Privacy notice

Jon Green operates Sub-Tracked and is the controller for personal information used by this service. Contact hello@jongreen.dev for privacy questions or rights requests.

Sub-Tracked is a personal planning tool for people aged 18 or over. It is not intended for children.

• Identity and login data: name, email address, verification state, password hash or linked Google account identifier, and profile image when Google supplies one.
• Information you enter: account names, balances, currencies, time zones, income and expense schedules. Do not enter another person’s information or special-category data.
• Security and service data: session dates, browser user agent, Cloudflare-provided IP address, abuse-limit hashes, authentication email delivery, and sanitized availability logs containing fixed categories, request IDs, release versions, statuses and timings.
• Optional Plus data: account balance buffers, expense labels, annual bill reserves, alert preferences and delivery state used to avoid repeating warnings, Stripe customer/subscription identifiers, subscription status and billing period. If you enable email alerts, messages can contain account names, projected balances and scheduled bills. Pending email contents are held for delivery retries and removed after completion or scheduled expiry. Stripe collects payment and billing details on its hosted pages; Sub-Tracked does not store card numbers. What-if inputs are processed to calculate projections but are not stored as saved scenarios.
• Support messages you choose to send.

• Contract: create and secure your account, save the data you ask us to store, calculate forecasts, provide exports, process optional Plus subscriptions, and action deletion requests.
• Legitimate interests: prevent abuse, diagnose availability and security failures, protect users, and answer support requests. These uses are limited to what is necessary to operate a small, secure service.
• Legal obligation: respond where applicable law requires preservation, disclosure, or action on a rights request.

Name, email and a sign-in method are required to provide an account. Financial entries are optional, but forecasts cannot work without the entries they use. The service does not use consent as the basis for essential account processing or send marketing.

Balances are snapshots you enter and schedules are future projections. Sub-Tracked does not connect to a bank, confirm that a payment happened, move money, or keep transaction history. Forecasts are not financial advice and may be wrong when entries are incomplete, stale, or changed.

There is no solely automated decision-making or profiling that has legal or similarly significant effects.

Cloudflare provides Workers, D1 database hosting, security, recovery and support-email routing; the current D1 database uses automatic placement and is not restricted to a UK or EU jurisdiction. The operator’s destination mailbox provider processes support correspondence. Resend processes authentication email and optional account alerts that you enable. Google processes sign-in data only when you choose Google sign-in. Stripe processes optional Plus payments and billing. See Stripe’s privacy notice. Their own notices also apply when they act independently.

These providers may process information in the United States or other countries outside the UK. Transfers use the provider’s data-processing terms and applicable adequacy arrangements or contractual safeguards, including a UK transfer addendum where required. Ask the contact above for information about the safeguards.

Information may also be disclosed where law requires it or where necessary to establish, exercise or defend legal claims. It is not sold.

• Active identity and financial data is kept while you maintain the account. Archived accounts and schedules are recoverable for 90 days.
• Local Plus billing and alert delivery records are deleted with your identity; buffers and account alert settings are deleted with their financial account, and expense labels and reserves with their payment. Inactive alert delivery state is removed after 30 days. Deletion also requests Stripe customer removal and subscription cancellation; Stripe may retain invoice and payment records under its own retention and legal requirements.
• Sessions expire after seven days without refresh; verification/recovery links expire after 30 minutes; hosted application logs must be kept no longer than 30 days.
• Permanent account deletion removes live identity and financial rows immediately and keeps only a pseudonymous erasure hash for 45 days so restored backups can be cleaned.
• D1 recovery history lasts up to 7 days on Free or 30 days on Paid service and remains beyond use until overwritten. Encrypted exports made before database maintenance are deleted after 45 days, with temporary plaintext removed after verification. Resend documents 30-day email-data retention.
• Support and feedback correspondence is deleted within 12 months after resolution unless a documented legal or security need requires longer retention and review.

You can export JSON/CSV, restore recent archives, or permanently delete your identity and data from Profile & security. See the deletion screen for the effect before confirming.

Sub-Tracked uses only essential storage: secure authentication/OAuth cookies, a seven-day sidebar-state cookie, and local browser preferences for display settings and collapsing Plus previews. There is no advertising, cross-site tracking or analytics storage, so no nonessential-cookie consent banner is used.

Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase, restrict, object to use based on legitimate interests, and receive portable data. The right to object to direct marketing is absolute, but Sub-Tracked does not conduct direct marketing. Rights can have legal limits.

Email the controller to exercise a right. You can also complain to the UK Information Commissioner’s Office. Please contact us first if you can, so the issue can be investigated.

This page will be updated before materially different uses begin. The effective date above identifies the version currently in force.