Privacy Policy

Last updated: April 3, 2026

1. Data Controller

SubSync is operated by the SubSync team. For any privacy-related questions or requests, contact us at support@subsync.cc.

2. Data We Collect and Legal Basis

Account data: When you sign in with Google OAuth, we receive your email address, display name, and profile avatar. This information is used solely to identify your account. Legal basis: performance of contract (you create an account to use the service).

Usage data: We record sync counts, timestamps, and sync type (e.g., audio-based or shift-based) to enforce tier limits and improve the service. Legal basis: legitimate interest (service operation and abuse prevention).

Anonymous users: For users who do not sign in, we use your IP address for rate-limiting purposes only. The IP address is hashed and not stored in identifiable form. Legal basis: legitimate interest (abuse prevention).

3. First-Party Analytics

We collect analytics events using our own first-party system (no third-party analytics services are used). Events we track include:

  • Page views and tab navigation
  • File uploads (format and slot, not file contents)
  • Sync initiated, completed, or abandoned
  • Manual tool usage (offset, drift, sync points)
  • Download clicks
  • Sign-up prompts shown and clicked

Each event includes a timestamp. For signed-in users, events are associated with your account. For anonymous users, events are associated with a hashed IP address. We do not record subtitle content, file names, or any personally identifiable information in analytics events. Legal basis: legitimate interest (understanding usage patterns to improve the service).

4. Subtitle Files

Subtitle files you upload are processed entirely in memory. They are never written to disk, stored in a database, or persisted on any server. Once processing is complete, the data is discarded immediately.

5. Third-Party Services

SubSync relies on the following third-party services:

  • Cloudflare— hosting and edge compute (Workers)
  • Supabase— authentication and database
  • Google— OAuth provider for sign-in

Each of these services has its own privacy policy governing the data they process on our behalf.

6. Cookies and Local Storage

SubSync stores Supabase authentication tokens in your browser's localStorage to keep you signed in. We do not use tracking cookies, advertising cookies, or any third-party analytics that track individual users.

7. Data Retention and Deletion

Account and usage data is retained for as long as your account exists. Anonymous usage data (hashed IP records and analytics events) is retained for 90 days and then automatically deleted.

You may request complete deletion of your account and all associated data at any time by emailing support@subsync.cc. Upon deletion, all personal data is permanently removed from our systems.

8. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

  • Right to access — request a copy of all data we hold about you
  • Right to rectification — request correction of inaccurate personal data
  • Right to erasure — request deletion of your personal data
  • Right to restrict processing — request that we limit how we use your data
  • Right to object — object to processing based on legitimate interest
  • Data portability — receive your data in a structured, machine-readable format
  • Right to lodge a complaint — file a complaint with your local data protection supervisory authority

To exercise any of these rights, email support@subsync.cc.

9. Children's Privacy

SubSync is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. Your continued use of SubSync after changes are posted constitutes acceptance of the revised policy.

11. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please email support@subsync.cc.