Privacy Policy

Last updated: July 26, 2026 · Effective: July 26, 2026

SubTap is built privacy-first. We never ask for bank or card credentials, and your subscription data lives on your device by default. This policy explains what we collect, why, and what rights you have.

Who we are

SubTap is a subscription tracking mobile application operated by Allie Ltd ("SubTap", "we", "us", or "our"), a company registered in the Republic of Cyprus.

• Company: Allie Ltd
• Registration No.: HE 460424
• VAT No.: 60076104S
• Registered address: Emmanouil Roidi 44, Kirzis Center, 3031, Limassol, Cyprus
• Contact: support@subtapapp.com

By using SubTap, you agree to the collection and use of information as described in this policy. If you don't agree, please don't use the app.

What we collect

A lightweight account (Email, Google, or Apple sign-in) is required to use SubTap — it enables encrypted sync, renewal reminders, and the AI assistant. Creating this account never involves linking a bank account, card, or any financial institution. Where a password is used, it's stored hashed and never visible to us in plain text.

We also collect:

• Subscription entries you add manually — service name, cost, billing cycle, renewal date, category, notes.
• Messages you send to the AI assistant, and the subscription context needed to answer them (see "AI assistant" below).
• Purchase receipts and access status, handled by Adapty and the app stores — we never see your card details.
• Basic device data (model, OS version, app version, crash and performance reports) needed to run and fix the app, processed by Firebase Crashlytics.
• A push notification token, only after you grant permission, used for renewal reminders.
• Anonymous product-usage events — only if you opt in (see "Product analytics" below).

We run no ad networks, show no ads, and never sell your data or share it with data brokers. On iOS, if you grant both our analytics opt-in and Apple's tracking permission, analytics events are keyed on your device's advertising identifier — see "Tracking and the advertising identifier" below. You can decline either one, and nothing else changes.

Your subscription data

Subscriptions you add are stored locally on your device and, once you're signed in, synced in encrypted form to your account so they're available across your devices. You remain the source of truth — nothing is ever pulled automatically from a bank or payment provider.

AI assistant

Who receives your data. The AI assistant is powered by OpenAI. Requests reach it through OpenRouter, an AI infrastructure provider that routes the request to OpenAI on our behalf. Those two companies are the only third parties involved in the assistant.

We ask first. Before your very first message is ever sent, the app shows a confirmation dialog that names both OpenAI and OpenRouter and lists exactly what will be sent. Nothing leaves your device for either provider until you tap Continue. You can decline and keep using every other part of the app exactly the same.

What we send. When you send a message, we forward to OpenRouter — which passes it to OpenAI — only:

• the text of the message you typed;
• your currency, time zone, and today's date, so amounts and dates make sense;
• the subscription details needed to answer: service names, prices, billing cycles, renewal and trial dates, categories, status, and how often you use each one.

What we never send. Your name, email address, sign-in identifiers, device identifiers, payment methods, and the free-text notes you keep on your subscriptions are never transmitted to OpenAI or OpenRouter. Our servers strip everything outside the list above before the request leaves our infrastructure.

Retention and protection. Under our data processing agreements, both OpenRouter and OpenAI are contractually bound to protections equivalent to those in this policy, and your messages are not used to train models. OpenAI may briefly retain API request data for abuse monitoring — see openai.com/enterprise-privacy; OpenRouter's handling is described at openrouter.ai/privacy. We don't store the content of your conversations on our servers — we keep only a count of how many times the assistant was used, for rate limiting.

Withdrawing permission. Signing out clears your confirmation, so the dialog appears again (and can be declined) next time. You can also email support@subtapapp.com to withdraw it. Either way, the rest of the app is unaffected.

Product analytics

Off unless you turn it on. SubTap can send anonymous product-usage events to Amplitude, our analytics provider, to show us which features people actually use. Nothing is collected until you opt in: the app asks once, and the switch lives in Settings › Privacy where you can turn it back off at any time. Declining changes nothing else about the app.

What an event contains: the action itself (a screen opened, a subscription added, the assistant used), plus low-detail attributes such as a subscription's category, billing cycle and currency code, your app version, OS version, device model and language.

What it never contains: your email address or name, subscription names, any amount or price, your notes, your assistant messages, or your account identifier. Events are not linked to your SubTap account. We do not use your device's vendor identifier, and we ask Amplitude not to collect or store your IP address, so no location is derived from it.

Which identifier is attached depends on your answer to Apple's tracking prompt — see the next section.

Where it goes. Analytics events are processed by Amplitude in the United States. Because that's outside the EU/EEA, we rely on European Commission–approved Standard Contractual Clauses for the transfer — see "Data retention & international transfers" below. Amplitude is bound by a data processing agreement, does not use your data for advertising, and is not permitted to sell it. Our legal basis is your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time from Settings › Privacy.

Tracking and the advertising identifier

On iOS, after you opt in to analytics, the app shows Apple's App Tracking Transparency prompt. Your answer decides which identifier is attached to your analytics events:

• If you allow tracking — events are keyed on your device's advertising identifier (IDFA). Because that identifier is shared across apps, this counts as "tracking" under Apple's rules, which is why the App Store listing for SubTap says data may be used to track you.
• If you decline, or you're on Android — no advertising identifier is read or sent. Events carry only an identifier Amplitude generates for this app install, which cannot be matched to you in any other app.

Either way, we use this only to understand how SubTap is used. We do not build advertising profiles, run ad targeting, or combine your data with data from other companies for advertising, and we never share it with a data broker. You can change your answer at any time in iOS Settings › Privacy & Security › Tracking, or switch analytics off entirely in SubTap's Settings › Privacy — turning analytics off stops all of it, regardless of the tracking permission.

How we use your information

We use what we collect to run and improve SubTap: syncing your data across devices, sending renewal reminders you've opted into, powering the AI assistant, processing purchases, understanding which features are used (only with your analytics opt-in), preventing fraud and abuse, and meeting legal obligations. We rely on contract performance (to deliver the app), legitimate interests (security, fraud prevention, improving the service), and consent (notifications, AI assistant use, product analytics) as our legal bases under GDPR. Nothing in SubTap involves automated decision-making with legal or similarly significant effects on you.

How we share your information

We don't sell, rent, or trade your personal data. We share it only with:

• Service providers who help us run the app — our cloud hosting provider (encrypted sync storage), Adapty (purchases), OpenRouter and OpenAI (AI assistant — only if you confirm you want to use it), Amplitude (product analytics — only if you opt in), Google Firebase (Crashlytics crash and performance diagnostics, and Cloud Messaging for push), and Apple (push notifications). Each is bound by a data processing agreement requiring protections equivalent to those described here.
• Authorities, if required by law, court order, or to protect the rights and safety of SubTap, our users, or others.
• A successor, if SubTap is ever acquired or merged — we'd notify you first.
• Anyone else, only with your explicit consent.

Data retention & international transfers

We keep your data while your account is active. If you delete your account, we delete or anonymize your personal data within 30 days, except where the law requires us to keep something longer (e.g. billing records under Cyprus tax law). Subscription data stored locally on your device is removed as soon as you delete the app or your account.

Allie Ltd is based in Cyprus (EU), but some processors — OpenAI, Amplitude, Adapty, Google Firebase, and parts of our cloud infrastructure — operate outside the EU/EEA, including in the US. Where data leaves the EU/EEA, we rely on European Commission–approved Standard Contractual Clauses or other appropriate safeguards. Analytics data reaches the US only if you opt in, and you can stop it at any time from Settings › Privacy.

Your rights

Under GDPR and equivalent laws, you can:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated data — do this yourself any time in Settings, or ask us.
• Export your data in a portable format, any time, from Settings.
• Object to or restrict certain processing.
• Withdraw consent at any time, without affecting anything processed before.

You can also turn product analytics on or off in Settings › Privacy, and disable biometric lock, notifications, or sync individually from Settings. For anything else, email support@subtapapp.com — we respond within 30 days. If you're in the EU/EEA, you can also complain to the Cyprus data protection authority (dataprotection.gov.cy, commissioner@dataprotection.gov.cy).

If you're a California resident, you have similar rights under the CCPA/CPRA, including the right to know, to delete, and to opt out of the sale or sharing of personal information. We don't sell personal information, and we don't share it for cross-context behavioural advertising — the advertising identifier described above is used for product analytics only, never for ad targeting. You can withdraw it at any time by declining tracking or switching analytics off in Settings › Privacy.

Children

SubTap is meant for people 18 and over. We don't knowingly collect data from anyone under the age of digital consent in their country (13–16 depending on where you are) without verifiable parental consent. If you're a parent and think your child has given us personal data, email support@subtapapp.com and we'll delete it and close the account.

Security

We encrypt data in transit (TLS 1.3) and at rest (AES-256), support optional biometric lock on your device, and limit internal access to personal data on a need-to-know basis. No system is 100% secure, and we can't guarantee absolute security — but if a breach affects your rights, we'll notify you and the relevant authority as GDPR requires.

Changes

We may update this policy from time to time. We'll update the date above and, for changes that affect your rights, notify you in the app at least 30 days before they take effect.

Contact

Questions? Email support@subtapapp.com.

Allie Ltd, Emmanouil Roidi 44, Kirzis Center, 3031, Limassol, Cyprus (Reg. No. HE 460424, VAT 60076104S).