Privacy Policy

Effective: 17 October 2026

Last updated: 28 October 2026

About this policy and privacy contact

This policy explains how Unsubscriber handles information when you use its Android application, website, connected Gmail features, and support services.

For privacy questions, data requests, or concerns, contact phoenix.digitcore@gmail.com or visit our Support page. Do not send passwords, one-time verification codes, OAuth credentials, or payment card details.

What Unsubscriber does

Unsubscriber helps you organize recurring subscriptions, costs, provider-stated renewal dates, reminders, and subscription-management links. It is not a payment processor. Opening a cancellation link does not cancel a service; you must complete the provider's own confirmation.

Account information and cloud sync

Unsubscriber uses Google Sign-In and Firebase Authentication to identify your account. It receives your account identifier, email address, and display name. Subscription records are stored under your account's protected Firebase path so they can sync across your devices. Account-scoped storage does not mean the data is inaccessible to the backend or authorized administrators.

Subscription information may include service name, amount, currency, billing cycle, provider-stated renewal or expiry date, billing source, profile label, notes, status, management links, and a short verification evidence line. Reminder history and a local copy of Google Play entitlement state may remain on your device. Trial start and expiry information is stored in your protected backend account record.

Free-trial abuse prevention

The free trial starts only after you choose to activate it. It lasts one calendar month, does not request a payment method, and does not automatically charge you when it ends.

To limit the trial to one per account and device, the app creates a one-way proof using its package name and the Android device identifier. The raw Android identifier is not sent to the backend. The backend applies an additional secret-keyed hash and retains a redeemed marker to prevent repeat trial redemption. This marker is not stored with your user ID, email address, name, or raw Android identifier and is retained after account deletion for abuse prevention.

Optional screenshot processing

When you choose an image, ML Kit optical character recognition runs on your device first. Only likely subscription screenshots with identifiable provider and billing evidence can proceed to optional cloud analysis.

A separate confirmation lets you send a compressed JPEG and limited recognized text through Firebase to the paid Google Gemini API. You may instead use the local result. Images can contain personal information, so review what you choose to submit. The original image is processed in memory and is not stored in Firestore. Processing and retention by Google are governed by the applicable service configuration and terms.

One Vision request can extract multiple subscription plans. The server allows at most 10 screenshot-analysis attempts per Firebase user per UTC calendar month. Identical image bytes can reuse a minimal cached result within the same receipt-reader version. A separately confirmed analysis using an upgraded receipt reader may consume a new attempt. Failed or uncertain upstream attempts are not automatically retried. Local scanning and manual entry remain available.

Optional Gmail access and automation

Connecting Gmail is optional and separate from signing in to Unsubscriber. The requested Gmail permission is https://www.googleapis.com/auth/gmail.readonly. It permits reading messages and related information. Unsubscriber uses it to identify subscription-related billing and lifecycle information; this permission does not permit sending or deleting email.

The backend encrypts Gmail refresh tokens so it can perform authorized background updates. It initially searches matching messages received within the previous calendar year using pagination, then processes subsequent mailbox changes.

Candidate messages must match subscription-related keywords and credible provider, subscription-lifecycle, or billing evidence. Fixed parsing runs first. After you consent to the current Gmail extraction disclosure, selected candidates may send a short billing excerpt through Firebase to the paid Google Gemini API for extraction. This can include provider, plan, amounts, and dates.

Email addresses, card references, greeting names, and links are redacted where detected. Automated redaction is not a guarantee that every personal detail will be removed. Full email bodies and attachments are not retained by Unsubscriber as stored message copies. Extracted subscription records and short evidence lines can be stored to provide the subscription-management feature.

The server allows at most 5 Gmail AI-analysis attempts per Firebase user per UTC calendar month across linked inboxes. Irrelevant candidates, cached results, and quota rejections do not consume another attempt. Uncertain lifecycle or legacy records require review by the account holder.

You can disconnect Gmail in Settings or revoke access in your Google Account connections . Revoking access does not by itself delete subscription records already saved in Unsubscriber. Use the deletion controls described below.

Google user data and Limited Use

Unsubscriber's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace user data and developer policy, including Limited Use requirements.

Google user data, including information derived from Gmail, is used to provide the subscription-management features described in this policy. It is not sold, used for advertising, used for creditworthiness decisions, pooled across users to train models, or used to create, train, or improve a general-purpose or personalized AI model. AI extraction described above is processing to provide a user-facing feature, not permission to train a model on your Gmail data.

Transfers of Google user data are limited to providing the disclosed user-facing features with your consent, necessary security purposes, legal obligations, or other transfers expressly permitted by the applicable Google policies.

Administrative access and human review

Authorized administrators have technical tools to review account and subscription records, manage premium access, investigate failures, and make support-related corrections. Some subscription records can contain information derived from Gmail.

Administrative authority is not blanket permission to read Google user data. Human access to that data, including derived information, must be limited to the circumstances permitted by Google's Limited Use rules: your documented explicit agreement to view specific data; aggregated and anonymized information for permitted internal operations; necessary security investigations; or legal requirements.

Contacting support does not by itself grant unrestricted access to your mailbox or all Gmail-derived records. Support-related access to specific Google user data requires your explicit agreement unless another permitted exception applies.

Choose and revoke subscription support access

Use Support access to sign in and choose up to 20 specific saved subscription records. Nothing is selected automatically. You can authorize viewing only, or viewing and editing, for one hour or 24 hours. The disclosure identifies the saved fields that can be accessed, including notes, billing history, and Gmail-derived evidence. You can revoke permission on the same page. Declining does not change your paid plan.

The owner console checks this permission before returning selected record contents and when committing corrections. Permission does not grant access to your mailbox, other subscription records, or original email messages. Access that already completed before revocation cannot be undone. Legacy private notes, linked-inbox details, and message markers are withheld from the owner console because this selected-record permission does not authorize them.

New subscription-edit audit records contain change metadata rather than copied field values or free-text reasons. Historical audit records may contain earlier values; those contents are withheld in the console. User-associated audit records, support conversations, consent records, administrative session-operation records, and complimentary-access mappings are removed during account deletion.

Internal provider-icon reporting uses aggregated provider counts. Its pagination hides account paths, and temporary scan-scoped pseudonymous keys support deduplication without exposing account identifiers in results. Such keys are not a claim that all underlying data has been anonymized.

Support messages

If you contact us by email or use the support chat, we receive the information you submit. Signed-in support chat associates your conversation with your account and stores messages and related conversation information so you and authorized support personnel can exchange replies.

Support messages are used to respond to requests, investigate reported problems, and maintain the support conversation. Share only information needed for your request. Do not include passwords, verification codes, access tokens, full payment details, or unnecessary email content. Support conversations are retained with your account until account deletion. Contact the privacy email above with questions about these records; identity verification may be required.

Security and payments

Unsubscriber uses access controls and protected Firebase backend services. Firebase App Check and Google Play Integrity provide app and device integrity signals. Gmail refresh tokens are encrypted on the backend. No security measure guarantees complete protection against every possible incident.

Google Play processes in-app purchases and does not provide Unsubscriber with your full card or bank details. The backend processes purchase-verification information, account associations, product identifiers, subscription state, expiry information, and token hashes to manage access, capacity, renewals, cancellations, and refunds.

Optional crash diagnostics

Firebase Crashlytics is enabled by default to help identify failures. It may process crash stack traces, app version and state, device model, operating-system information, and identifiers used for crash grouping and delivery.

You can disable or re-enable Crash reports in Settings. Unsubscriber does not intentionally add Gmail content or addresses, OAuth credentials, purchase tokens, or AI input/output text to crash reports. Disabling future collection does not necessarily delete reports already received by the service.

Subscription-management links

Automated management-link discovery using Google Search Grounding is temporarily paused while the Android client's result delivery and cache handling are updated. This pause does not affect Gmail or screenshot extraction. The backend does not make new Search Grounding requests for management links during this pause and does not return legacy Grounding results from the shared discovery cache.

You can continue using your own saved management links, Google Play and Apple account-management pages, and public provider destinations that the owner independently verifies and publishes. Owner-published links must come from the provider's own public information, not from copying Grounding output into a shared directory. Those independently published links can be distributed through the shared provider catalog.

The repair removes legacy live cloud discovery-result caches, search leases and stored Grounding replay snapshots without resetting usage counters or deleting subscription records. Existing database recovery copies remain subject to the recovery-copy retention described below.

Older installed app versions may already have management results stored on the device. Their reuse window is up to seven days, but expiry alone does not erase the stored bytes. Such local entries can remain until replaced, cleared during account deletion in the app, or removed by the planned Android cache migration. The backend cannot remotely erase those files.

External pages are governed by their own policies. Opening a page does not cancel a subscription. Complete the provider's confirmation, then update the saved record or sync the resulting email.

Service providers and sharing

Google Firebase provides authentication, database storage, backend infrastructure, and crash reporting. Google Gemini processes the optional screenshot and Gmail extraction inputs described above. Automated Search Grounding management-link discovery is paused as explained above.

Unsubscriber contains no advertising or separate analytics SDK. Crash diagnostics and operational information are still processed as described in this policy. If you choose Export, Android lets you select another app to receive a CSV copy. The receiving app handles the exported file under its own policies.

Google services may process information on infrastructure outside your country, subject to their applicable terms and safeguards. See Google's Privacy Policy and Gemini API terms for information about Google's services.

Retention and deletion

Account and saved subscription information is retained to provide your account and cloud-sync features until you delete relevant records or your account. It is not all automatically deleted within 90 days.

Individually deleted subscriptions remain recoverable in your private account for up to 30 days unless you choose Delete forever. After the recovery period or permanent deletion, subscription content is removed and a minimal deletion marker remains until account deletion to prevent offline devices from restoring old records.

Normalized AI results and hashed request identities are retained for up to 90 days. Monthly usage counters remain until account deletion. Undo and Recently deleted apply only during the recovery window. Dashboard refresh and automatic Gmail updates respect deletion state.

You can request deletion of your Unsubscriber account using Settings → Delete account. For the external request route and verification instructions, visit Account deletion. You may also contact phoenix.digitcore@gmail.com if you cannot access the app. We may need to verify account ownership before acting on a request.

Verified account deletion removes the Firebase Authentication user and associated live account data, including synced subscriptions, Gmail credentials and mappings, cached screenshot-analysis results, rate-limit records, and Play purchase mappings. The trial-redemption marker described above is retained for abuse prevention. Recovery-copy retention is described below.

Deleting Unsubscriber data does not delete your Google Account or cancel subscriptions with providers, including an active Google Play subscription. Manage cancellation separately through Google Play or the relevant provider.

A temporary deletion-security lock retains an account identifier and timestamps to prevent delayed devices or background jobs recreating deleted data. After successful deletion, the scheduled cleanup normally removes this lock within 48 hours. If a deletion is incomplete, its lock remains until the deletion is resolved. This is separate from the trial-redemption marker and recovery copies.

Disaster recovery copies

Operational database backups use a daily schedule with seven-day retention. Point-in-time recovery retains up to seven days of available history after enablement. Recovery copies may temporarily retain deleted account data, including encrypted credentials and subscription metadata, until their configured retention expires.

Access to recovery copies is restricted to authorized administrators for recovery purposes. Deleted accounts are not intentionally reactivated from backups. Account deletion removes live application records as described above.

Changes to this policy

Updates will be published on this page with a revised last-updated date. Where a change requires additional consent or notice, it must be provided before the affected processing begins.