for retaining particular information.

11. International processing

APPTALKS LLC is in the United States and ALLIE LTD is in Cyprus. Our providers may process information in these and other countries, which may have different privacy laws from yours.

Transfers subject to the GDPR or UK GDPR require a valid mechanism, such as an applicable adequacy decision or approved contractual safeguards with any necessary supplementary protections. A company's location or a link to its privacy policy is not itself a transfer safeguard. Contact support@subtapapp.com for information about destinations and the safeguards applicable to your data, including how to obtain a copy where available.

12. Your rights and choices

Depending on applicable law, you may request access to your information, correction, deletion, restriction, portability, or objection to certain processing. Portability requests can be sent to support. You may withdraw consent without affecting earlier lawful processing.

Where applicable US state privacy laws provide them, rights may also include opting out of sale, sharing for cross-context behavioral advertising, targeted advertising, or certain profiling; limiting specified uses of sensitive information; and appealing a denied request. Availability depends on the law and whether it applies to our processing. We will not discriminate against you for exercising an applicable privacy right.

Send requests, opt-outs, or appeals to support@subtapapp.com. An authorized agent may contact us where permitted; we may request proportionate proof of identity or authority. Our response will explain any limitation or refusal and available next steps.

You may complain to the relevant supervisory authority, including in the EU/EEA country where you live or work, or to the UK Information Commissioner's Office where applicable. You do not have to contact us first to exercise that right.

For device-level choices, use the app's product-analytics switch, operating-system notification settings, and advertising or tracking controls described above. Turning a permission off does not automatically erase previously processed information.

13. Children

SubTap is for adults aged 18 and over. We do not knowingly provide accounts to, or collect personal information from, children under 18. If you believe a child has provided information, contact support so we can investigate, close the account, and delete information as required.

14. Security

We use measures such as encrypted network connections, account authentication, and protected hosting to help secure personal information. Device security also depends on your operating system and access settings. We do not promise that every local copy is separately encrypted by the app or that any system is completely secure. Where a breach requires notification, we will notify affected people and authorities as required by law.

15. Policy updates and contact

We update this policy when processing practices or legal requirements change and revise the date above. We will give any required notice of material changes and obtain consent where required for a new use of information.

Privacy contact: APPTALKS LLC, 1007 North Orange Street, Wilmington, DE 19801, United States.
Email: support@subtapapp.com.
Developer: ALLIE LTD, Emmanouil Roidi 44, Kirzis Center, 3031 Limassol, Cyprus.