Privacy Policy

Last updated: March 4, 2026

SubGhost ("we", "our", or "the extension") is a Chrome browser extension that helps you track free trials and avoid unexpected charges. This policy explains what data we collect, how we use it, and your rights over that data.

      Short version: We collect only what's needed to make the extension work. We never sell your data. All trial data lives on your device and in your private Firebase account.
    

1. What Data We Collect

Google account info — Your email address and display name, used solely to identify your account via Firebase Authentication.
Trial records — Service names, end dates, and reminder preferences you add manually or that the extension detects. Stored locally in chrome.storage.local and synced to your private Firestore document.
Purchase data — When you upgrade to Pro, our payment processor (LemonSqueezy) provides us with your order ID and the email address used at checkout. We store only the order ID and license status in Firestore.
Google Calendar events — If you optionally connect Google Calendar, we create and delete reminder events on your behalf. We never read your existing calendar events.

2. What We Do NOT Collect

We do not read, store, or transmit your browsing history.
We do not collect passwords or payment card numbers.
We do not use advertising trackers or analytics SDKs (no Google Analytics, no Mixpanel, etc.).
We do not sell or share your data with third parties for marketing purposes.

3. How We Use Your Data

To display your trials in the extension popup.
To send browser notifications as trial end dates approach.
To sync your trials across devices when you're signed in.
To verify your Pro license and unlock unlimited trial tracking.
To create Google Calendar reminders (only if you explicitly connect Calendar).

4. Data Storage & Security

Your trial data is stored in:

chrome.storage.local — local to your browser, never transmitted unless you're signed in.
Google Firestore — a private document readable only by your Google account. Access is enforced by Firebase Security Rules requiring authentication.

All communication with our backend uses HTTPS. Webhook payloads from LemonSqueezy are verified using HMAC-SHA256 signatures.

5. Third-Party Services

Firebase (Google) — Authentication and database. Firebase Privacy Policy →
LemonSqueezy — Payment processing. Acts as Merchant of Record, so your payment details go directly to them. LemonSqueezy Privacy Policy →
Google Calendar API — Optional; only used if you choose to connect it.
Vercel — Hosts our backend API. Vercel may log request metadata (IP, timestamp) per their standard infrastructure logging.

6. Data Retention

Your Firestore data persists until you delete your account or manually delete individual trials. You can request full account deletion by emailing us at support@subghost.app and we will erase all stored data within 30 days.

7. Children's Privacy

SubGhost is not directed at children under 13. We do not knowingly collect personal information from children.

8. Changes to This Policy

We may update this policy as the extension evolves. The "Last updated" date at the top will reflect any changes. Continued use of the extension after changes constitutes your acceptance of the updated policy.

9. Contact

Questions or data deletion requests: support@subghost.app