How we keep your data safe

• No bank login, ever

  You upload exports yourself. Subless can’t see your accounts or move money.

• Bank CSVs stay in your browser

  Only the subscriptions you confirm are saved.

• Stored in the EU

  Database and app servers in Ireland.

• Encrypted

  In transit (HTTPS) and at rest.

• No ads, no tracking

  No data sales. The only cookies keep you signed in.

• Delete means delete

  Your account and everything in it, right away, from Settings.

There are no passwords to leak. You sign in with a passkey (Face ID, Touch ID or a security key), a one-time code sent to your email, or Google. You can see your passkeys in Settings and sign out of every device at once.

Your subscriptions (name, price, cycle, dates, the icon you picked), your reminder settings, your AI scan history and the email address you sign in with. If you subscribe to Subless, also the plan’s status and billing period.

We never see or store card details. Polar, our reseller, takes the payment on its own checkout page.

We don’t store bank exports, statement files, screenshots or the text of forwarded emails. Those are read and thrown away.

• Bank export (CSV)

  Read entirely in your browser. Nothing from the file reaches our servers. You pick which of the detected subscriptions to save.

• PDF statement

  Our server turns the PDF into text and keeps only lines with amounts. It removes IBANs, card numbers, email addresses, phone numbers, long reference numbers and lines that name the account holder. Only what’s left goes to the AI model. The file is discarded when the request ends.

• Screenshot

  The image goes to the AI model as it is, so crop out account numbers or anything else private first. It’s discarded after reading.

• Forwarded email

  We accept mail only from your own address or a bot you set up. The body is cleaned the same way as a statement and read by the AI model. We keep the subject, the sender’s domain and what was found, never the email itself.

AI imports run on a commercial AI API, and only when you start one. Under the provider’s terms, what we send isn’t used to train their models by default, and it’s deleted from their systems within 30 days, apart from exceptions like abuse checks and legal requirements. The privacy policy names the provider.

• Every table uses row level security: the database itself only returns your own rows. Automated tests try to read and change other people’s data, and must fail.
• Scan allowances, subscriptions, AI jobs and reminders are changed only by our server, never directly by the app. A subscription changes only through Polar’s signed webhook.
• Secrets like the database service key and the AI key exist only on the server.
• Data is encrypted in transit (HTTPS) and at rest.
• AI use is rate limited per account, and paused for everyone if daily usage passes a hard budget.

• Export everything as CSV or JSON from Settings.
• Delete your account from Settings. It’s gone right away, with no email to support.
• Hide amounts with the eye button in the header, handy in public.
• Turn off reminder emails from the link in any email.

• SupabaseUSA, EU hostingDatabase and sign-in, hosted in Ireland
• CloudflareUSA, EU hostingRuns the app next to the database in Ireland
• Our AI providerUSAReads statements, screenshots and emails, only when you import
• ResendUSASends sign-in codes and reminder emails
• GoogleUSASign-in, only if you choose it
• PolarUSASells the subscription and takes the payment, only if you subscribe

Details and legal bases are in the privacy policy.

Write to hello@board.ly. We answer security reports first.