Privacy Policy
Last updated: 1 November 2026 · Effective: 1 November 2026
This policy explains what personal data we collect through the All My Subs website and mobile application, why we collect it, who we share it with, and the rights you have over it. It is written to satisfy the Brazilian General Data Protection Law (Lei nº 13.709/2018, the LGPD) and, for users in the European Economic Area and the United Kingdom, the GDPR.
The short version. This website sets no cookies and runs no analytics. The app never connects to your bank and never asks for card numbers — you type your subscriptions in yourself. We do not sell personal data and we do not use it for advertising.
1. Who is responsible for your data
The data controller is:
- Rocha Labs
- CNPJ 27.586.421/0001-00
- Brazil
- Data protection contact (Encarregado / DPO): contact@allmysubs.com
Where this policy says "we", "us" or "All My Subs", it refers to that company.
2. What this policy covers
It covers the website at www.allmysubs.com and the All My Subs mobile application for iOS and Android. It does not cover the third-party services you track inside the app — if you add Netflix as a subscription, we hold the text "Netflix" and an amount you typed; we have no relationship with Netflix and no access to your account there.
3. The website
3.1 Cookies
This website uses no cookies. It sets no local storage, runs no analytics or advertising scripts, embeds no social media widgets, and loads no fonts or files from third-party servers. There is no consent banner because there is nothing to consent to.
3.2 Server logs
The site is served by Cloudflare Pages, which records standard technical request data — including IP address, timestamp, page requested, browser and operating system — for security and to keep the service running. We do not use these logs to build profiles or identify individuals. Legal basis: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
3.3 Contact by e-mail
If you write to us, we hold your e-mail address and the content of your message for as long as needed to answer and to keep a record of the exchange.
4. The app
What we collect when you use All My Subs:
| Data | Why | Legal basis |
|---|---|---|
| Account data — e-mail address and an encrypted password, or an identifier from Sign in with Apple or Google if you use those. | To create your account, sign you in and restore your data on a new device. | Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)) |
| Subscription entries — the names, amounts, currencies, billing cycles, renewal dates, categories and notes you enter. | This is the content of the service. Without it the app has nothing to show. | Performance of a contract |
| App settings — theme, language, notification preferences. | To keep the app the way you configured it. | Performance of a contract |
| Push notification token — a device identifier issued by Apple or Google. | To send renewal reminders. Only collected if you enable notifications. | Consent (LGPD art. 7, I; GDPR art. 6(1)(a)) |
| Technical and diagnostic data — app version, device model and operating system version, plus crash reports that Apple and Google make available to us through App Store Connect and Google Play Console if you chose to share diagnostics with developers. We run no crash-reporting service of our own. | To fix crashes and keep the app working across devices. | Legitimate interest |
| Purchase status — whether your one-time purchase was completed, received from Apple or Google. | To unlock the app and restore your purchase on a new device. | Performance of a contract |
4.1 What we deliberately do not collect
- Bank or financial institution credentials. The app has no bank connection of any kind.
- Credit or debit card numbers. All My Subs is a one-time purchase handled entirely by Apple and Google; we never see your card.
- Your contacts, photos, precise location, microphone or camera.
- Advertising identifiers. The app contains no advertising SDK and no third-party tracker.
5. How we use your data
- To provide the app: storing your subscriptions and calculating your monthly and yearly totals.
- To send the renewal reminders you asked for.
- To keep accounts secure and prevent abuse.
- To diagnose crashes and improve the product.
- To answer support requests.
- To comply with legal obligations.
We do not sell personal data, share it with data brokers, use it for behavioural advertising, or use your subscription entries to profile you.
6. Who processes data on our behalf
We use a small number of service providers, each bound by contract to process data only on our instructions:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication and file storage for the app | Ohio (us-east-2) |
| Cloudflare | Website hosting and CDN | Global edge network |
| Apple, Google | App distribution, in-app purchases, push notification delivery (Apple Push Notification service, Firebase Cloud Messaging) and, if you choose them, Sign in with Apple / Sign in with Google | United States and other regions |
We may also disclose data where required by law, court order or a legitimate request from a competent authority, and in connection with a merger or sale of the business — in which case you will be told before your data is transferred.
7. International transfers
Some of these providers store or process data outside Brazil. Where that happens, transfers are made under the safeguards permitted by LGPD art. 33 — contractual clauses providing an adequate level of protection — and, for EEA/UK users, under the European Commission's Standard Contractual Clauses.
8. How long we keep it
- Account and subscription data: for as long as your account exists or until the service is discontinued (see section 12), whichever comes first.
- After you delete your account: erased from live systems within 30 days, and from encrypted backups within a further [90] days.
- Support e-mails: [24] months after the exchange ends.
- Server logs: [90] days.
- Records we must keep by law (tax, accounting, or the connection logs required by the Marco Civil da Internet): for the period the law requires.
9. Security
Data is encrypted in transit with TLS and encrypted at rest by our database provider. Access to production data is limited to the people who need it, protected by multi-factor authentication, and database access rules ensure one account cannot read another's records. No system is perfectly secure, but if a breach occurs that is likely to create risk to you, we will notify you and the ANPD as required by LGPD art. 48.
10. Your rights
Under LGPD art. 18 you may ask us to:
- confirm that we process your data, and get access to it;
- correct data that is incomplete, inaccurate or out of date;
- anonymise, block or delete data that is unnecessary, excessive or processed unlawfully;
- export your data in a portable, machine-readable format;
- delete data processed on the basis of consent;
- be told which public and private bodies we have shared data with;
- withdraw consent at any time, and be told what happens if you do;
- object to processing you believe does not comply with the law.
EEA and UK users hold the equivalent rights under GDPR arts. 15–22, including the right to restrict processing and to lodge a complaint with a supervisory authority.
You can delete your account and all its data from inside the app at any time, under Profile → Settings. For anything else, write to contact@allmysubs.com. We answer within 15 days, as LGPD art. 19 requires. We may ask you to confirm your identity before acting on a request.
How to delete your account and data
- In the app: Profile → Settings → Delete account. This removes your account and all subscription entries.
- Without the app (for example if you uninstalled it): write to contact@allmysubs.com from the e-mail address of your account, with the subject "Delete my account". We may ask you to confirm your identity, and will delete your data within the periods in section 8.
Residents of California and other US states: we do not sell or share personal data as those terms are defined in state privacy laws.
You may also complain to Brazil's National Data Protection Authority (ANPD).
11. Children
All My Subs is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.
12. Service changes and discontinuation
All My Subs is a one-time purchase, and your data is hosted on infrastructure we pay for. We may modify, suspend or stop supporting the app and its servers, or delete the service and the data stored on it, at any time.
- Where reasonably possible, we will give at least 30 days' notice in the app or by e-mail, and keep an export option available during that period. We cannot guarantee notice where the shutdown is caused by events outside our control.
- When the service ends, your account data will be deleted from our systems and from backups within the periods in section 8. We have no obligation to keep it after that.
- We recommend exporting your data from time to time. Refunds, if any, are governed by Apple's and Google's policies and applicable law.
13. Changes to this policy
If we change this policy we will update the date above and, where the change materially affects you, tell you in the app or by e-mail before it takes effect.
14. Contact
Rocha Labs — CNPJ 27.586.421/0001-00
contact@allmysubs.com