Privacy Policy

What this covers

This policy describes what information Subscription Guru ("we", "us") collects when you use the app, why we collect it, and the choices you have. The short version: we store what the app needs to keep your shelves and subscription plan working, we don't run ads or analytics trackers, and we never sell your data.

Information we collect

Account information. You sign in with a Google or Microsoft account. From the sign-in we store your email address, your display name, and (when the provider supplies one) an avatar image URL. We do not receive or store your password. The provider's internal account identifier is stored only as a keyed cryptographic hash, so the raw identifier is never kept at rest.

Content you add. Your watchlists and the titles on them, watched/episode progress, list sharing and membership, subscription-plan settings, and preferences such as language and region.

Invitations. If you invite someone to a shared list by email, we store only a keyed hash of their address (to match the invite when they sign in) and a masked display form such as j…@e….com — not the raw address.

Technical data. Encrypted session cookies to keep you signed in, and ordinary web-server logs (IP address, request path, timestamp) kept for security and troubleshooting.

How we use it

Only to operate the service: signing you in, showing your shelves, generating your subscription plan and calendar exports, enabling list sharing, and keeping the service secure. We do not use your data for advertising, we do not build profiles for third parties, and we do not sell or rent personal information to anyone.

Google user data

When you sign in with Google we request only basic profile scopes (openid, email, profile) and, if you choose "Keep me signed in", a refresh token that lives inside your encrypted session cookie so your session can last up to 30 days. We do not access your Gmail, Drive, Calendar, contacts, or any other Google content.

Subscription Guru's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can review or revoke Subscription Guru's access at any time from your Google Account connections page.

Microsoft user data

When you sign in with Microsoft we request only basic profile scopes (openid, email, profile) from the Microsoft identity platform and, if you choose "Keep me signed in", the offline_access scope so a refresh token — stored only inside your encrypted session cookie — can keep your session alive for up to 30 days. We read your email address and display name from the sign-in token and nothing else; we do not access your Outlook mail, calendar, contacts, OneDrive, or any other Microsoft 365 content. Our use of Microsoft APIs adheres to the Microsoft APIs Terms of Use. You can review or revoke Subscription Guru's access from your Microsoft account app permissions (personal accounts) or your organization's My Apps portal (work or school accounts).

Cookies

We use only essential cookies: an encrypted session cookie that keeps you signed in (up to 24 hours by default, or up to 30 days if you pick "Keep me signed in"), and short-lived cookies used during the sign-in handshake. There are no advertising, analytics, or cross-site tracking cookies.

Sharing and third parties

Title, artwork, and streaming-availability information comes from The Movie Database (TMDB) and TheTVDB. Our requests to those catalogs are about films and shows, not about you — no personal information is sent to them. Your data lives on infrastructure we operate; we disclose personal information only if the law requires it.

Retention and deletion

Your account data is kept for as long as you have an account. Sessions expire on their own. To delete your account and everything attached to it, email [email protected] from the address you sign in with and we will remove it. You can also revoke Subscription Guru's access at any time from your Google or Microsoft account security settings.

Security

All traffic is served over HTTPS. Session cookies are encrypted, and identifiers that could link you across services (provider account IDs, invite email addresses) are stored as keyed hashes rather than raw values. No internet service can promise perfect security, but we aim to store the minimum and protect what we store.

Children

Subscription Guru is not directed at children under 13 (or the equivalent minimum age where you live), and we do not knowingly collect their data.

Changes and contact

If this policy changes materially we will update the effective date above. Questions or requests: [email protected].