Privacy Policy

This website

systmize.net is operated by Suleiman Hussein, Rua Principal, 1250, CasaAlice, Alvoeira, 3420-161 Mouronho, Portugal, who is the data controller. Contact for all privacy matters: hello@systmize.net.

Waitlist. The waitlist is closed and this website no longer collects email addresses. While it was open, people who signed up gave us one thing: their email address, used solely to contact them about Systmize early access and launch. Addresses collected while the waitlist was open are held until the Systmize web app opens to the public (and in any case no later than 17 October 2027) or the person asks for deletion, whichever comes first. Legal basis: consent (Art. 6(1)(a) GDPR), given at the time of signing up. You can withdraw it at any time.

Third parties. This website makes no calls to third-party services when you visit it. Fonts and provider logos are served from systmize.net itself, and there is no analytics, no tag manager and no embedded media. The password-reset page (systmize.net/reset) talks only to Supabase, our authentication provider listed under Processors below. We do not share your email with anyone else, and we do not use it for advertising.

How long we keep it. Addresses from the closed waitlist are kept until the Systmize web app opens to the public (and in any case no later than 17 October 2027), or until you withdraw — whichever comes first. Withdrawn addresses are deleted, not archived. To access, correct or delete your waitlist data, or to withdraw consent (same effect as deletion), email hello@systmize.net and we act on it promptly. You can also lodge a complaint with your supervisory authority — in Portugal, the CNPD (cnpd.pt).

Cookies. This site sets at most two cookies, and only when you change a setting: sy_theme stores your appearance (System, Light or Dark) and sy_lang the language you picked. Each holds that one word for a year and is shared with app.systmize.net so both look the same. Neither is used for analytics, advertising or tracking, and there are no analytics or trackers on this site. If you have not picked a language, the homepage follows your browser's language setting; nothing is stored for that.

The web dashboard

app.systmize.net is the same Systmize service in a browser, operated by the same controller. It signs you in, shows and edits your subscriptions, runs the same AI features and deletes your account — against the same database in Frankfurt, through the same server functions. Everything in the sections below applies to it, with two additions that are specific to the web.

Hosting. The dashboard is served by Vercel Inc. (United States). Vercel receives the technical details any web request carries, including your IP address, and holds short operational logs. Your account data is not stored there: it stays in Supabase in Frankfurt, and the dashboard reads it in your browser using your own session. Because Vercel is outside the EU, we rely on its data-processing terms, including EU standard contractual clauses, for that transfer.

Browser storage. The dashboard stores a few things in your own browser, not as cookies and not sent to us: your sign-in session, your display-currency choice, which dashboard groups you left open, whether you last viewed totals per month or per year, and the date of your last visit. Your appearance and language choices are the sy_theme and sy_lang cookies described under "This website", shared with it. Clearing your browser data removes them all; nothing in that list is used for analytics, advertising or tracking, and none of it leaves your device.

The Systmize app

The sections below are the privacy policy shown inside the Systmize app (Settings → Privacy Policy), and they also govern the web dashboard described above. The app copy and this one are kept identical; the data-deletion route is described at systmize.net/delete-account.

Who we are

Systmize is operated by Suleiman Hussein, Rua Principal, 1250, CasaAlice, Alvoeira, 3420-161 Mouronho, Portugal, who is the data controller for the app. Contact for anything in this policy: hello@systmize.net.

These sections cover the Systmize mobile app and the web dashboard at app.systmize.net. This website itself is covered separately, above.

What we collect and why

Account: your email address and password. The password is stored only as a hash by our authentication provider. We use the email to sign you in, to send account emails (confirmation, password reset) and to match receipts you forward to your account.

Profile: first and last name, optional nickname, date of birth, country, display currency, phone number, your marketing preference and, if you told us, how you heard about Systmize. You enter these at sign-up and can edit them in Settings. They are kept in your account record and a copy is cached on your device. Date of birth is used only to check that you are old enough; the phone number is held for account security (verification is not yet active) and to keep one account per number. No marketing email is currently sent.

Profile photo: stays on your device only. It is never uploaded to our servers.

Subscriptions: the service name, price, currency, billing cycle, next charge date, category, whether it is a fixed or usage-based plan, where it came from (manual entry or email) and a history of prices with dates. This is the core of the service: it powers your totals, price-change alerts and renewal reminders.

Insights: short alerts we generate for you (price increase, price drop, duplicate, usage change, renewal reminder, saving opportunity) and savings you log in the app. Each insight is linked to one of your subscriptions.

Forwarded receipt emails: when you forward a receipt to parse@in.systmize.net we receive the sender address, the recipient address, the subject and the message body. We use the sender address to find your account and we extract the subscription details listed above. Only those extracted details are stored. The email itself is not stored in our database and is discarded after processing.

Screenshots: if you import subscriptions from a screenshot, the image is sent to our server once for extraction. We do not store the image. You then choose which of the extracted entries to add.

Draft letters: when you ask for a cancellation letter or a support email, we send the details needed to write it (see AI processing below). The draft comes back to the app and opens in your own mail app. We do not store drafts and we do not send them for you.

Plan status: whether you are on the free plan or a paid plan, when any free trial started, and, once paid plans are on sale, the entitlement your purchase grants. This is held in your account record on our server in Frankfurt, and a copy is cached on your device so the app works offline.

Sign-in session: a session token is kept on your device so you stay signed in. It is removed when you sign out or delete your account.

Exchange rates: the app fetches daily currency rates from a public rates service (open.er-api.com) to show totals in your display currency. That request contains no account data, only the technical details any web request carries, such as your IP address. Rates are cached on your device.

What we do not collect: no bank or card details, no access to your inbox or contacts, no location, no advertising identifiers, no analytics or crash-reporting SDKs, no push notifications. The app does not use the camera or microphone. Photo library access is asked for only when you choose a profile photo or a screenshot to import.

Legal basis: running the service for you (contract, Art. 6(1)(b) GDPR) for everything above; our legitimate interest (Art. 6(1)(f)) in keeping accounts secure, preventing duplicate accounts and keeping short operational logs; your consent (Art. 6(1)(a)) for marketing messages and photo access, which you can withdraw at any time.

AI processing

Some features use a large language model. The request goes from our server to OpenRouter, which routes it to Google Gemini for extraction. The model returns structured data only; we validate the structured fields before we store or show them.

What is sent: for a forwarded receipt, the subject and the text of the email (up to 8,000 characters). For a screenshot import, the image. For a savings scan or alternative suggestions, the names, prices, currencies, cycles and categories of your subscriptions, without your name or email. For a cancellation letter, the subscription details plus your name, account email and country, so the letter identifies your account. For a support email, your description of the problem, your account email, name, plan, platform version and app version.

Under our agreement with OpenRouter, this data is not used to train models. OpenRouter and Google are outside the EU, so this data leaves the EU for the duration of the request. We rely on their standard data-processing terms, including EU standard contractual clauses, for that transfer.

Raw receipt emails are not kept by us after processing: our server extracts the subscription details and discards the message. A weekly automated scan runs over your subscription list to find saving opportunities and a daily check creates renewal reminders; both work from the stored subscription details only.

Processors

Supabase (database, authentication, server functions) — hosted in Frankfurt, Germany. All account, subscription and insight data lives here.

Cloudflare — receives emails sent to your Systmize forwarding address and passes them to our server. Cloudflare operates a global network, so the message may transit servers outside the EU under its EU data-transfer safeguards.

Cloudflare (Pages and DNS) — hosts systmize.net. Serving a page means Cloudflare processes your IP address and the request details; Cloudflare keeps request logs for a short operational period and may process them outside the EU under its data-transfer safeguards.

Formspree (United States) — holds the email addresses people left on our pre-launch waitlist. The form is no longer on the site. We email those addresses once, when the Systmize web app opens to the public, and then delete them from Formspree; any still held are deleted no later than 17 October 2027.

OpenRouter and Google (Gemini) — AI extraction and drafting, as described above.

Expo (EAS Update) — delivers app updates. When the app checks for an update, Expo receives technical request details such as platform, app runtime version and your IP address. We do not receive this information.

Google (favicon service): to show provider logos, the app loads each logo from Google's public favicon service. Each request carries your IP address and a web domain for that subscription: the provider's (for example netflix.com), or one guessed from the name you typed. It never carries your account, prices or dates.

Apple App Store and Google Play, with RevenueCat managing in-app entitlements — only once the iPhone and Android apps are listed and plans are on sale there. For purchases made in the apps, Apple and Google are the merchants of record; we never see your card details.

We do not sell your data and we do not share it with advertisers or data brokers.

Retention

Account, profile, subscription and insight data: for as long as your account exists.

Forwarded emails, screenshots and AI drafts: processed and discarded; not retained.

Operational logs on our server, which can include your email address and the extracted subscription name and price, are kept briefly by our hosting provider for troubleshooting and then deleted automatically.

When you delete your account in the app, your subscriptions, insights, profile and account record are deleted immediately, and the copies on your device are cleared. Copies in our hosting provider’s automatic backups expire on their rotation schedule. Requests sent by email are handled within 48 hours.

Your rights

Under the GDPR you can ask for access to your data, have it corrected, have it erased, receive a copy in a portable format, object to processing, ask us to restrict it, and withdraw any consent you gave. Email hello@systmize.net and we will act promptly, normally within one month.

Delete your account yourself at any time: Settings → Delete account on app.systmize.net or in the app, or via https://systmize.net/delete-account. Deletion is immediate and cannot be undone. Once paid plans are on sale, cancel any store subscription first; deleting your account does not cancel it.

You can complain to a supervisory authority. In Portugal this is the CNPD, Comissão Nacional de Proteção de Dados (cnpd.pt). You may also contact the authority in your own EU country.

Children

Systmize is not for children under 18. We ask for your date of birth at sign-up and do not create accounts for anyone younger. If you believe a child has created an account, email hello@systmize.net and we will delete it.

Changes

We update this policy when the app changes what it collects or who processes it. The date at the top tells you the current version. Material changes are announced in the app or by email before they take effect.