Security & data protection

Connecting an inbox is a big ask. Here is what SubSaver can and can't do, and how your data is protected. Questions or a vulnerability to report? Email support@subsaver.help.

Read-only, and narrowly used

• Signing in never grants access to your email. Inbox access is a separate, explicit step you can skip.
• Gmail and Outlook connect through Google's and Microsoft's own sign-in, with read-only permissions (gmail.readonly or Mail.Read): SubSaver can't send, delete, move or change email there.
• iCloud Mail and Yahoo Mail use an app password that you create at Apple or Yahoo — never your main password. An app password can technically do more than read, so SubSaver limits itself: it opens your inbox read-only and never sends, deletes, moves or changes email. The app password is stored encrypted, deleted when you disconnect, and you can revoke it at Apple or Yahoo at any time.
• SubSaver only looks for billing emails — receipts, invoices, renewal and trial notices.
• Email text and attachments are processed in memory and never stored. We keep only the extracted service, price, period, dates and the payment method shown on the receipt (card brand and last four digits, or e.g. PayPal).
• Our use of Google data follows the Google API Services User Data Policy, including the Limited Use requirements — no advertising, no selling, no AI training.

How your data is protected

• Data is encrypted in transit, and at rest by our database provider. Inbox access tokens and app passwords are additionally encrypted by SubSaver before they are stored.
• Inbox access tokens and app passwords are used only by our servers to talk to your email provider, and are never shown in the app. Tokens from signing in with Google or Microsoft aren't stored at all.
• Hosted in Frankfurt, EU, with reputable providers bound by data protection agreements.
• Every request is checked against your account, so no one can read another person's data.
• Least-privilege access: only the operator can reach production systems, and no one can see email content because SubSaver never stores it.
• Protection against abuse and automated attacks, and regular security reviews.
• Payments go through Stripe — we never see your card.
• No advertising or tracking cookies.

You stay in control

• Disconnect an inbox anytime — for Gmail, we also revoke SubSaver's access at Google, and for iCloud Mail and Yahoo Mail we delete the app password. You can also remove access from your Google or Microsoft account settings, or revoke the app password at Apple or Yahoo.
• Export everything we store about you — your account, subscriptions and their history, settings, connected inboxes, devices, notifications, invoices, support messages and hidden services. Secrets such as access tokens are left out on purpose.
• Delete your account and all its data in one step. This also cancels any paid plan and, for Gmail, revokes our access at Google.
• Unsubscribe in one click from reminder emails and the monthly summary, or switch each off in Settings. Account, security and billing emails are part of the service and always arrive.

More detail: privacy policy · sub-processors · cookies

Responsible disclosure

If you believe you've found a security issue, please email support@subsaver.help with details and give us reasonable time to fix it before telling others. We respond within 72 hours, keep you informed, and won't take action against good-faith research that avoids harm to users and their data.