Privacy Policy

Who this covers

SubAlly (“we”, “us”) is operated by VersaSphere. This policy covers the SubAlly website and the signed-in app. It sits alongside our Terms of Service.

What we collect

Everything below is either something you typed or something the app derived from it.

Your account

• Your email address, used to sign you in and to send the weekly email.
• Your password, hashed by our authentication provider. It is never stored in readable form and we cannot see it.
• The name you give at sign-up.

The subscriptions you add

• Service name, category, price, currency, billing cycle and renewal date — all as you entered them.
• The date you last marked a subscription as used, which is what the waste score is calculated from.
• Whether you want that particular subscription included in reminder emails.

Labels you create

• Household member names, so you can record who actually uses a subscription.
• Payment card names only — a card is just a label like “Joint Visa”. We never ask for and never store card numbers, expiry dates, security codes or any other payment credential.
• Any custom categories you add on top of the built-in ones.

Preferences and delivery records

• Your display currency, whether the weekly email is on, and which day you want it.
• For each weekly email: your account ID, the send date, the channel and whether it succeeded. This is what stops the same email being sent twice.

Usage analytics

We use privacy-friendly page and performance analytics to see which pages are slow or broken. These record aggregate page views and loading measurements. They do not set cross-site tracking cookies and are not used to build a profile of you.

What we never collect

• No bank or card account access. There is no open-banking connection, no transaction aggregator and no financial OAuth token — there is nothing of that kind to revoke, because none of it is ever created.
• No payment credentials. No card numbers, no bank account or routing numbers.
• No access to your email. SubAlly does not connect to, read, scan or receive mail from your inbox.
• No sale or sharing of your data. We do not sell your data, share it with data brokers, or use it for advertising.

Why we process it

• To give you an account and keep you signed in.
• To show your totals, category breakdown, renewal calendar and waste score — all computed from the entries you made.
• To send the weekly renewal email, if you have it switched on.
• To keep the service working, secure and reasonably fast.

Who else processes it

We use a small number of providers to run the service:

• Supabase — Account authentication and the database your subscription data is stored in.
• Vercel — Hosting, plus privacy-friendly usage and page-speed analytics that carry no cross-site tracking cookies.
• Resend — Delivery of the weekly renewal email, if you have it switched on.

Exchange rates come from a free public rates feed, refreshed weekly. That request is made by our own systems and carries no information about you or your subscriptions.

Where your data is stored

VersaSphere operates from Ontario, Canada, but the providers above host and process data outside Canada, including in the United States. Personal information held in another country is subject to that country's laws and may be accessible to its courts, law enforcement and national security authorities.

How it is protected

• Every table holding your data enforces row-level security in the database, so a query can only ever return rows belonging to the signed-in account.
• Passwords are hashed by our authentication provider; we never receive the plaintext.
• All traffic is served over HTTPS.

No service can promise perfect security, and we do not. We can promise there is no stored bank connection or card number to lose.

How long we keep it

Your data stays until you remove it. Deleting a subscription, card, household member or category removes that record. Deleting your account removes everything attached to it, including your subscriptions, labels, settings and email delivery records.

Your choices and rights

• See and correct. Everything we hold about you is visible and editable in the app.
• Stop the emails. Turn the weekly email off in Settings, or switch off reminders for individual subscriptions.
• Delete your account. Self-serve account deletion is not built yet. Email us at admin@versasphere.ca and we will delete your account and all associated data.
• Get a copy. Ask at the same address and we will send you an export of your data.

If you are in Canada and we haven't resolved a privacy concern to your satisfaction, you can complain to the Office of the Privacy Commissioner of Canada. Depending on where you live you may have further rights over your personal data, including the right to complain to your own local data protection authority.

Children

SubAlly is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

Changes

If this policy changes in a way that affects what we collect or who processes it, we will update the date at the top of this page and, for significant changes, tell account holders by email.

Contact

Questions about this policy, or a request about your data: admin@versasphere.ca.