Privacy Policy

Last updated: 2026-10-23 · Effective: 2026-10-23

This Privacy Policy explains what personal data SUB&SUB collects when you use www.subnsub.com and api.subnsub.com, what we do not store, who processes data with us, and how to exercise your privacy rights.

This update clarifies existing Service behavior: Google Gemini model routing alongside OpenAI and Anthropic, the shared sid sign-in cookie and Tools Plus subscription records across subnsub.com, tab-scoped sessionStorage keys, and self-service account deletion in the Console.

At a glance

Short version We store only what we need to run accounts, authentication, and billing: your email, sign-in and two-step verification credentials, versioned legal-acknowledgement records, hashed API keys, and billing/usage ledger entries. We do not store your prompts or model responses. API requests are forwarded to the upstream AI provider for the model you choose (OpenAI, Anthropic, or Google). If you append :online, the latest user message is also sent to Tavily for web search. Payments run on Stripe, and we never see your card number. We do not use analytics trackers or sell personal data.

1. Who we are

SUB&SUB ("we", "us") operates www.subnsub.com and api.subnsub.com and acts as the data controller for the personal data described in this Policy. Your SUB&SUB account also powers shared sign-in and Stripe subscription management for our sister developer-tools site at tools.subnsub.com (which publishes its own tool-specific privacy notice). For privacy questions or requests, email [email protected].

2. What we collect

2.1 Account, security & subscription records

When you register or manage your account, we store:

Data	Source	Purpose
Email address	You, or Google OAuth	Account login, verification, billing receipts, and security or policy notices.
Password hash	Derived at signup/reset	PBKDF2-SHA256 password hash (empty for Google-only accounts); plaintext passwords are never stored.
Google account ID, display name & avatar URL	Google OAuth, or you	Links Google sign-in to your account and shows your profile in the Console.
Account & verification timestamps	System	Records when the account was created and when email ownership was verified.
Legal acknowledgement record	System, after your signup action	Stores the accepted Terms and Privacy versions, prompt version, timestamp, page locale, and signup method (email or Google, and whether initiated on `www` or `tools`).
Two-step verification credentials	You, if enabled	Stores your active 2FA method; for TOTP, the shared secret and last accepted time step; for WebAuthn passkeys, the credential ID, public key, algorithm, signature counter, transport hints, and timestamps.
Tools Plus entitlements & referrals	Stripe / system, if used	If you subscribe to Tools Plus, redeem a promo/referral grant, or submit a signed-in tool request on `tools.subnsub.com`, the shared database records your Stripe customer/subscription IDs, plan status, billing period, referral/promo grant state, and submitted request text.

2.2 API key metadata

For each API key you create, we store its label, a SHA-256 hash of the key, the short visible prefix (such as sk-cf-fJk2…), creation time, last-used time, and revocation time (if revoked). The full key is shown once at creation and is never stored in plaintext.

2.3 Billing & transactions

For each credit top-up, API settlement, or refund, we store a ledger entry with the transaction type (topup, settle, or refund), amount in cents and microdollars, payment source (stripe or usage), reference ID (Stripe Checkout Session ID cs_… or per-request ID req:<uuid>), and timestamp. We also log processed Stripe webhook event IDs, event types, amounts, and timestamps so retried webhooks cannot double-credit or double-process an event.

2.4 Per-request usage metering

When you call /v1/*, we record the API key used, requested model ID, input/output and prompt-cache token counts reported upstream, request latency, microdollar debit, per-request UUID, and timestamp so we can bill accurately, display Console usage history, and detect abuse. We do not store prompt bodies or model response bodies on SUB&SUB systems.

2.5 Authentication & session state

Short-lived authentication state is stored in Cloudflare KV with automatic expiration: email verification tokens (up to 24 hours), password-reset tokens (up to 1 hour), Google OAuth state and nonces (about 10 minutes), two-step login and passkey ceremony challenges (about 5 minutes), and session records (about 30 days). Signed-in browser sessions use a cookie named sid set with HttpOnly; Secure; SameSite=Lax (and Domain=.subnsub.com on production hosts so a single sign-in works across www.subnsub.com and tools.subnsub.com).

2.6 Server-side logs

Cloudflare processes network edge metadata—including IP address, request path, user-agent, HTTP status, country header (cf-ipcountry), and timing—for security, DDoS mitigation, rate limiting, and operational diagnostics. Our Workers/Pages Functions also write minimal operational error logs to Cloudflare's short-lived runtime log stream when an upstream or internal error occurs.

2.7 Transactional email

We send verification links, password resets, and essential security, billing, or policy notices from [email protected] via Cloudflare Email Routing/Workers, with Resend configured as a delivery fallback if the primary path fails. The active mail provider receives your email address and the message content.

3. What we don't collect

Prompt or response bodies. Metered /v1/* requests stream through our relay to the upstream AI provider without writing message text to our database or persistent logs. Upstream AI providers process your request content as described in §5, and Tavily processes the latest user message when you opt into :online.
Payment card numbers. Checkout and subscription management run on Stripe-hosted pages. Stripe handles your card or Link details directly; we receive only Stripe customer, session, subscription, and payment status metadata.
Third-party behavioural analytics. We do not load Google Analytics, Meta pixels, Mixpanel, PostHog, Sentry, or session-replay scripts.
Advertising profiles. We do not sell personal data or share it with ad networks.

4. How we use data

We use personal data only to:

Authenticate your account and API keys, route API requests to upstream providers, and return responses.
Maintain your prepaid balance, Subscriptions/Plus entitlements, and itemized billing history.
Send transactional emails for verification, password recovery, security alerts, billing events, and material policy updates.
Detect and prevent fraud, rate-limit abuse, credential stuffing, and violations of our Terms of Service.
Meet tax, accounting, and legal obligations.

We never use your data to train AI models or authorize third parties to train AI models on our behalf.

We share personal data only with service providers needed to run the features you use, or when required by law:

Recipient	What they receive	Purpose
Cloudflare (Pages, Workers, D1, KV, Email)	Network traffic metadata, data stored in D1 and KV, and outbound transactional email payloads.	Hosts our edge network, database, key-value store, and primary email delivery. Cloudflare Privacy Policy.
Upstream AI providers (OpenAI, Anthropic, and Google)	The `/v1/*` request payload you submit (prompts, messages, tool definitions, parameters) routed through our upstream provider credentials, without your SUB&SUB email address.	Generates the model response for the model family you select. Governed by the OpenAI Privacy Policy, Anthropic Privacy Center, and Google Privacy Policy.
Tavily (only when you append `:online`)	Up to 400 characters of the most recent user message as a web-search query.	Fetches live public-web search results prepended to your model request. Tavily Privacy Policy.
Resend (transactional-email fallback)	Recipient email address, subject, message body, and delivery metadata when fallback mail delivery is triggered.	Delivers verification, reset, security, or billing emails if Cloudflare email delivery is unavailable. Resend Privacy Policy.
Stripe	Account email, checkout or subscription amount, currency, billing status, and payment details entered on Stripe Checkout or the Stripe Customer Portal.	Processes credit top-ups and Tools Plus subscriptions and notifies us via signed webhooks. Stripe Privacy Policy.
Google (only if you sign in with Google)	OAuth 2.0 / OpenID Connect sign-in request; Google returns your verified email, subject ID, display name, and avatar URL.	Provides passwordless Google sign-in. Google Privacy Policy.
Public authorities	Only records required by valid, binding legal process.	Compliance with applicable law.

We do not "sell" personal data or "share" it for cross-context behavioural advertising under the California Consumer Privacy Act (CCPA/CPRA).

6. Legal bases for processing (EEA/UK users)

Where the GDPR or UK GDPR applies, we rely on:

Contract performance (Art. 6(1)(b)) — to create and secure your account, issue API keys, route requests, and manage balances and subscriptions.
Legitimate interests (Art. 6(1)(f)) — to protect the Service against fraud, abuse, and security threats, maintain reliability, and troubleshoot errors, balanced against your rights.
Legal obligation (Art. 6(1)(c)) — to keep required tax, accounting, and compliance records and respond to binding legal requests.
Consent (Art. 6(1)(a)) — only if we offer an optional feature that explicitly asks for your opt-in consent, which you may withdraw at any time.

The signup checkbox records your agreement to the Terms and acknowledgement of this Privacy Policy; it is not marketing consent.

7. International transfers

Cloudflare, Stripe, OpenAI, Anthropic, Google, Tavily, and Resend process data across multiple countries, including the United States. When personal data leaves the EEA, UK, or Switzerland for a country without an adequacy decision, our providers rely on recognized transfer mechanisms such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum published in their data-processing terms.

8. Retention & account deletion

Category	Retention period
Account profile, 2FA credentials, API keys, and usage ledger	Kept while your account is open. If you use Settings → Delete account in the Console, your user record and dependent API keys, 2FA credentials, passkeys, Plus entitlements, referrals, and account-linked transaction rows are deleted immediately, active KV sessions are revoked, and any active Stripe Plus subscription is cancelled.
Accounts closed via support or inactivity	Deleted or anonymized within a reasonable period (and no more than 24 months after closure unless law or an active dispute requires longer preservation).
Stripe webhook idempotency & statutory tax/accounting records	Retained for up to 7 years where required for tax, accounting, payment reconciliation, or fraud-prevention obligations.
KV verification, reset, OAuth & 2FA challenge tokens	Expire automatically within 5 minutes to 24 hours depending on token type.
Session tokens in KV	Expire automatically 30 days after creation, or immediately upon sign-out or account deletion.
Cloudflare edge logs	Retained briefly by Cloudflare under its standard operational log retention schedule.

9. Your rights

Depending on where you live, you may have the right to:

Access a copy of the personal data we hold about you.
Correct inaccurate or incomplete account information.
Delete your account and personal data (directly in Console Settings when your balance is non-negative, or by contacting us), subject to mandatory legal retention.
Restrict or object to certain processing, including processing based on legitimate interests.
Export your account and billing data in a structured, machine-readable format.
Withdraw consent where processing is based on consent.
Complain to your local data-protection authority (EEA/UK) or state regulator (U.S.).

We do not make solely automated decisions with legal or similarly significant effects. To exercise your rights, email [email protected] from your account email address. We verify requests before disclosing or modifying account data and respond within 30 days (or notify you if a lawful extension applies). California residents may use an authorized agent and will never face discrimination for exercising privacy rights.

10. Security

Passwords use PBKDF2-SHA256 hashing, API keys use SHA-256 hashing, and accounts support optional TOTP authenticator and WebAuthn passkey two-step verification.
Session cookies (sid) are HttpOnly, Secure, and SameSite=Lax, and all traffic runs over TLS via Cloudflare.
Stripe webhooks are verified with HMAC signatures and a 5-minute replay window using encrypted Cloudflare secrets.
Traffic between Cloudflare and our upstream relay host runs over a private Cloudflare Tunnel restricted to ^/v1/ paths.

No system can guarantee absolute security. To report a security issue, email [email protected] with the subject line "Security report" and allow reasonable time for remediation before public disclosure.

11. Cookies & browser storage

We use strictly necessary and functional first-party cookies, localStorage, and tab-scoped sessionStorage. We set no advertising or third-party tracking cookies.

Name	Where	Purpose	Lifetime
sid	Cookie (`.subnsub.com`; `HttpOnly, Secure, SameSite=Lax`)	Identifies your signed-in session across `www.subnsub.com` and `tools.subnsub.com`.	~30 days (or until sign-out)
lang_pref	Cookie (`Secure, SameSite=Lax`)	Remembers your chosen display language on `www.subnsub.com`. Readable and updatable by the in-page language picker so bare `/` redirects to `/<lang>/` consistently. Pick English (`lang_pref=en`) to stay on `/`.	~1 year
cf-mode	localStorage	Saves your light, auto, or dark theme choice.	Until cleared
cf-limited	localStorage	Caches whether a signed-in account was created after the API capacity cutoff so pages paint the right navigation state immediately.	Until sign-out or next session check
cf-anim	localStorage	Saves your motion preference (on, off, or OS default).	Until cleared
cf-themecache	localStorage	Stores resolved light/dark CSS token values written by the theme script.	Until cleared
pg-key	sessionStorage	Keeps a newly created or entered API key in memory for the current Console Playground tab only; never written to `localStorage`.	Until tab closes
verified-pkgate	sessionStorage	Preserves the one-time passkey setup token across reloads on the post-verification page.	Until tab closes
cf-vchk	sessionStorage	Tracks live-deployment version checks so open tabs update cleanly without reload loops.	Until tab closes

Explicit locale paths (such as /zh-CN/ or /de/) always render that language. On your first non-crawler visit to bare / without lang_pref, our edge middleware checks Cloudflare's cf-ipcountry country code, redirects to a matching supported locale if one exists, and sets lang_pref.

During Google sign-in or Stripe Checkout/Portal sessions, Google and Stripe may set their own cookies on their domains under their respective privacy policies.

12. Children

The Service is for adults aged 18 and older (or the age of majority in your jurisdiction), and we do not knowingly collect personal data from children under 13. If you believe a child has submitted personal data to us, email [email protected] so we can delete it.

13. Changes to this Policy

When we update this Policy, we post the revised text at www.subnsub.com/privacy and update the "Last updated" date above. For material changes, we provide advance notice via a site banner, email, or both. If we ever introduce optional processing that relies on consent, we will ask for a separate opt-in.

14. Contact

For privacy questions or rights requests, contact [email protected].