Privacy Policy
SubFlow (the "Service") complies with the Personal Information Protection Act of Korea and other applicable laws, and has adopted this policy to protect users' personal information.
1. Personal information we collect
A. On sign-up (required)
| Item | Purpose |
|---|---|
| Email address | Account identification, sign-in, sending notifications |
| Password | Account authentication (stored with one-way bcrypt hashing; the original is never kept) |
| Name (nickname) | Shown inside the Service |
B. Information you enter yourself
| Item | Purpose |
|---|---|
| Subscription details (service name, price and currency, billing cycle and date, status, notes, etc.) | Subscription management, analysis and reminders |
| Notification settings (timing, email/push, monthly budget) | Providing notifications |
| Mobile push token | Sending app push notifications |
| Bug reports and feedback (what you write, email address, device, app version and browser information, the screen at the time of the report) | Answering inquiries and finding the cause of errors |
C. Information generated automatically
| Item | Purpose |
|---|---|
| IP address | Preventing abuse; rate-limiting sign-in and sign-up requests |
| Service usage history (creating, changing and cancelling subscriptions; payment history) | Timeline, statistics and price-increase detection |
D. Information we do not collect
The Service never collects or stores real financial or payment information such as card or bank account numbers. A subscription's "amount" is a number you enter for your own tracking; actual payments happen at each subscription provider.
2. Why we use personal information
- Identifying members and authenticating sign-in
- Core features such as subscription management, spending analysis and budgets
- Sending reminders (email and push) for billing dates, price increases, trial endings and budget overruns
- Preventing abuse and keeping the Service stable
3. How long we keep it
- Member information: kept until you delete your account, and destroyed without delay on request.
- When you delete your account, your subscriptions, notification settings and usage history are deleted with it.
- Where a law requires a separate retention period, we keep the data for that period.
4. Sharing with third parties and outsourcing
The Service never sells personal information or provides it to third parties. To run the Service, we outsource the following tasks.
| Processor | Task | Data sent |
|---|---|---|
| Email delivery service (SMTP provider) | Sending notification emails | Recipient email address, notification content |
| Expo (mobile push service) | Sending app push notifications | Push token, notification content |
| OpenAI | Summarizing news articles | News headlines and sources (no user personal information or subscription data is sent) |
ℹ️ The news summary feature sends only public news headlines to the external AI. Personal data, such as which services you subscribe to, is never sent outside.
5. How we destroy personal information
- We destroy data without delay once the retention period ends or its purpose is fulfilled.
- Electronic files are deleted in a way that cannot be recovered.
6. Your rights
You may at any time ask to see, correct or delete your personal information, ask us to stop processing it, or delete your account. You can edit or delete your account and subscriptions yourself in the Service's settings; other requests can be sent to the contact below.
7. How we keep it safe
- One-way password hashing (bcrypt) — not even administrators can see the original
- JWT-based authentication with token expiry and refresh
- Rate limits on sign-in and sign-up (against brute-force attacks)
- Secret keys and database credentials kept in separate environment variables
8. Privacy officer
For questions, complaints or remedies regarding personal information, please contact:
- Privacy officer: Gyeongeun Yoon
- Contact: [email protected]
Other reports and counselling on privacy violations (Korea): Personal Information Infringement Report Center (privacy.kisa.or.kr / 118), Korean National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)
9. Changes to this policy
This policy may change with laws or the Service. We announce changes in the Service or on this page.
← SubFlow home