Privacy policy

This Privacy Policy explains how we collect, use, and protect your personal data when you use SubAnalyzer ("we," "our," or "us"). By using our website, you agree to the terms of this policy.

Information we collect

• Account information: When you sign up via Google login, we collect your name, email, and profile picture URL. When you sign up via email, we collect your email address directly
• Subscription data: We store your subscription ID to manage your access to premium features. Payment details are handled by Stripe and its checkout, Link
• Search data: We log the domains and subdomains you search for to track usage and improve our services
• Contact form data: When you use our contact form, we collect your name, email address, and message content
• IP addresses and logs: We store your IP address at the time of account creation for security purposes. Connection attempts may also be logged. Without an account, we keep your IP address with the domains you opened and a daily count for up to 90 days, to apply the free daily limit
• Cookies: Four cookies are necessary and always on: sessionid keeps you signed in, csrftoken protects forms from abuse, sa_known remembers that this browser has signed in, so a stranger cannot stop it getting sign-in codes, and sa_consent remembers your cookie choice. Analytics in your browser (Google Analytics and PostHog, including session replay with your email address and name masked) is on unless you turn it off, in the cookie notice or any time from Cookie settings at the bottom of every page
• Usage analytics: Unless you turn analytics off, we use Google Analytics and PostHog to understand how the site is used, such as which pages are visited and which features are clicked. These tools may set their own cookies and identifiers, and PostHog data is collected through our own domain. Separately, sign-ups and subscription changes are recorded in PostHog from our servers under your account's email address, whatever you choose in Cookie settings

How we collect your data

• Google OAuth when you create an account via Google login
• Directly from you when you sign up via passwordless email login or submit the contact form
• User interactions, such as searches and subscription updates
• Server logs that record access attempts and security events

How we use your data

• Provide and improve our services, including subdomain searches and subscription management
• Detect and prevent fraud, abuse, and unauthorized access
• Send transactional emails (e.g., account confirmations, subscription updates, security notifications)
• Send marketing emails (if opted in), with an option to unsubscribe
• Analyze website usage to enhance performance and user experience

Who we share your data with

We do not sell your data. However, we share information with third-party providers to operate our services:

• Stripe and Link: To sell subscriptions and handle payments, tax and receipts
• Amazon Web Services (AWS): To send account-related and optional marketing emails
• Cloudflare: For DNS, DDoS protection, and bot prevention
• Microsoft Azure: For hosting infrastructure and application monitoring via Application Insights
• Google: For website analytics via Google Analytics
• PostHog: For product analytics that shows us how features are used
• Anthropic: To describe the screenshots our scans take and to find domains related to a scanned one. It receives the screenshots, page titles and public DNS and registry data, nothing about you

How you can control your data

• Account deletion: You can delete your account from the dashboard. Upon deletion, scan data is retained in anonymized form (your user association is removed). Your Stripe customer ID mapping is preserved to ensure correct account association if you re-create your account. A record of each free trial, the card's Stripe fingerprint and the subscription ID, is kept without your account, so a card can start only one free trial
• Data access requests: You can request a copy of your data
• Email preferences: You can opt out of marketing emails via an unsubscribe link

Security measures

• Encryption of sensitive information
• Rate limiting and abuse detection mechanisms
• Continuous monitoring for unauthorized access

Data retention

• Scan data is retained indefinitely to provide historical results
• Server logs are retained for a limited period
• Account data is deleted upon request, except as noted in the Account deletion section above

International data transfers

Your data may be processed in the United States and other countries where our service providers operate, including Microsoft Azure, Amazon Web Services, Stripe, Cloudflare, Google, PostHog, and Anthropic.

Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page, and we may notify you via email.

Contact us

If you have any questions about this Privacy Policy, please visit our contact page.