What Renewbird knows about you, and what it never will.

The short version

• Renewbird is a subscription tracker. You type in what you pay for; it never connects to your bank and never asks for card numbers.
• We keep what the app needs to work: your account, the subscriptions you add, and your reminder settings.
• We note how you found Renewbird (a link with campaign tags, the website that sent you, or the Play Store), so we know which places are worth our time.
• Product analytics are anonymous, never include your amounts, names or notes, and can be switched off in Settings.
• We don't sell your data, show ads, or share it with anyone except the services that run the app, listed below.
• You can export everything or delete your account from Settings at any time.

Who we are

Renewbird ("we") runs the Renewbird app on the web at renewbird.app, on iPhone and on Android. Questions about this policy or your data go to privacy@renewbird.app.

What we keep, and why

Your account

• Email address, to sign you in, send your confirmation code and password-reset links, and (if you turn them on) email reminders.
• First name, to greet you in the app. You can change it in Settings.
• Password, stored only as a one-way hash by our authentication provider. We can't read it.
• If you sign in with Google or Apple, we receive the email address and name that provider shares, and an identifier for your account there. Apple lets you hide your real email; we then only see the relay address.

What you add

• Subscriptions: name, price and currency, how often it renews, dates, free-trial details, category, colour, status, any cancel link and your notes.
• Reminder settings: when and how you want to be reminded, and the reminders scheduled from them.
• Preferences: your time zone (from your device unless you set it), currency for totals, and similar settings.
• Payment method labels, only if you created one in an earlier version: a nickname, optionally the card brand and last four digits. Never a full card number, security code or expiry date; the database refuses them.

We use this only to show you your totals, calendar and reminders. We don't look at it, analyse it for anyone else, or use it for advertising.

How you found us

• When you create an account we store, once, how you found us: the campaign tags on the link you followed (such as "reddit" or "launch-2026-11"), the website that sent you (for example google.com, never the full address), the first page you landed on and when.
• On the website, this sits in a small first-party cookie (rb_ft) from your first visit until you sign up, then the cookie is deleted. It expires after 90 days, is never sent to anyone else, and isn't used to track you around the web.
• On Android, it's Google Play's install referrer: the tags on the link that led to the install, or "Play Store" if you found us there. iPhones don't share this.
• It's included in your export and deleted with your account.

To deliver reminders

• Device tokens: when you allow notifications, your phone or browser gives us a token so reminders can reach it. We remove it when you sign out on that device or the token stops working.

Purchases

• If you buy Renewbird Pro, the App Store, Google Play or, on the web, Paddle handles the payment. We never see your card. We receive what you bought, when, and whether it is active, so the app can unlock Pro.
• On the web, Paddle is the seller of record: it collects your email, country and payment details to take the payment, charge the right tax and send your receipt, under its own privacy policy.

Analytics

• We count anonymous product events (for example "a subscription was added" or "a reminder was opened") with PostHog, linked to a random account identifier, never your email or name.
• They never include subscription names, notes, payment labels or exact amounts; prices are only ever sent as a broad range such as "5–15".
• We ask PostHog to discard IP addresses. Session recording, heatmaps and automatic click tracking are off.
• Inside the app, nothing is sent before you sign in. Switch it off any time under Settings → Privacy, and it stays off on every device.
• On our public pages (the home page, blog, guides and tools), PostHog counts anonymous page views and clicks on the store buttons, with the address of the page and the site or campaign that sent you. No cookies are set for this, every page load is a new anonymous visitor, and it's never linked to your account.
• The website honours your browser's Do Not Track setting.

Logs

Our hosting and database providers keep short-lived technical logs (such as request times, IP addresses and errors) to keep the service secure and working, for example to limit repeated sign-in attempts.

Who can see your data

Only Renewbird's founder, through an internal admin view, to run and improve the service: your email, first name, sign-up date, plan, how you found us, and counts (how many subscriptions and reminders you have). The admin view never shows your subscriptions' names, prices or notes. Access is limited to named accounts and checked by the database itself.

Who helps run Renewbird

We use these services, each only for the job described, under their own privacy and security terms:

• Supabase: database, sign-in and background jobs. Your data is stored in its Mumbai (India) region.
• Vercel: hosts the website. Its servers run in the same region.
• Google Firebase: delivers push notifications to your phone or browser.
• Resend: sends our emails (confirmation codes, password resets and email reminders).
• PostHog: anonymous product analytics, in the United States.
• RevenueCat, Apple, Google Play and Paddle: purchases of Renewbird Pro.
• Google and Apple: only if you choose to sign in with them.

Exchange rates come from a public rates service; we send it nothing about you.

Some of these services process data outside your country, including in India and the United States. Where the law requires it, we rely on their standard contractual protections for those transfers.

We don't sell or rent your personal data, and we don't share it for advertising. We would only disclose it if the law required us to.

How long we keep it

• Your data stays while you have an account.
• A subscription you delete is erased for good 30 days later.
• Sign-in records (when you signed in, and from where) are erased after 30 days.
• When you delete your account, from Settings, your account, everything in it and its sign-in records are deleted straight away. Copies can remain in our database provider's encrypted backups until those expire.
• Purchase records are kept by the stores and payment providers as their own rules and tax law require.

Your choices and rights

• See and take your data: export your subscriptions as a spreadsheet (CSV) or everything, including how you found us, as JSON from Settings → Your data.
• Correct it: edit anything in the app.
• Delete it: Settings → Delete account removes your account and data. If you signed in with Apple, the iPhone app asks Apple to confirm once more and then revokes Renewbird's access to your Apple ID.
• Analytics: switch off under Settings → Privacy.
• Notifications and email reminders: turn them off in Settings or your device settings.

Depending on where you live (for example under the GDPR in the EU and UK), you may also have the right to object to or restrict how we use your data, and to complain to your data protection authority. We use your data to provide the service you signed up for, and for analytics on the basis of our legitimate interest in improving the app, which you can opt out of. To exercise any right, email privacy@renewbird.app.

Security

Data travels encrypted (HTTPS). Every row in our database is locked to its owner, so one account can't read another's. Our server keys never ship in the apps.

Children

Renewbird isn't meant for children under 16, and we don't knowingly keep their data. If you think a child has an account, email us and we'll delete it.

Changes

If we change this policy, we'll update the date at the top and, for significant changes, tell you in the app or by email before they apply.