SubVora Privacy Policy

Effective 24 October 2026

SubVora is a subscription tracker for Android. This policy explains what the app stores, why, and how to delete it. Questions: gaurav2000ashish@gmail.com.

What we store

• Account: your email address and a bcrypt hash of your password. We never store the password itself.
• What you enter: subscriptions (name, cost, currency, billing cycle, dates, paid status, reminder days), your own categories, payment source labels (for example "HDFC card" — a name you type, never a card number), and your home currency.
• Sign-in tokens: so you stay signed in. They expire, and are deleted with your account.
• Password reset codes: short-lived, only when you ask to reset your password.

We do not collect your location, contacts, bank details, card numbers, or device identifiers. The app has no ads, no analytics, and no tracking SDKs.

How it is used

Only to run the app: show your subscriptions, compute spending totals, and email you a password reset code when you ask for one. We do not sell your data or share it for advertising.

On your phone

The app keeps a copy of your data on the device so it can be viewed offline, and stores sign-in tokens in Android's secure storage. Renewal reminders are scheduled locally by the app — nothing is pushed from a server. Uninstalling the app removes all of this.

Services we rely on

• Render (United States) hosts the server.
• Neon hosts the database.
• Brevo sends password reset emails, so it receives your email address when you request one.
• open.er-api.com supplies currency exchange rates. No user data is sent.
• Middleware monitors the server. It receives technical records of each request to the server: which part of the service was called, how long it took, whether it failed, and your account's internal ID, so a problem can be traced and fixed. It does not receive your email address, your password, or the details of the subscriptions you enter.
• jsDelivr serves brand logos shown in the app. Like any website, it sees your device's IP address when a logo loads.

All traffic between the app and the server is encrypted (HTTPS).

Deleting your data

In the app: Settings → Delete account, then confirm with your password. Your account and everything linked to it are deleted from the database immediately. Without the app, see how to request deletion.

Children

SubVora is not directed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes, the new version will be posted on this page with a new effective date.