Privacy Policy

Who is responsible

F*ckSubscription is operated by Martin Bonan, who is the data controller for the data described here. For any privacy question or request, email martin@fcksubscription.com.

What we collect and why

• Waitlist, interest and price-alert sign-ups. When you leave your email to hear about an app or one of our packs, we store the email and what you signed up for, and we get an email notification of the sign-up so we can reply. When you tick the box to get price-change alerts on our comparison and calculator pages, we store your email in the same database. Some older sign-ups are also kept in mailing lists at Resend. Every sign-up is confirmed by email first: we send you a link, and your address is only used for mailings once you click it. We use these emails for what you signed up for (news about that product, or price changes of the tools you compared) and for occasional F*ckSubscription news and launches. Legal basis: your consent, which you can withdraw at any time with the unsubscribe link in every email.
• Purchases. When you buy the bundle or a pack, Stripe collects your payment details and billing address; we never see or store your card number. We receive and store your email address, the amount paid, the purchase date, the Stripe payment reference and, for the bundle, your license key. The license record is copied to each app's database so the key can be activated there. We use it to deliver your purchase, send your license key, and provide support. Legal basis: performance of our contract with you, and our legal obligations for accounting and tax records.
• "Your apps" page. Bundle buyers get a private link (in the purchase email, on the purchase confirmation page, or on request at /my-apps, sent only to the purchase email) to a page listing every app of the bundle. The link is signed and expires after 180 days. To show which apps you already use, the page checks, for your purchase email only, whether each app has an account with that email and whether it has access. The answer is kept in the server's memory for one minute and not stored anywhere. The page shows your email masked and never your license key. Legal basis: performance of our contract with you.
• Affiliate referrals. If a bundle owner refers you, we store their email and yours to attribute the commission when you buy. If you arrive through a referral link (a link with ?ref=), we keep its code in your browser for this tab only (session storage, no cookie) and pass it to checkout, so the referrer is credited if you buy in that tab. Likewise, if you arrive through one of our campaign links (with utm_source / utm_campaign, e.g. from our newsletter), we keep those two labels (not personal data) in your browser for this tab only (session storage, no cookie) and attach them to your purchase in Stripe, so we know which campaign led to a sale. Legal basis: our legitimate interest in running the affiliate program.
• Emails we send. Transactional emails (license keys, purchase confirmations) and, if you signed up, product news. Every marketing email has a one-click unsubscribe link. When you unsubscribe we keep your email address on a suppression list so we never email you again.
• App suggestions. If you suggest a tool for us to build, we store the name you type, with no email or other identifier attached.
• Anonymous counters. We count clicks on app links and votes on app ideas. These counters store the app name and a timestamp, nothing that identifies you. To prevent double votes, your browser remembers which idea you voted for in its local storage. Until October 2026 the click counters also stored visitors' IP addresses; we stopped collecting them, and the stored ones are no longer accessible to anyone outside our team and are scheduled for deletion.
• Analytics. We count page views with Vercel Web Analytics, without cookies or persistent identifiers (no visitor ID is stored in your browser). Legal basis: our legitimate interest in understanding and improving the site.
• Abuse prevention. To stop people from signing up others or flooding our forms, we keep a keyed hash of your IP address and email address (not the addresses themselves) to limit the number of sign-ups per hour and per day. We delete these records once they are more than a day old.
• Server logs. Our host, Vercel, processes your IP address and browser information to serve pages and protect the site against abuse.

We don't sell your data, we don't use advertising trackers, and we don't make automated decisions about you.

KiwiProof: people who leave a testimonial

KiwiProof lets its customers ("owners") collect testimonials through a public form. If you leave a testimonial there, the owner of that form decides what to publish and is responsible for it; we host the data for them, in our Supabase database.

• What the form stores: your name, your role or company (optional), a star rating (optional), your text, an optional photo (JPEG, PNG or WebP, up to 2 MB, kept in private storage) and an optional YouTube or Loom link. We do not ask for your email address.
• Consent: you must tick a box agreeing that the owner may publish your testimonial with your name, role and photo. Nothing is public until the owner approves it; approved testimonials (name, role, rating, text, photo, video link and dates) are shown on the owner's website.
• Abuse prevention: to rate-limit the form we store a salted hash of your IP address, never the address itself. These records are short-lived and deleted automatically.
• Owners can also add a testimonial by hand (for example a public post) and attest that they may publish it.
• How long: until the owner deletes the testimonial, the space or their account. To have your testimonial removed, ask the owner, or email martin@fcksubscription.com and we will pass it on or remove it.

DurianStatus: status page subscribers and monitored sites

DurianStatus lets its customers ("owners") publish a status page for their service. The owner of a status page decides what it shows and is responsible for it; we host the data for them, in our Supabase database.

• If you subscribe to a status page: we store your email address and your subscription status. You must confirm by email first (double opt-in); you then get an email when an incident on that page is opened, updated or resolved, and every email has a one-click unsubscribe link. The owner of the page can see the addresses of its subscribers and remove them. We don't store your IP address; to limit abuse we keep salted hashes of it for a short time.
• Monitored sites: owners can have a public web address checked every 5 minutes. We store that address and, per day, the number of checks, failures and the total response time. We never read or store page content. The public status page shows the daily results, never the address.
• How long: daily check results for 95 days; subscriptions, incidents and pages until the owner deletes them or their account. To have your email removed from a status page, unsubscribe from any email, ask the owner, or email martin@fcksubscription.com.

LimeQR: people who scan a code or open a short link

LimeQR lets its customers ("owners") create QR codes and short links that send people to an address the owner chooses. The owner decides where a link goes and is responsible for it; we host the links for them, in our Supabase database.

• When you scan a code or open a short link: we redirect you and add one to a daily count for that link, by country (from the network you connect from) and device type (mobile, tablet, desktop). We don't store your IP address or your browser's user agent; to avoid counting the same scan twice we keep a hash of them in memory for a short time. Link previews and bots are not counted. The owner sees the daily counts, never who scanned.
• Destinations: when an owner saves a link, its destination address is checked against our blocklist and Google Web Risk, which receives that address to tell us whether it is known as malware or phishing.
• If you report a link: we store the link, the reason, your details and, if you give it, your email, and email them to Martin to review. To limit abuse we keep salted hashes of your IP address for a short time.
• How long: daily counts until the owner deletes the link or their account; reports are kept with their outcome. To have your report or email deleted, or to ask about a link, email martin@fcksubscription.com.

FigVote: people who post, vote or comment on a feedback board

FigVote lets its customers ("owners") run a feedback board, a roadmap and a changelog for their product. The owner decides what the board shows and is responsible for it; we host the data for them, in our Supabase database.

• If you post, vote or comment: you sign in with your email (a sign-in link or a password). We store your email, the name you choose to show (optional), your posts, votes and comments, and the posts you follow. Your name and what you write are shown on the board; your email is not.
• Emails: when a post you voted on or follow changes, you get at most one summary email a day from that board, with a one-click unsubscribe (we keep a hash of your email to remember it, not the address).
• What the owner sees: the board's posts, votes and comments with the emails of their authors and voters, which the owner can export.
• How long: until the owner deletes the post, the board or their account, or you delete your own account. To limit abuse we keep salted hashes of your IP address for a short time. To ask about a board, email martin@fcksubscription.com.

GrapeLink: email sign-up blocks

A GrapeLink page can have an "Email sign-up" block. GrapeLink stores, on behalf of the page owner, the email addresses visitors leave there, with their consent: you tick "I agree that <page> can email me", and that consent is stored with your address.

• The page owner can see, export (CSV) and delete these addresses, and is responsible for how they use them. GrapeLink never emails them. To be removed, ask the page owner, or email martin@fcksubscription.com.
• To limit abuse we keep salted hashes of your IP address for a short time. The addresses are kept until the owner deletes them, their page or their account.

If you tell us why you left the checkout

When you come back to the bundle page from the checkout without paying, we may ask what stopped you. If you answer, we keep the reason you picked and the note you typed, if any. Nothing else: no email, no IP address, no link to your checkout. Your IP address is only used, in a scrambled form kept one day, to limit how many answers can be sent. We read the answers in aggregate to improve the page and the offer.

KiwiProof: testimonial requests after a meeting

If a KiwiProof owner turns on "Send a testimonial request after each meeting" and connects their PeachCalendar account, KiwiProof receives the name and email address of the people who booked a meeting with them. We use them for one thing only: sending one email on the owner's behalf, after the meeting, asking for a testimonial. We never email the same person more than once in 30 days for the same owner.

The owner can also turn on "Ask when a project is delivered" and connect their GuavaTeam account. When a card is moved to the column they chose, KiwiProof receives the card's title and the client's email address written on it (or the one already on their GuavaTeam Leads board), and sends that client the same single request email, under the same rules.

• Unsubscribe: every email has a one-click unsubscribe link. If you use it, we add a scrambled (hashed) form of your address to a do-not-ask list so you are never asked again by that owner.
• What the owner sees: the requests sent (name, email, and whether you answered), including one you unsubscribed from.
• How long: requests are deleted when the owner deletes the space or their account; the do-not-ask list is deleted with their account. Emails are sent through Resend.

Your F*ckSubscription account

One F*ckSubscription account lets you sign in to any of our apps with the same email and password: you click "Continue with F*ckSubscription" on the app's sign-in page and sign in once, on fcksubscription.com. You manage the account at fcksubscription.com/account.

• What the account stores. Your email address, your password as a one-way hash (nobody can read it, us included), whether your email address is confirmed, your two-step verification setup if you turn it on, and when the account was created and last used. Supabase, which runs our sign-in, also logs sign-in events with the IP address, to protect accounts. Legal basis: performance of our contract with you (the sign-in you use), and our legitimate interest in keeping accounts secure.
• Accounts we set up for existing customers. If you already had an account on MangoForm, PeachCalendar, GrapeLink or GuavaTeam and your email address there was confirmed (or you signed in there with Google, with a verified email), we create your F*ckSubscription account with the same email address and copy your password hash (if you had a password there), so your current password works. If you used that email on several of these apps, it's the password of the one you signed in to most recently. Nothing else is copied, and no email is sent. Accounts whose email address was never confirmed are not used. Legal basis: our legitimate interest in giving our existing customers one sign-in without a new password to create. You can delete the account at any time (below).
• What our apps receive when you sign in. When you continue with F*ckSubscription on one of our apps, that app receives your account ID, your email address and whether it is confirmed. Never your password or your two-step verification. The app uses them to open your account there: the one with the same email address, only if that address was proven to be yours, or a new free account if you have none. It never links an account by an unconfirmed email address. The link (your F*ckSubscription account ID and the app's account ID) is stored in that app's database and in ours. Your data and what you paid for stay in each app, as before. Only our own apps can use this sign-in.
• Cookies. Signing in on fcksubscription.com sets the cookies needed to sign you in and keep you signed in. They are strictly necessary and used for nothing else. Signing out removes your session.
• Unlink an app or delete the account. Email martin@fcksubscription.com from your account's address. We can unlink one app (your account in that app stays, and you sign in there with that app's own sign-in form, or reset its password) or delete your F*ckSubscription account and all its links. Deleting it does not delete your accounts or data in the apps: say so in the same email if you want those deleted too. We do it within one month.

Connected apps

Our apps can be connected to each other. A connection is only made when you click Allow, and only gives the other app what the consent screen lists. The access it gives is stored encrypted, and you can remove it at any time from either app.

• KiwiProof and DurianStatus: if you connect them to another of our apps (for example GrapeLink), that app can see the list of your testimonial spaces or status pages (names and public addresses), and nothing else. You choose there which ones to show. You can see and remove these connections in your account.
• GrapeLink: when you connect PeachCalendar, MangoForm, KiwiProof or DurianStatus, GrapeLink can list your event types, forms, testimonial spaces or status pages so you can pick one, and shows the one you picked on your public page. It stores which item you picked (its name and public address), not the content of the other app.
• GrapeLink as a source: if you connect GrapeLink to another of our apps, that app can read the branding of your pages (the page name, your avatar, the brand color you picked and the address of each public page, on your own domain if you connected one) when you open "Use details from your apps" there, and uses it only if you pick it.
• FigVote: if you connect GuavaTeam, FigVote creates a card for each request you mark Planned (its title, vote count and link), and reads when that card moves, to mark the request In progress or Shipped.

Who processes your data

We rely on these providers, each acting on our instructions:

• Vercel (United States): hosting, server logs, Web Analytics.
• Supabase (databases hosted in the United States): sign-ups, purchase and license records, referrals, counters, F*ckSubscription accounts and sign-in.
• Stripe (United States / Ireland): payments.
• Resend (United States): sending emails and storing mailing lists.
• Google Web Risk (United States): checking LimeQR link destinations against known malware and phishing.

When data is transferred outside the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as offered by each provider.

How long we keep it

• Waitlist and interest sign-ups: until you unsubscribe or ask us to delete them.
• F*ckSubscription account, its links to your app accounts and its sign-in logs: until you delete the account. We keep a record, without your email address, that we created it.
• Purchase and license records: for as long as your license is active, and then as long as accounting and tax law require.
• Suppression list (unsubscribed addresses): permanently, so we never email you again. Ask us if you want it removed anyway.
• Affiliate referrals: until the commission is paid, then as long as accounting law requires.
• Analytics and server logs: according to Vercel's retention settings.

Your rights

You can ask to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw your consent at any time. Email martin@fcksubscription.com and we will answer within one month. You can also lodge a complaint with your local data protection authority.

Changes

If we change what we collect, we update this page and the date at the top. For significant changes we will tell people on our mailing list by email.