Privacy Policy

1. Data Controller

The controller of your personal data is SKdev, as identified above. We process your data in accordance with the General Data Protection Regulation (GDPR) and Polish data protection laws.

2. Categories of Personal Data

We collect and process the following categories of personal data:

• Account Data: Email address, display name, avatar (profile picture), preferred language and currency.
• Authentication Data: Password (hashed), Google OAuth identifiers (if used).
• Subscription Data: Information about your tracked subscriptions (names, amounts, billing cycles, categories).
• Payment Data: Payment information processed by Stripe; we do not store full card details.
• Communication Data: Telegram ID and username (optional, for bot integration), email notifications preferences.
• Technical Data: IP addresses, browser type, device information, login timestamps.
• Mobile App Data: Device model, operating system version, and push notification tokens (if notifications are enabled).

3. Technical Data and Cookies

We use the following types of cookies:

• Essential Cookies: Required for authentication and core functionality. These cannot be disabled.
• Analytics Cookies: Used to understand how users interact with our service and to improve user experience. You may opt out of these cookies.

We also collect technical data such as IP addresses, login data, and browser type for security and service improvement purposes.

4. Purposes and Legal Basis of Processing

• Contract Performance: To provide the SaaS services including subscription tracking, family sharing features, and payment calendar (GDPR Art. 6.1.b).
• Legal Obligations: For tax and accounting purposes related to billing (GDPR Art. 6.1.c).
• Legitimate Interests: To improve our service, ensure security, provide basic personalization such as subscription recommendations, and for analytics purposes (GDPR Art. 6.1.f).
• Consent: For marketing communications and newsletter where you have opted in (GDPR Art. 6.1.a).

5. Personalization

We use basic personalization to enhance your experience, such as subscription recommendations based on your usage patterns. This personalization does not involve automated decision-making that produces legal effects or similarly significantly affects you. You may object to personalization by contacting us.

6. Data Sharing and International Transfers

We use third-party providers to operate the service:

• Supabase: Database and authentication services (AWS infrastructure, EU and US regions).
• Stripe: Payment processing (certified PCI DSS Level 1).
• Resend: Transactional email delivery.
• Telegram: Bot integration for notifications (if enabled by you).
• Google Play Services: App distribution and updates via Google Play Store.
• Vercel Analytics: Performance monitoring and usage analytics.
• Rollbar: Error tracking and crash reporting.

International Transfers: Some providers process data in the USA. For such transfers, we rely on:

• EU-US Data Privacy Framework (where applicable);
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Additional technical and organizational measures to ensure data protection.

7. Data Retention

• Account data: Retained as long as you have an active account. Upon account deletion, your data is removed immediately, except where retention is required by law.
• Financial/Billing records: Retained for 5–6 years as required by Polish tax and accounting regulations (Ordynacja podatkowa, Ustawa o rachunkowości).
• Marketing data: Retained until you withdraw consent.
• Technical logs: Retained for up to 12 months for security purposes.

8. Your Rights

Under GDPR, you have the following rights:

• Right of access – obtain a copy of your personal data;
• Right to rectification – correct inaccurate data;
• Right to erasure ("right to be forgotten") – request deletion of your data;
• Right to restriction – limit how we process your data;
• Right to data portability – receive your data in a machine-readable format;
• Right to object – object to processing based on legitimate interests;
• Right to withdraw consent – withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at support@subs.watch. We will respond within 30 days.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) in Poland: ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl.

9. Children's Privacy

Our service is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child under 16, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our website. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related queries or to exercise your rights, please contact us at: